14 ms·

The Rise of One-Time Password Interception Bots

187 points by elorant 5y ago

gtirloni 5y ago
It's not intercepting anything. It's classical social engineering that got automated with bots.
- hoarad 5y ago
  indeed. it s still the user fault
  - Finnucane 5y ago
    Right. If you want good security, just remove the users.
hannob 5y ago
Ultimately what this shows is that two factor authentication with either TOTP (aka Google Authenticator) or SMS is not ideal. It makes phishing harder for the attacker, but it does not prevent it. Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol.
- julianlam 5y ago
  I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. The fault here lies with victims answering a prompt to enter their 2FA out of the blue. Just as with passwords and other such info, the bank will never request it for no reason. A hardware token using webauthn protocol is most secure though, yes.
  - md_ 5y ago
    The fault with phishing _always_ lies with the victim, by this logic. Put differently: if you assume the user to be infallible, there's very little reason to use 2FA of any kind. (Don't believe me? Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.)
    - jdavis703 5y ago
      I leave my work desk to grab a coffee. An attacker adds a hardware keylogger between my keyboard and computer. When I come back 5 minutes later I don’t sweep for any hardware modifications. Now they have my password.
      - UncleMeat 5y ago
        This threat model is orders of magnitude less likely than something like phishing. It is not scalable for attackers and simply doesn't work for anybody who works from home or works in a location with meaningful physical security. It also isn't defeated by 2FA, since they've physically installed something on your machine to detect your keypresses. They just capture your password and the sms code.
        jdavis703 5y ago
        The post asked to “Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.” Defense in depth is absolutely a thing. Now does your grandfather need this level of security? Probably not. But that doesn’t mean multi-factor is worthless.
        UncleMeat 5y ago
        But it isn’t. The key logger steals your second factor code just the same.
        nyuszika7h 5y ago
        That only works if the site allows replaying codes and it doesn't expire before the attacker logs in with it.
  - hsbauauvhabzb 5y ago
    I work in infosec, I literally write phishing sites. A good phishing site with MFA would easily fool me. How’s grandma gonna stand a chance?
    - tialaramex 5y ago
      WebAuthn saves granny though. Because it's so easy that granny can't get confused. The best way forward under WebAuthn is to have her physically send them her Security Key. Now, granny may not be down with the latest Tik Tok trends, but she has seen keys before, and the analogy is strong - so I think she can get this right. To be fair, scammers have been successful with scams that involve an actual bike courier (presumably the scammer or a friend) coming to pick up your bank card, but that at least feels a bit reasonable because it does say the card remains property of the bank, so, sure, have your card back. And I'm also guessing this is a much higher friction scam than the average "Phone support in India" setup. I reckon scam dozens of people for their card this way and somewhere around the 100 victims mark the guy opening the door to your courier has a baseball bat, or worse, and your courier has a bad day.
  - dotancohen 5y ago
    > The fault here lies with victims answering a prompt > to enter their 2FA out of the blue. Go wish 10 random people happy birthday. For some people such a greeting is relevant for one day only. For others, a week. For some people, especially if the don't recognize you and think that "it's been a long time" a whole month is valid. If one is using a dozen services that auth with 2Fa and needs to log in once per day, that's a lot of windows of opportunity. Multiply that by 86,400 numbers phished that day.
  - UncleMeat 5y ago
    We've spent years and years and years trying to train people to resist phishing. It doesn't work. Even actual literal security professionals fall for it. If you use a thing with such common known failure modes, it is your responsibility for using that thing. Phishing is enormously more common than sim-swapping because, as described in TFA, it can be fully automated. Going from SMS to TOTP fixes a rare attack but does not fix a common attack.
    - Laforet 5y ago
      So what other options do we have available? We have tried client certificates, hardware tokens, biometrics and a tonne of heuristics. None of these could do much to stop an attack when the user is cooperating with the scammer.
