Multi-Factor Authentication Interception (T1111) is a credential access technique. MITRE lists Linux, macOS and Windows.
MFA is strongly recommended, and nothing here changes that. But some second factors can be captured or proxied by an attacker who already controls the machine or the message channel, and defenders should know which ones.
How attackers use it
MITRE describes targeting MFA mechanisms such as smart cards and token generators to gain credentials. Three situations are given:
- Smart cards. A keylogger can capture the password for a smart card during normal use. With the card inserted and the password known, an adversary can use the infected system to proxy authentication with the inserted hardware token.
- Hardware tokens. Keylogging can also capture input for tokens such as RSA SecurID, including the personal code. That may give temporary access, by replaying a one-time code until it rolls over, and could let an attacker predict future values if they also hold the algorithm and seed values.
- Out-of-band codes. One-time codes are often sent by email or SMS. If the device or service is not secured, they can be intercepted. MITRE notes that service providers can be targeted too, for example by compromising an SMS messaging service to steal codes sent to users' phones.
How to detect it
MITRE's strategy looks at input capture and smart card proxying. Analytics describe:
- On Windows, unexpected API calls that capture keyboard input, driver loads for keyloggers, or remote use of smart card authentication through logon sessions not started by local user interaction.
- On Linux, access to /dev/input, kernel modules loaded with insmod, or user input devices polled from non-user shells.
- On macOS, processes using TCC-protected input APIs or polling HID services without user interaction, or loaded keylogging frameworks using accessibility privileges.
Authentication logs help too: a smart card logon that no one was sitting at is a strong lead.
How to reduce the risk
MITRE lists user training: remove smart cards when not in use. That removes the window in which a card can be proxied.
Further steps that follow from the description: prefer phishing-resistant factors over one-time codes sent by SMS or email, protect the mailboxes and phone numbers that receive codes, and treat unexpected driver and kernel module loads as high priority.
Quick check
Why does MITRE tell users to remove smart cards when not in use?
With the card inserted and the password captured, an attacker can use the infected system to proxy authentication with the token.
Which MFA delivery method is exposed if the device or service is not secured?
One-time codes sent out of band by email or SMS, which can be intercepted.
Sources
- MITRE ATT&CK, Multi-Factor Authentication Interception (T1111)
