5 ms·

> Hunt said GitLab has implemented multi-factor authentication and that would have protected employees had the attack not been a simulation. "Protected employe

> Hunt said GitLab has implemented multi-factor authentication and that would have protected employees had the attack not been a simulation. "Protected employees" is a weird way to put it to say the least. It's not about protecting employees, it's about protecting gitlab company and their customers. And the protection would have failed. The attacker would have needed to use the credentials (including the one-time credential) in real-time. That makes the attack-site logic a bit more difficult, but it would have allowed to break in. I doubt gitlab employees have to reauthenticate very often during a working day. Well, unless they really use a challenge response system. At least what I use as a gitlab customer is not, it's just standard OTP. I would provide a valid one time password to a phishing site, should I fall for it. (Edit: reworded. Commenting on the phone is never a good idea...)

tialaramex 6y ago
Most challenge response systems don't help either, the attacker gets to forward the challenge to you, and then your response back to the real site. It's some extra work but you can get ready-made software to help perform this attack. WebAuthn (and the older U2F) works, because it's recruiting the browser (which knows perfectly well which site this is) to mint site-specific credentials every time. An attacker with a phishing site https://fake-gitlab.example/ https://fake-gitlab.example/ has a few options, none of which work out for them: * Just don't do WebAuthn, now they don't have a second factor and can't get in * Ask the browser for legitimate WebAuthn credentials for fake-gitlab.example. But, of course GitLab won't accept those credentials, any more than it'd accept a made-up username so they're useless. * Show the browser the "cookie" GitLab offered for GitLab WebAuthn credentials, the browser will cheerfully give a user's FIDO dongle this cookie and the fake-gitlab.example name, and the dongle will explain that it doesn't recognise the combination, maybe use a different dongle? No joy. * Show the browser that cookie and tell it this is gitlab.com. But this is fake-gitlab.example not gitlab.com, so the browser will just raise a DOMException SecurityError in the fake site's JS code. The code can hide that easily, but it doesn't get any credentials.
- usr1106 6y ago
  Thanks for mentioning https://en.m.wikipedia.org/wiki/WebAuthn https://en.m.wikipedia.org/wiki/WebAuthn According to Wikipedia Dropbox supports it. Any other widely used adopters? Need to check whether gitlab supports when I am at my computer. So it might well be that they even mandate it for their employees. But the statement or at least the part of the statement that made it to the article was not that specific.
  - Nullabillity 6y ago
    Google, GitHub, GitLab all support it, at least. Azure AD, notably, does not.
    - madjam002 6y ago
      Azure AD does, and was one of the first to adopt the new WebAuthN standard. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment#plan-passwordless-authentication-with-fido2-security-keys https://docs.microsoft.com/en-us/azure/active-directory/auth... You can also use it on a personal Microsoft account.
      - Nullabillity 6y ago
        I guess it might be a premium feature then? It certainly doesn't show up as an option for me..
  - tialaramex 6y ago
    My understanding is that Google mandates U2F (the de facto predecessor to WebAuthn) for employee systems, certainly the Google employees I know have FIDO keys. One interesting thing is that some of them don't really understand how those keys work - and the U2F/WebAuthn design means that doesn't matter at all. I believe way more firms should do this and I've tried to gently encourage it at places I've worked. Older sites tend to support U2F rather than WebAuthn. If you're on a greenfield install, you should just do WebAuthn, but it can be complicated in some scenarios to migrate from U2F especially if you're huge so it's understandable that not all have. In at least Chrome and Firefox the UX is identical anyway. So, not differentiating them: Facebook, GitHub and Google are three popular examples You can also authenticate for some US Federal Government business on Login.gov (even if you aren't a US citizen) And the UK's "Gov.uk verify" authentication can use Digidentity's offering which in turn relies on WebAuthn or U2F. Edited to add: AWS can do it, but, for some crazy reason they won't let you register more than one FIDO dongle. So I would not advise securing an "admin" AWS account this way, only users who can go to someone with admin privs to reset if they lose the dongle, but it's good for a team of developers I guess. Not allowing multiple dongles goes against the intended security design, ignores a SHOULD in the WebAuthn standard, and also makes a bunch of the fairly complicated design pointless, I can't tell if Amazon are incompetent or had some particular weird reason to do it.
Nullabillity 6y ago
Gitlab.com has used U2F/WebAuthn for years (not sure which, but they're both isolated by origin anyway).
- usr1106 6y ago
  Right, according to https://en.m.wikipedia.org/wiki/Universal_2nd_Factor https://en.m.wikipedia.org/wiki/Universal_2nd_Factor it's U2F. So I would not be surprised if gitlab requires their employees to use the dongle instead of simple OTP which they allow for customers/users. A shortcoming of the article not to mention whether that's the case or not.
- emilycook 6y ago
  I work at gitlab and just stumbled across this, we use U2F but we have an MR to add WebAuthn support https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26692 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26692

