![\"email-hacking-300\"](\"https:\/\/www.ncr-iran.org\/en\/wp-content\/uploads\/sites\/2\/2015\/08\/email-hacking-300.jpg\" "\\"email-hacking-300\\"")
<\/p>\n<\/p>\n
Researchers have linked a sophisticated hacking scheme targeting Iranian dissidents back to Iran, the Associated Press reported on Thursday.<\/p>\n
A report released Thursday by the Citizen Lab at the University of Toronto\u2019s Munk School of Global Affairs describes how the hackers used text message and phone-based phishing to try to get around the security of Google\u2019s Gmail and access the accounts of their targets.<\/p>\n
The attacks studied by the Citizen Lab were very similar to others connected to Iranian hackers, the report says.<\/p>\n
According to the report, some of the attacks began when the targets received text messages that appeared to be from Google saying that there had been an unauthorized attempt to access their Gmail accounts.<\/p>\n
The hackers would then follow up with a carefully crafted email notification containing personal details and stating that the login attempt had been from \u201cThe Iran,\u201d boosting the fears of people already worried about Iranian hackers.<\/p>\n
The emails contained links directing the target to a page where they could reset their password. But in fact, the links were to phishing sites designed to collect the target\u2019s password. The hackers would then, in real time, use the password to login to the user\u2019s account and trigger the sending of an identification code to the target.<\/p>\n
Gmail uses the code as a form of two-factor authentication, which adds a second layer of security on top of a person\u2019s password. The hackers would then wait for the target to enter the code, collect it through the fraudulent website, and then use it to take control of the account.<\/p>\n
In other cases, the targets were contacted by phone by a person speaking English or Farsi, the predominate language in Iran, who would make a \u201cproposal\u201d related to the target\u2019s business activities. The fake proposal, usually promising thousands of dollars, would then be sent to the target\u2019s Gmail in the form of an email containing a fake Google Drive link.<\/p>\n
When the target clicked on the drive, they would be prompted to login with the Google credentials and ultimately the two-factor identification code, just like in the cases of the text messages.<\/p>\n
While attempts to circumvent two-factor authentication security are nothing new when it comes to financial fraud-related hackings, the practice is fairly new to politically motivated attacks.<\/p>\n
\u201cIt may be that, as a growing number of potential targets have begun using two-factor authentication on their email accounts out of a concern for their security, politically motivated attackers are borrowing from a playbook that financial criminals have written over the past decade,\u201d the report reads.<\/p>\n
The report emphasizes that these kinds of attacks are increasing, boosting the importance of two-factor authentication.<\/p>\n
It notes that in the case of these hackers, the existence of the code significantly increased the amount of work required. The hackers were forced to actively monitor the phishing site and enter the information they collected in real time in order to take control of the accounts.<\/p>\n
Without the existence of the code, the hackers could have just collected passwords through the fake website at their leisure, the report says.<\/p>\n","protected":false},"excerpt":{"rendered":"
Researchers have linked a sophisticated hacking scheme targeting Iranian dissidents back to Iran, the Associated Press reported on Thursday. A report released Thursday by the Citizen Lab at the University […]<\/p>\n","protected":false},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[175],"class_list":{"0":"post-19014","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-iran-a-world","7":"tag-updated"},"yoast_head":"\n