      - UncleMeat 5y ago
        Webauthn works. You cannot sign a message for the wrong origin. The core problem here is that everybody needs access to some sort of hardware to do this and they need systems to handle the inevitable loss of that hardware.
        withinboredom 5y ago
        Literally Windows and MacOS has this built-in. But you’re right, the hard part is losing the token or it breaking. I slammed one Yubikey in a door, breaking it in half. I’m on my backup but I still find services where I didn’t enroll the backup and have to go through a lengthy process to regain access to my account (or create a new one).
      - jdavis703 5y ago
        Hardware tokens and biometrics are better because it makes it harder for the scammer to describe a plausible scenario to intercept the authentication. In one of the linked articles the scammers pretended to send a one-time token and asked the victim to read it back. This is the same process my top-10 US-based bank uses, so it wouldn’t necessarily raise any red flags.
  - ezekg 5y ago
    Sort of off-topic -- but related to "they would never request that" -- recently, I reached out to Hover's support due to a billing issue. The support agent eventually asked me for my 2FA code and I literally sat back in my chair and mumbled "...what?" I told them, "absolutely not." Then I told them that typically, they would request access and then I would have to approve it. They then proceeded to follow protocol. This agent was literally asking to take over my account, and I guess they can bypass passwords but not 2FA. I know Hover != $Bank, but regardless, it made me very uncomfortable and has me second guessing Hover's security practices.
    - flixic 5y ago
      Banking systems in Baltic countries use a unified 2FA system called SmartID[0]. When authenticating to bank via phone, they ask for two things: your user ID (which is not secret), and to authenticate using Smart ID, which means entering a PIN on your phone. However, each PIN entry is accompanied by "code check": bank's support person says their 4 digit code, and you can verify that it matches on request for PIN screen. This neatly prevents someone pretending to be a bank during a call, because each PIN request uses a different "code check". [0]: https://www.smart-id.com https://www.smart-id.com
      - londons_explore 5y ago
        It can still be man-in-the-middle'd. Theres no way to know the attacker isn't calling you on one line while calling your bank on the other. As soon as you've authenticated, they'll continue talking to your bank, and fob you off with some excuse like "oh, the system is down, can you call back tomorrow".
      - btown 5y ago
        Is it still vulnerable to a MITM attack though, e.g. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ? Attacker wants Victim's code. Attacker calls the Bank impersonating Victim, and also calls Victim impersonating the Bank. Bank tells Attacker the code check, Attacker tells Victim the code check, Victim sees the match and enters their PIN into the Smart-ID app, and Attacker's phone session with Bank is now fully authenticated and has no more need for Victim.
  - jrochkind1 5y ago
    In the linked article on the words "the scammers can get around that, too" [1], there's an account that claims the legit bank did in the past ask for the 2FA on a phone call, in pretty much exactly the same way the scammers did. > Mitch said his financial institution has in the past verified his identity over the phone by sending him a one-time code to the cell phone number on file for his account, and then asking him to read back that code. The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons". It is very hard for the end-user to tell what 2FA request is "for no reason". I think we need to focus not on what the "reason" is or if it's "out of the blue", but, the equivalent of "call them back" for online too -- don't click on a link in an email, etc. No matter what, it's not easy, especially for less technical users. The linked account is a security professional that fell for it -- I personally don't have the hubris to think I never would. There have been times when an actual bank asks me to do something I know is insecure, and I consider resisting it, but I just didn't have the energy for it, I figured it really was the real bank just being idiotic and I wanted to get on with my day (and guess what, it was, I was right). [1]: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...
    - londons_explore 5y ago
      While "call them back" is good practice, you should remember that even outgoing telephone calls aren't authenticated or encrypted. An advanced enough attacker can totally redirect your outbound calls too - it's just a little harder without an insider in your phone network.
      - smiley1437 5y ago
        So to be safe, I should call them back on a one-time use burner phone? What would you recommend for the call back?