tialaramex 6y ago

Most challenge response systems don't help either, the attacker gets to forward the challenge to you, and then your response back to the real site. It's some extra work but you can get ready-made software to help perform this attack. WebAuthn (and the older U2F) works, because it's recruiting the browser (which knows perfectly well which site this is) to mint site-specific credentials every time. An attacker with a phishing site https://fake-gitlab.example/ https://fake-gitlab.example/ has a few options, none of which work out for them: * Just don't do WebAuthn, now they don't have a second factor and can't get in * Ask the browser for legitimate WebAuthn credentials for fake-gitlab.example. But, of course GitLab won't accept those credentials, any more than it'd accept a made-up username so they're useless. * Show the browser the "cookie" GitLab offered for GitLab WebAuthn credentials, the browser will cheerfully give a user's FIDO dongle this cookie and the fake-gitlab.example name, and the dongle will explain that it doesn't recognise the combination, maybe use a different dongle? No joy. * Show the browser that cookie and tell it this is gitlab.com. But this is fake-gitlab.example not gitlab.com, so the browser will just raise a DOMException SecurityError in the fake site's JS code. The code can hide that easily, but it doesn't get any credentials.

usr1106 6y ago
Thanks for mentioning https://en.m.wikipedia.org/wiki/WebAuthn https://en.m.wikipedia.org/wiki/WebAuthn According to Wikipedia Dropbox supports it. Any other widely used adopters? Need to check whether gitlab supports when I am at my computer. So it might well be that they even mandate it for their employees. But the statement or at least the part of the statement that made it to the article was not that specific.
- Nullabillity 6y ago
  Google, GitHub, GitLab all support it, at least. Azure AD, notably, does not.
  - madjam002 6y ago
    Azure AD does, and was one of the first to adopt the new WebAuthN standard. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment#plan-passwordless-authentication-with-fido2-security-keys https://docs.microsoft.com/en-us/azure/active-directory/auth... You can also use it on a personal Microsoft account.
    - Nullabillity 6y ago
      I guess it might be a premium feature then? It certainly doesn't show up as an option for me..
- tialaramex 6y ago
  My understanding is that Google mandates U2F (the de facto predecessor to WebAuthn) for employee systems, certainly the Google employees I know have FIDO keys. One interesting thing is that some of them don't really understand how those keys work - and the U2F/WebAuthn design means that doesn't matter at all. I believe way more firms should do this and I've tried to gently encourage it at places I've worked. Older sites tend to support U2F rather than WebAuthn. If you're on a greenfield install, you should just do WebAuthn, but it can be complicated in some scenarios to migrate from U2F especially if you're huge so it's understandable that not all have. In at least Chrome and Firefox the UX is identical anyway. So, not differentiating them: Facebook, GitHub and Google are three popular examples You can also authenticate for some US Federal Government business on Login.gov (even if you aren't a US citizen) And the UK's "Gov.uk verify" authentication can use Digidentity's offering which in turn relies on WebAuthn or U2F. Edited to add: AWS can do it, but, for some crazy reason they won't let you register more than one FIDO dongle. So I would not advise securing an "admin" AWS account this way, only users who can go to someone with admin privs to reset if they lose the dongle, but it's good for a team of developers I guess. Not allowing multiple dongles goes against the intended security design, ignores a SHOULD in the WebAuthn standard, and also makes a bunch of the fairly complicated design pointless, I can't tell if Amazon are incompetent or had some particular weird reason to do it.

Nullabillity 6y ago

Gitlab.com has used U2F/WebAuthn for years (not sure which, but they're both isolated by origin anyway).

usr1106 6y ago
Right, according to https://en.m.wikipedia.org/wiki/Universal_2nd_Factor https://en.m.wikipedia.org/wiki/Universal_2nd_Factor it's U2F. So I would not be surprised if gitlab requires their employees to use the dongle instead of simple OTP which they allow for customers/users. A shortcoming of the article not to mention whether that's the case or not.
emilycook 6y ago
I work at gitlab and just stumbled across this, we use U2F but we have an MR to add WebAuthn support https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26692 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26692