Over 1,500 SingPass accounts hacked: IDA

By Nurul Azliah Aripin

Nurul Azliah Aripin

• Posts

By Nurul Azliah Aripin | Yahoo Newsroom – 13 hours ago

0users liked this commentThumbs UpThumbs Down0users disliked this comment

ricky l • a second agoRemove

2 FA OTP whether through hard-token or SMS will have prevent the changing of userid and password.

Even if userid and password are stolen by key-logger malware or by brute force, hackers still cannot change the password without getting through the 2FA which is not possible for hackers to break the One Time Password.

Reply

• 

  0users liked this commentThumbs UpThumbs Down0users disliked this comment

  ricky l • a second agoRemove
  

  Quite unlikely hackers had break in by brute force because the moment when false password is provided, the authentication page on next try will prompt to key in the security verification code - which is optical character generated by the system.

 

0users liked this commentThumbs UpThumbs Down0users disliked this comment

ricky l • a second agoRemove

Using soft token may not be a good idea because if an end-device is infected by keylogger malware, the keylogger will capture the keystroke when key in userid and password and the passcode that appear from the soft token can also be captured by the keylogger. If the keylogger allow the hackers to key in the captured userid, password and passcode faster than the compromised user, than the hacker can hack in.

If someone use SMS OTP through a smartphone, the SMS passcode generated by the telco network infrastructure (separate from the Singpass network infra) will still appear on the same smartphone device. If key logger infected the smartphone, then it can capture all the userid, password and passcode - similar effect like soft token where hacker can hack in faster than the user.

This is especially so if hacker can remotely take control of user device eg. through RDP or remote control software.

0users liked this commentThumbs UpThumbs Down0users disliked this comment

ricky l • a second agoRemove

2FA using hardware token or SMS OTP that uses the smartphone different from the device that access the Singpass will be safest - because keylogger malware of an infected device - cannot capture the OTP of a separate network and device generated by hardware token or SMS OTP from another smartphone.