        5y ago
  - mint2 5y ago
    When you call Amex for a while (and maybe still) will send a onetime password for things that need added verification and ask you to share it with them. The text itself says don’t ever share it.
  - time0ut 5y ago
    Some banks will request a 2FA code. I had Citi call me, then send me a code via SMS, then ask for the code on the phone. The SMS looked identical to the one I would get when logging in. My spider sense started tingling and I declined and hung up. Called them back directly and sure enough it was really them.
  - hamburglar 5y ago
    Unfortunately, both Microsoft and Apple have conditioned users to just provide their credentials out of the blue when asked. Microsoft in office, which just randomly asks me for my credentials to perform some communication between app components (I see this a lot when opening powerpoints for some reason), and Apple because my iOS devices are constantly wanting me to re-auth with my appleid. So people probably don’t think twice about it. I know my kids think constantly canceling an appleid login prompt without reading it is just part of using an iPad.
    - donmcronald 5y ago
      This is the biggest issue. Some sites ask for your TOTP every time you log in, so a phishing site asking for it won’t seem out of the ordinary.
  - dheera 5y ago
    Are there any major US banks that support web'n'auth?
  - indymike 5y ago
    > I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. At present, you are right. In the future, this may not be true, especially the "will stop nearly all attempts" part of what you are saying because the weakness in any security strategy is people.
- hsbauauvhabzb 5y ago
  Hardware tokens were commoditised by yubikey but they really should be TPM based, until there’s critical mass it’ll be a nuanced technology and Yubikey clearly don’t have the clout.
  - md_ 5y ago
    TPM-based like...Windows Hello? Both Windows and Mac support host-based FIDO keys. Of course, the downside here is that you...can't move them to a new computer. So they're sort of hard to use on their own, hence people still turn to portable (but less secure) solutions like TOTP and SMS.
    - hsbauauvhabzb 5y ago
      Fair point, I’m not super familiar with hello. The problem of cross-computer access is solvable* - add cryptographic trusts to transport encrypted data across insecure hardware. *I didn’t say it’d be great user experience though.
      - md_ 5y ago
        Yep, Apple solves this by moving FIDO key material around via iCloud, I believe. But it requires a good syncing mechanism like that. In principle it's similar to the password manager problem, which is a bit ironic: if everyone used password managers, most of the same security issues would be resolved. (There are a few cases where a FIDO key is better than a password manager, but not many!)
  - chopin 5y ago
    The Yubikey at least requires me to press it in an authentication process. If it's software only an attacker could gain access stealthily. It's already hard to trust OS and browser. Therefore I'd prefer a physical interaction on a device where the behavior cannot be altered.
    - hsbauauvhabzb 5y ago
      TPM is a hardware chip which effectively implements the same concepts as yubikeys but predates them by about a decade.
- ttul 5y ago
  An increasing number of websites are now offering their own authentication app, which uses a secure back channel to push authentication requests down to the user’s device. While it’s a pain to have a dozen authentication apps on your phone, IMHO this method is just as secure as a hardware module while being much more convenient. I’m sure that there is a start up that recently announced itself here on hacker news that is creating a universal authentication app that will allow any website to authenticate users in this way. Great idea.
  - withinboredom 5y ago
    Authy?
  - donmcronald 5y ago
    How does that help? If I put my credentials into a phishing site and then get a prompt on my phone to approve a login, why wouldn’t I click approve? Plus, then the attacker often gets a cookie showing their device passed 2FA.
    - ttul 5y ago
      The newest authenticators make a fingerprint of your browser and use that to select a random number that they show you in the app, along with other "controls". You have to pick the correct number, which of course the attacker will not have.
  - chrisbolt 5y ago
    And what’s the recovery method for the authentication app? If it involves SMS...
    - ttul 5y ago
      The best practice is a piece of paper with backup codes on it. And if you don't store that properly, you're out of luck. Nothing is perfect, but paper in a safe is pretty good. The cryptocurrency world has introduced titanium backup code holders, where the code letters are literally etched into titanium. Bullet proof, fire proof, etc..
