Otto
Advanced
- Joined
- 22.09.20
- Messages
- 104
- Reaction score
- 423
- Points
- 63
Two-factor authentication (2FA) has long been known for the security it can bring to organizations and their customers. The combination of what you know, what you have, and what you are is the heart and soul of 2FA and helps explain ITS relative reliability.
Even so, attackers are known to have several ways to successfully attack 2FA, and it's your job as an ethical hacker to understand these potential attacks. This article will describe in detail the six main methods of attacking two-factor authentication and give you a complete picture of the types of two-factor authentication attackers that you may encounter while working as an ethical hacker.
What is two-factor authentication?
2FA is an authentication method that adds extra security. Rather than relying solely on the traditional username and password combination, 2FA schemes require users to enter passwords as follows:
There are two authentication methods:
1. Social engineering
Without a doubt, the best way to attack 2FA is through social engineering. 2FA relies heavily on knowledge that is known only to the user, and when a website or service that uses 2FA doesn't seem to work, users naturally turn to technical support. Attackers start communicating on behalf of technical support to force the user to reset their password or give them confidential information related to their 2FA.
This is a natural vulnerability point for 2FA, since any interaction with the technical support team will make the possibility of disclosing confidential user information almost inevitable, and only a few questions are asked (or none at all if the user voluntarily provides this information).
2. Hacking the cookie session.
Cookie session capture has been around since the advent of networked computers. It was said that there are hundreds of ways to capture a cookie session, even if 2FA is used for authentication.
A recently unveiled method for performing this technique was demonstrated by hacking expert Kevin Mitnick using a man-in-the-middle attack framework called evilginx. This method involved tricking the victim into visiting a domain with a typo and providing the user with a proxy login page; user interaction allowed evilginx to capture the user's credentials and authentication code, which are then transmitted to the legitimate site. The end result was a recorded session cookie that can be used indefinitely.
3. Duplicate code generator.
Depending on how your organization has implemented 2FA, code or number generators can be used to create "something you know" (see Google Authenticator).
"Random" number generators usually start with an initial value that is randomly generated, which in turn is used to generate the first number in the code. This first value is used by the algorithm to generate subsequent code values. If attackers learn the algorithm and seed, they can use this information to create a duplicate code generator that is identical to the compromised user's code generator.
4. Two-factor authentication "not required"
Some websites and services that allow users to use 2FA may not require this, which means that the user does not have a real 2FA. In contrast, access to 1FA will still be available to both the user and attackers, which means that attackers can use 1FA to access the site or service.
The worrying thing is that many widely used websites, including Facebook, LinkedIn, and Twitter, do not require two-factor authentication, even if they do offer it. In such cases, attackers can bypass two-factor authentication by providing answers to password reset questions that are much less secure.
5. BruteForce
What would authentication attacks be like without typical brute-force attacks? Even though 2FA offers better security than 1FA, brute force can help attackers get around this.
Brute-force attacks are possible if the 2FA authentication screen does not lock the account for a pre-determined number of failed attempts. This works like this: the attacker sends a password reset message to the compromised user's email address. The attacker can then go to that password reset email and set a new password, and then just pick up the user's 2FA code.
6. Two-factor authentication error.
Mistakes are still a fact of life in the modern world, and this extends to the 2FA world as well. Over the past year or so, there have been several examples of how this has affected widely used websites and services, including Uber.
The danger of a 2fa buggy is the sheer number of cars it can affect. For example, in 2017, The return of Coppersmith's Attack (ROCA) vulnerability was found to affect all 2FA products, including smart cards and TPM chips that use Infineon Technologies-generated RSA keys with a key length of 2048 or less (most of them). To this day, hundreds of millions of devices are affected.
Conclusion
Two-factor authentication was supposed to be a major security update for many websites and services, and in fact it is. In doing so, attackers exploited inherent flaws in the technology and its implementation to attack 2FA and eventually gain access to the website, service, and even the system.
Ethical hackers should be aware of these different 2FA attack methods. This is because there is a chance that at least one of these methods will be used against their organization at some point.
Thanks for your attention!
