Kevin Surace: How AI-driven relay attacks bypass MFA and how biometric hardware prevents them
Kevin Surace explains how hackers use AI to create pixel-perfect fake websites that facilitate man-in-the-middle relay attacks to steal MFA credentials. He describes how Token's biometric ring and bio stick use proximity and domain-specific encryption to stop these phishing attempts. The discussion also covers the profitability of state-sponsored hacking and the future of AI agents in large enterprises.
Kevin Surace was a guest. Charles Cormier hosted. This is not a client result. The quotes and answers below are from the episode.
What they said
“90% of all ransomware oriented hacks happen uh right in the front door they happen because people have hacked your credentials”
“I use AI to generate uh a pixel perfect uh internal employee website. Okay? Something that has access to data, whatever that is. So, I generate that”
“The hacker is logging in on my actual employee site. Okay. Now, the site comes up and it says, 'Oh, um, go to your off app and it'll come up and it'll say, is this you logging in?'”
“you have to be within three feet of the computer logging in because it's the local browser that kicks you off and says use your token product”
“Most so most of the hackers are um uh Russia, North Korea, China and often they're government sponsored and and uh and Iran those four countries”
From the episode
How do hackers use AI to facilitate phishing?
Hackers use AI to generate pixel-perfect copies of internal employee websites and craft emails that are indistinguishable from legitimate communications. These fake sites then relay user credentials to the hacker in real-time.
What is a man-in-the-middle real-time relay attack?
It is an attack where a fake site captures a user's login ID, password, and MFA code, then immediately relays that information to the hacker who logs into the real site. This happens simultaneously, making traditional MFA ineffective.
How does the Token ring prevent remote hacking?
The device requires the user to be within three feet of the computer and uses biometric fingerprint verification that is cryptographically tied to a specific domain. This ensures that even if a user is tricked by a fake site, the authentication process will fail.
Why are large companies like airlines and hospitals primary targets for ransomware?
These organizations have thousands of employees, and statistically, a small percentage will always fall for sophisticated phishing attempts. Hackers target them because stealing their data or customer lists provides significant leverage for demanding ransom payments.
The interview is the meeting.
We book conversations like this for founders. You take the meeting.
Book a callFull transcript on charlescormier.com