- ufmace 5y ago
  > Hardware tokens with the webauthn protocol It'd be nice, but support for them around the web seems to be mostly terrible. Only a tiny handful of sites support it at all, and most of the ones that do support it don't support more than one, which seems kind of essential to actually use it long-term and guard against the tokens breaking or getting lost or damaged.
  - tialaramex 5y ago
    > most of the ones that do support it don't support more than one Do you have any examples besides AWS?
    - ufmace 5y ago
      Well now that you mention it... I had been thinking of Github and Cloudflare, but I actually just checked both of them and they do now allow multiple keys to be registered. So I guess that's gradually getting better. It's still pretty amazing that AWS still doesn't allow multiple 2FA methods though.
- u801e 5y ago
  > Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol. This could also be done using client side TLS certificates without restricting the application protocol used on top of the TCP connection.
- toast0 5y ago
  Two factor with a code device (totp, rsa token, sms, etc) isn't effective for phishing, but it is effective against non-interactive attacks like cracking password files or brute force or password reuse. Something like webauthn that ties the token to the usage context and so addresses phishing (until the host security is broken) and also addresses non-interactive attacks is clearly better from that perspective, but it's not as easy to setup two of those as it is to setup TOTP on two devices at the same time or be able to put your SIM in another phone or get a new SIM (this is, or course, a negative if someone else gets a new SIM for your number). And then there's the extra cost (until/unless it's more integrated into devices people already have)
  - CyberRage 5y ago
    the hell are you talking about? why make out wrong "facts"? 2FA is very useful against phishing: https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html https://security.googleblog.com/2019/05/new-research-how-eff...
    - toast0 5y ago
      It doesn't work so well if the phishers also make a 2fa phishing page. People confused enough to put in their password on the login page will also put it on the 2fa entry phishing page.
      - CyberRage 5y ago
        I work in the industry if it wasn't obvious though for years now nothing to do with phishing but I do have some experience shall we say. 1. Building a phishing page and can accept 2FA and in real time(remember code is useless after 30 sec) logs in to an account is much harder. most attacks are low quality junk. 2. From a detection standpoint, this is awesome. the attacker has to log in real-time. he will likely send that link to hundreds of people = good telemetry to detect anomalies\fraudulent logins. 3.* Another pain I remember observing was regarding the login process itself. Websites tend to change their log in UI\processes, different websites have different layouts. This makes it frustrating and tedious maintain, bank changes the login prompt, attacker has to modify code to accommodate that. 4. Data doesn't lie, it is not bulletproof but it does offer significantly higher level of protection. saw that in actual enterprise with my own eyes.
- qqii 5y ago
  Correct me if I'm wrong, but won't WebAuthn with hardware tokens still be vulnerable to MITM phishing attacks? Ones where the attacker sets up a convincingly fake website and forwards the signature to the actual server?
  - BenjiWiebe 5y ago
    The signature will be for the convincing fake and won't be valid for the real site. Plus, your hardware key won't even recognize the fake site as an enrolled site, and won't even generate a signature for the fake site! I think that's mostly right anyways. There's a very helpful explanation somewhere upthread and that's what I understood from it.
thunderbong 5y ago
Key point from the article - > This service (and all others mentioned in this story) assumes the customer already has the target’s login credentials through some means. > OTP Agency customers would enter a target’s phone number and name, and then the service would initiate an automated phone call that alerts that person about unauthorized activity on their account. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”), and that code would then get relayed back to the bad guy customers’ panel at the OTP Agency website.
- nextos 5y ago
  There are OTP algorithms that allow both parties to identify each other (not just one way where the server confirms the identity of the client), so you can't be subject to a MITM attack. In EU, 2FA is mandatory, but it's really frustrating that the law allows to use SMS codes as a second factor. The typical hack in my country is to use a rogue employee in a phone shop to clone a SIM card, and then you are screwed up.