Even so, attackers are known to have several ways to successfully attack 2FA, and it's your job as an ethical hacker to understand these potential attacks. This article will describe in detail the six main methods of attacking two-factor authentication and give you a complete picture of the types of two-factor authentication attackers that you may encounter while working as an ethical hacker.
What is two-factor authentication?
2FA is an authentication method that adds extra security. Rather than relying solely on the traditional username and password combination, 2FA schemes require users to enter passwords as follows:
- Something you know: password, PIN, etc.
- Anything you have: a smart card, a USB token, etc.
- What you are on your own: voice, iris, fingerprints, etc.
There are two authentication methods:
- One-way: this is the most common type of authentication. This is a server-only/client-only method, and server-only authentication is most commonly used.
- Two-way (mutual authentication): both the client and server must authenticate using this method. It's not as common as one-way authentication, but it's more secure
1. Social engineering
Without a doubt, the best way to attack 2FA is through social engineering. 2FA relies heavily on knowledge that is known only to the user, and when a website or service that uses 2FA doesn't seem to work, users naturally turn to technical support. Attackers start communicating on behalf of technical support to force the user to reset their password or give them confidential information related to their 2FA.
This is a natural vulnerability point for 2FA, since any interaction with the technical support team will make the possibility of disclosing confidential user information almost inevitable, and only a few questions are asked (or none at all if the user voluntarily provides this information).
2. Hacking the cookie session.
Cookie session capture has been around since the advent of networked computers. It was said that there are hundreds of ways to capture a cookie session, even if 2FA is used for authentication.
A recently unveiled method for performing this technique was demonstrated by hacking expert Kevin Mitnick using a man-in-the-middle attack framework called evilginx. This method involved tricking the victim into visiting a domain with a typo and providing the user with a proxy login page; user interaction allowed evilginx to capture the user's credentials and authentication code, which are then transmitted to the legitimate site. The end result was a recorded session cookie that can be used indefinitely.
3. Duplicate code generator.
Depending on how your organization has implemented 2FA, code or number generators can be used to create "something you know" (see Google Authenticator).
"Random" number generators usually start with an initial value that is randomly generated, which in turn is used to generate the first number in the code. This first value is used by the algorithm to generate subsequent code values. If attackers learn the algorithm and seed, they can use this information to create a duplicate code generator that is identical to the compromised user's code generator.
4. Two-factor authentication "not required"
Some websites and services that allow users to use 2FA may not require this, which means that the user does not have a real 2FA. In contrast, access to 1FA will still be available to both the user and attackers, which means that attackers can use 1FA to access the site or service.
The worrying thing is that many widely used websites, including Facebook, LinkedIn, and Twitter, do not require two-factor authentication, even if they do offer it. In such cases, attackers can bypass two-factor authentication by providing answers to password reset questions that are much less secure.
5. BruteForce
What would authentication attacks be like without typical brute-force attacks? Even though 2FA offers better security than 1FA, brute force can help attackers get around this.
Brute-force attacks are possible if the 2FA authentication screen does not lock the account for a pre-determined number of failed attempts. This works like this: the attacker sends a password reset message to the compromised user's email address. The attacker can then go to that password reset email and set a new password, and then just pick up the user's 2FA code.
6. Two-factor authentication error.
Mistakes are still a fact of life in the modern world, and this extends to the 2FA world as well. Over the past year or so, there have been several examples of how this has affected widely used websites and services, including Uber.
The danger of a 2fa buggy is the sheer number of cars it can affect. For example, in 2017, The return of Coppersmith's Attack (ROCA) vulnerability was found to affect all 2FA products, including smart cards and TPM chips that use Infineon Technologies-generated RSA keys with a key length of 2048 or less (most of them). To this day, hundreds of millions of devices are affected.
Conclusion
Two-factor authentication was supposed to be a major security update for many websites and services, and in fact it is. In doing so, attackers exploited inherent flaws in the technology and its implementation to attack 2FA and eventually gain access to the website, service, and even the system.
Ethical hackers should be aware of these different 2FA attack methods. This is because there is a chance that at least one of these methods will be used against their organization at some point.
Thanks for your attention!
Edit Post