Given
- Attacker is targeting a user of
bank.com
. bank.com
uses SMS or Google Authenticator 2FA, where the user enters the 2FA code into a form.
Scenario
- Attacker registers domain name
baank.com
- Attacker creates a web page that scrapes the login page of
bank.com
and presents it from the domainbaank.com
(or working as a MITM proxy to send user supplied details back tobank.com
if needed). - Attacker sends a phishing email to the user getting them to log in to
baank.com
instead ofbank.com
. - User fills in their username, password, and 2FA (as per usual).
- Attacker now has the users credentials as well the 2FA that the user supplied.
- Attacker immediately (maybe through a script) logs in to the bank account since he has the username, pass, and 2FA.
Question
Am I missing something or does user-entered 2FA not help in this scenario?