The attack was a Man-in-the-middle (MIM) attack where smart tactics were employed to even produce errors originally generated at citibank web site.
http://blog.washingtonpost.com/securityfix/2006/07/citibank_phish_spoofs_2factor_1.html : "The site asks for your user name and password, as well as the token-generated key. If you visit the site and enter bogus information to test whether the site is legit -- a tactic used by some security-savvy people -- you might be fooled. That's because this site acts as the "man in the middle" -- it submits data provided by the user to the actual Citibusiness login site. If that data generates an error, so does the phishing site, thus making it look more real"
http://isc.sans.org/diary.php?storyid=1478 : "Overall, two factor authentication will reduce the risk of attacks by raising the effort of the attacker to compromise the accounts, but it might not have the level of security enhancement that some people believed. In the man-in-the-middle attack, the flaw happens due to the lack of verification of the bank's website by the victim, the victim are simply tricked into yielding credentials to a web site without authentication. This is really outside of the protection zone of the extra authentication factor.
To further extend this, two factor authentication also does NOT protect the end host security, a malware (such as keylogger, BHO) could be installed on the client's machine and effectively gather the credential and login on behalf of the victim instead of letting the victim login.
This is a classic problem of "you are only as secure as the weakest link". Two factor authentication is good for secure authentication but does not take care of mutual authentication or endpoint security. From the financial organization perspective, maybe further investment into mutual authentication and ensuring client's computer being free of malware would be necessary to protect the client's online transactions."
In the above blog entry at sans.org (Handler's diary) Jason mentions that 2 factor authentication is good for secure authentication but does not take care of mutual authentication or endpoint security. This is partly true as it really depends on the 2 factor authentication device being used. Most of the time consumers and enterprises consider one-time-password generating device (such as RSA Secure ID) to be the 2-factor authentication device as they do satisfy the notion "something you know and something you have" but there are 2 factor authentication devices such as smart cards which have lot to offer in terms of end-to-end security and thus are helpful in tackling man-in-the-middle attack.
Handler's diary points out that to fight against MIM mutual authentication is required and this is where smart cards (especially that of current generation where they are capable of getting easily plugged with enterprises following new standards such as Liberty Alliance and WS-*) distinguish themselves from just being the user authentication device and can also perform (even customized) web site/portal/server authentication.
In one of the his article (Authentication : The Pitfall of Two factor authentication) Jason says:
"In the phishing scenario, challenge response type of second factor seems to be problematic to the phishers. However, that really isn't stopping all the attackers. The desperate ones can still leverage Man in the middle type of attack. There are a few ways for man in the middle attacks to work. One is to put up a look-alike malicious site which is basically a proxy to the actual bank's website. When the victim login with proper credentials, the attacker can simply ride on that established online banking session. Notice that even challenge-response type of token would work in this case because the attacker (or the man in the middle) is passively observing the connection between the bank and the victim. The challenge will reach the victim, who will then send in the response. The attack simply proxies the traffic until the session is establish and then sends in the fraud transaction."
I would say that key here is to do all the transactions that need security over 2 way SSL where mutual authentication is required between device (& thus the user) and web server and all communication happens encrypted with a session key negotiated between device and web server. This way session hijacks could be prevented (correct me if I am missing something).
Solution lies in the mutual authentication and communication over secure channel between a smart device (such as smat card) and web server.