In a closed-door meeting at a Manhattan mansion, executives outlined changes to controversial software that was implicated in two crashes.Aerospace & Defenseread more
Current and former Tesla employees working in the company's open-air "tent" factory say they felt pressure to take shortcuts to hit aggressive Model 3 production goals,...Technologyread more
Minutes from the Reserve Bank of Australia's monetary policy meeting in July showed the central bank was ready to adjust interest rates if required.Asia Marketsread more
The findings by McKinsey and Company come amid a year-long tariff fight between the U.S. and China, which has spilled into areas such as technology and security.China Economyread more
President Donald Trump and the RNC are picking up key supporters in the business community who did not back him as a candidate in 2016.2020 Electionsread more
Amazon workers in Minnesota and Germany are striking as Prime Day kicks off, in a stand against working conditions and wage practices. The action in Minnesota represents the...Retailread more
Treasury Secretary Steven Mnuchin is raising red flags ahead of Facebook's proposed cryptocurrency launch.Marketsread more
Beto O'Rourke's campaign for the 2020 election raised just $3.6 million in the second quarter of this year, putting him in the lower tier of candidates who have struggled to...2020 Electionsread more
Epstein is accused of sexually exploiting dozens of underage girls from 2002 through 2005 at his New York and Florida residences. He is a former friend of Presidents Donald...Politicsread more
When you think of Prime Day, you might be thinking about deals on Instant Pots and Amazon Echo devices — not half-off dresses and designer heels. But the market for apparel...Retailread more
David Marcus, the head of Facebook's digital currency project, said the company expects Libra will drive more advertising revenue for the company.Technologyread more
In a quest to make online accounts safer, many services now offer two-factor authentication. The system typically sends a code to a user's mobile phone that they need log in, along with a username and password.
Cybersecurity professionals have advised enabling two-factor to add an extra layer of security — but according to at least one expert, this may not be a silver-bullet. Kevin Mitnick, who was once the FBI's most wanted hacker and now helps companies defend themselves, found that two factor authentication can be vulnerable.
"Just by enabling two-factor authentication, you can't relax…a smart attacker could get access to your account," Mitnick said in an interview with CNBC. He is the chief hacking officer at KnowBe4, a cybersecurity company that trains people to spot phishing, or spoofed emails.
Mitnick told CNBC he found out about the vulnerability when it was posted online for anyone to find.
"The tool to actually pull these attacks off has been made public. So any 13-year-old could download the tool and actually carry out these attacks," he said.
According to Mitnick, the attack begins when a cybercriminal sends an email that looks real, and asks the receiver to click on a link.
Once the user clicks on the link, they are directed to log into the real website, including entering the code sent to their cellphone. Secretly, however, the log in went through the hacker's server and they were able to get the session cookie, the expert explained.
"If we can steal the user session cookie, we could become them, and we don't need their username, their password, or their two-factor," Mitnick said.
Mitnick showed CNBC that he was able to enter that code into his browser. "When I hit refresh I'm going to be magically logged into the victims account," he said.
Mitnick used LinkedIn to demo the attack for CNBC, but said many other websites are also vulnerable. The email he clicked on looked like a real LinkedIn connection request — but actually came from a fake domain, lnked.com. He said most people may not realize the difference.
"It's not LinkedIn that's vulnerable. It's the actual user… It's a security flaw with the human," Mitnick said.
In a statement, Mary-Katharine Juric, a LinkedIn spokesperson, told CNBC that the professional network took Mitnick's demonstration "very seriously," and that LinkedIn has "a number of technical measures in place to protect our members from fraudulent activity including phishing scams."
She added: "When we detect this type of activity, we work to quickly remove it and prevent future re-occurrences. We strongly encourage members to report any messages or postings they believe are scams, and utilize our member help center as a resource to educate and protect themselves from frauds online."
This attack is part of what is known as social engineering, when hackers take advantage of human behavior to get you to do something, like click on a link. Another way to protect yourself is to pay close attention to email you get, even if you use two-factor authentication.
"Social engineering if you do it right can be used to get into almost anything," said Stu Sjouwerman, KnowBe4'S CEO.
To protect from attacks like this one, some companies are making tools called security keys.
Instead of sending a code to your cell phone, security keys — which look like a keychain — contain a hardware chip, and use Bluetooth or USB to be the additional factor needed to log into your account. Recently, Google released its own version of the device, which it calls the Titan Security Key.
"The security key stores its own password and requires the site to prove it's legit before releasing the password and getting you signed in," said Mark Risher, Google's director of product management for security and privacy.
"It's not ubiquitous by a long shot but we are encouraged to see more and more sites and apps," he added.