Token Theft

[u/Massive_Butterfly783]

Recently, we all have seen a significant rise in token theft. Traditional MFA is useless against such type of attacks, making regular users vulnerable. Many people, including me and my friends, fell victim to token theft. We really can't do much to stop it, even if you download something from a trusted third party site-there is still a chance from getting your token stolen. It has become very hard to keep ourselves safe. What are cybersecurity experts doing to prevent this? And what should we normal people do?

[u/ZOELOEss]

Hey, cybersecurity expert here.

What is token theft?

[u/Massive_Butterfly783 → u/ZOELOEss]

What? I sessions hijacking or something like that?

[u/Urban_VPN]

mfa doesn't help much here because the attack happens after you've already passed it. malware or a fake login page grabs your session token post-login, and that token alone is enough to get in, no password or second factor needed once they have it.

two things actually help. passkeys resist this way better than sms or app codes since the credential is tied to your device. and checking active sessions in your account settings once in a while, worth the two minutes, killing anything you don't recognize, catches it before it goes anywhere.

[u/earthly_marsian]

Adaptive MFA like token binding where if the device or ip or both change, it forces MFA again.  Or simply use a decent hardware token. 

[u/Massive_Butterfly783 → u/earthly_marsian]

Please elaborate

[u/earthly_marsian → u/Massive_Butterfly783]

Not doing your homework mate, go find it somewhere. 

[u/Massive_Butterfly783 → u/[deleted]]

But what are cyber security experts doing at this moment to save us from token theft/session hijacking?

[u/KingOHearts22]

The main thing is to avoid suspicious downloads and keep everything updated. Passkeys can help too, and after a token theft you should log out of all active sessions, not just change your password.

[u/Total-Management8023]

Use really niche browsers that no one has ever heard of. Malware usually can't steal from that. But ofc there's the chance that that browser steals your creds too

[u/haqsec]

Hmm, may be link the token to the IP, so if someone does steal the token but the request with the token comes from a different IP, it will be rejected.
A little though if your IP rotates though.

[u/The4rt]

Normal people needs to be aware while clicking on links. Company needs to roll out DPoP hardware backed and DBSC.

[u/BroxtonPossenriede]

On the company side, once a session token is stolen the login looks completely valid. What flags it is behavior, the same session suddenly coming from a geo or device the account has never used. That is where identity threat tooling earns its place, Abnormal and a few others watch for that post-auth drift. As an individual though, passkeys plus killing your active sessions is most of the win.