  - jrimbault 5y ago
    Can eSIM be cloned ?
    - g_p 5y ago
      Yes - eSIM is just the same keys used in 3GPP, but distributed differently. You could do a "SIM swap" to a traditional SIM in exactly the same way, using phone customer support or retail store IT.
  - tinus_hn 5y ago
    And of course allow resetting the password over sms.
- deleted 5y ago
  [deleted]
jaywalk 5y ago
Push notifications to a smartphone app for login approvals is by far the most convenient 2FA method and also more secure than TOTP or SMS. I use it wherever I can.
- tialaramex 5y ago
  Push notifications mean that if you believe you're logging in, and the crook is actually logging in, (not a coincidence, they understand how this works) you get a push notify, which you accept because you think you're logging in, and you thereby let the crook in. Brilliant. Prefer WebAuthn.
  - jaywalk 5y ago
    With Okta, it tells you the approximate location of where the login request is coming from. So unless the crook happens to be in the same city as me, I'm going to immediately see that something is wrong and decline the request. Not perfect, sure. Webauthn is definitely more secure, but far less convenient.
    - iudqnolq 5y ago
      Look up city on social media, buy a VPN. If you're on a mobile network the location is often off by a city or so anyway.
      - eikenberry 5y ago
        It's about raising the bar, not making it impossible.
        tialaramex 5y ago
        Why isn't it about making it functionally impossible? You can break WebAuthn if you can guess a 128-bit AES key. You won't, but it's not impossible it's just astronomically unlikely if everybody spends their lifetime trying. That's why Google gave all its employees Security Keys. Instead of "Well, we spend a little bit of money on some half-solution but we just raised the bar and so we'll have to spend more forever and always risk phishing attacks" they just solved the problem. This saves you extra money because your adversaries stop trying. Not only are remaining attacks unsuccessful, they become much rarer and the associated clean-up (even if it's just helpdesk reassuring employees that although they fell for that scam email claiming to be from HR their credentials are fine) cost is reduced. Think about SSH. People scan and attack every SSH server on the public IPv4 Internet. But not on IPv6. Why not? Because it's statistically useless to attempt with 128-bit addresses. You're just wasting your time and money.
iou 5y ago
I don't think this is "the rise", inline attacks had been a known weakness of these security mechanisms almost since inception.
- IncRnd 5y ago
  That's not what the article said. "The rise" doesn't refer to the attack but to the increase in the OTP Interception "bots". [1] [1] (The Rise) of (One-Time Password Interception Bots)
upofadown 5y ago
"Oh no! Criminals are phishing our customers to get their passwords." Lets give them a code to enter... "On no! Criminals are phishing our customers to get their code."
- hoofedear 5y ago
  Would a fix to this be to make OTP’s 10 seconds rather than 30? Or is that not feasible/doesn’t make a difference?
  - lucb1e 5y ago
    Just run through the scenario you have in mind: would the attacker not be able to easily automate the forwarding of the OTP? Would grandmas still be able to use online banking? It's a trade-off, and validity periods so short that the user has to race a potential attacker, I don't think that's viable.
- jszymborski 5y ago
  In all fairness, I see OTP/2FAs as more of a solution to credential stuffing than anything else.
  - CyberRage 5y ago
    TOTP is definitely helpful vs phishing. They only last for 30 seconds, requiring better infrastructure(automated logins) which also tremendously helps with detection. The vast majority of phishing is just storing passwords for later attempts. TOTP by design can be stronger than password. the seed can be pseudo-randomly generated therefore you cannot guess the code without it, even if you have previously generated codes.
- deleted 5y ago
  [deleted]
loteck 5y ago
I get a lot of eye rolling when I go around pointing out that one-time codes are not, by definition, multi-factor auth. Google and some other services properly refer to this auth method as "two-step verification." Something you know. Something you have. Something you are. Known passwords of any type are all in the first category, and they will always be highly phishable, and using more than one of the same factor will never be "multi-factor."
- glenstein 5y ago
  I've always had trouble conceptually with two factor authentication conceived of in this way. If a phone is something you have, then it gives you a code, and you put in that code, so it's really just a code. If it's something you have, well, probably a key right? A usb key? But it's a code on the USB key. If it's something about you (voice, fingerprint, etc), or a location, it's ultimately something represented as information. That's not to say it's a bad philosophy or less secure. It's better, not worse. But it seems to be conceived of and framed in a way as though it's appealing to something other than stuff that gets turned into computer-accessible information. The one "hard" category that seems to make sense to me has to do with hard-wired networks, and having to be in a physical place to access a system that is not online. That creates a real distinction that doesn't boil down to some form of computer-comprehensible information.
  - loteck 5y ago
    But you yourself don't know the code on the hardware token, nor do you yourself know the information gathering, encoding or decoding for biometric information. Those are still pieces of information, but they aren't "something you know." To your later point, some later versions of these original authentication factors have added "somewhere you are" to the list.
    - e12e 5y ago
      There's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc. The otp is proof that you "possess" the otp secret. Then again, it's a shared secret - so if the server side is compromised - all bets are off. Here client certificates/public key crypto does better.
croes 5y ago
Isn't the same way the used to get entry from a TAN list? Pose as a valid receiver, ask for authentication, pass it through to access whatever you want. Don't give an answer if you didn't initiate the process.
EB66 5y ago
There's an interesting way you can implement TOTP that avoids the phishing problem described in the article. The method doesn't work for all situations, but it works for many -- it works particularly well if all you're trying to do is protect access to a mobile app. At my company we have a mobile app and we use TOTP for MFA. But instead of requiring a separate app like Google Authenticator to generate and type in 6 digit codes, we store the TOTP secret and generate the 6 digit codes all internally. In other words, we bundle the functionality of Google Authenticator directly into our own app. From the user's perspective, it's wonderfully simple: the user scans a QR code on our website and they're instantly enrolled in MFA. Then for all subsequent logins, they just type in their username and password -- the 6 digit TOTP code generation is handled silently in the background. With this approach you get all the benefits of TOTP-based MFA, but without the phishing risk. For all the mobile apps out there that offer TOTP as a form of MFA, I'm surprised how many of them require you to use a separate authenticator app.
- wepple 5y ago
  So the TOTP seed is deployed to a specific users mobile app?
  - EB66 5y ago
    Yep, that's correct.
    - wepple 5y ago
      Really fascinating idea I hadn’t heard of before. Felt “icky” at first pass, but it’s no different to having a separate TOTP gen app, in fact given it stops you from having to copy/paste the code around, possibly less exposure there. The only downsides I can think of is that if the app local data is exposed, you possibly lose your cached creds and the TOTP seed.. but most apps are toast if there’s a full local data exposure. I guess the other challenge is if you have to do a (full) app reinstall, you’ve got to re do the MFA config. But app reinstalls seem extremely rare these days (basically only when you get a new phone) Very fascinating idea
3np 5y ago
So, it sounds like one could use this to legitimately recover an account where one has lost the phone number, the service provider requires SMS auth to get back in? Using it on yourself and it becomes account recovery as a service.
lucb1e 5y ago
> an uptick in services on the cybercrime underground that allow attackers to intercept one-time password (OTP) tokens [...] we’ve seen actors provide access to services that call victims, appear as a legitimate call from a specific bank and deceive victims into typing an OTP or other verification code So not intercept, just phish.
xvector 5y ago
Hopefully banks loose enough money to this that they finally allow for WebAuthn only login
anotheraccount9 5y ago
Would a yubike helps against this?

187 points by elorant 5y ago

gtirloni 5y ago

It's not intercepting anything. It's classical social engineering that got automated with bots.

hoarad 5y ago
indeed. it s still the user fault
- Finnucane 5y ago
  Right. If you want good security, just remove the users.

hannob 5y ago

Ultimately what this shows is that two factor authentication with either TOTP (aka Google Authenticator) or SMS is not ideal. It makes phishing harder for the attacker, but it does not prevent it. Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol.

julianlam 5y ago
I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. The fault here lies with victims answering a prompt to enter their 2FA out of the blue. Just as with passwords and other such info, the bank will never request it for no reason. A hardware token using webauthn protocol is most secure though, yes.
- md_ 5y ago
  The fault with phishing _always_ lies with the victim, by this logic. Put differently: if you assume the user to be infallible, there's very little reason to use 2FA of any kind. (Don't believe me? Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.)
  - jdavis703 5y ago
    I leave my work desk to grab a coffee. An attacker adds a hardware keylogger between my keyboard and computer. When I come back 5 minutes later I don’t sweep for any hardware modifications. Now they have my password.
    - UncleMeat 5y ago
      This threat model is orders of magnitude less likely than something like phishing. It is not scalable for attackers and simply doesn't work for anybody who works from home or works in a location with meaningful physical security. It also isn't defeated by 2FA, since they've physically installed something on your machine to detect your keypresses. They just capture your password and the sms code.
      - jdavis703 5y ago
        The post asked to “Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.” Defense in depth is absolutely a thing. Now does your grandfather need this level of security? Probably not. But that doesn’t mean multi-factor is worthless.
        UncleMeat 5y ago
        But it isn’t. The key logger steals your second factor code just the same.
      - nyuszika7h 5y ago
        That only works if the site allows replaying codes and it doesn't expire before the attacker logs in with it.
- hsbauauvhabzb 5y ago
  I work in infosec, I literally write phishing sites. A good phishing site with MFA would easily fool me. How’s grandma gonna stand a chance?
  - tialaramex 5y ago
    WebAuthn saves granny though. Because it's so easy that granny can't get confused. The best way forward under WebAuthn is to have her physically send them her Security Key. Now, granny may not be down with the latest Tik Tok trends, but she has seen keys before, and the analogy is strong - so I think she can get this right. To be fair, scammers have been successful with scams that involve an actual bike courier (presumably the scammer or a friend) coming to pick up your bank card, but that at least feels a bit reasonable because it does say the card remains property of the bank, so, sure, have your card back. And I'm also guessing this is a much higher friction scam than the average "Phone support in India" setup. I reckon scam dozens of people for their card this way and somewhere around the 100 victims mark the guy opening the door to your courier has a baseball bat, or worse, and your courier has a bad day.
- dotancohen 5y ago
  > The fault here lies with victims answering a prompt > to enter their 2FA out of the blue. Go wish 10 random people happy birthday. For some people such a greeting is relevant for one day only. For others, a week. For some people, especially if the don't recognize you and think that "it's been a long time" a whole month is valid. If one is using a dozen services that auth with 2Fa and needs to log in once per day, that's a lot of windows of opportunity. Multiply that by 86,400 numbers phished that day.
- UncleMeat 5y ago
  We've spent years and years and years trying to train people to resist phishing. It doesn't work. Even actual literal security professionals fall for it. If you use a thing with such common known failure modes, it is your responsibility for using that thing. Phishing is enormously more common than sim-swapping because, as described in TFA, it can be fully automated. Going from SMS to TOTP fixes a rare attack but does not fix a common attack.
  - Laforet 5y ago
    So what other options do we have available? We have tried client certificates, hardware tokens, biometrics and a tonne of heuristics. None of these could do much to stop an attack when the user is cooperating with the scammer.
    - UncleMeat 5y ago
      Webauthn works. You cannot sign a message for the wrong origin. The core problem here is that everybody needs access to some sort of hardware to do this and they need systems to handle the inevitable loss of that hardware.
      - withinboredom 5y ago
        Literally Windows and MacOS has this built-in. But you’re right, the hard part is losing the token or it breaking. I slammed one Yubikey in a door, breaking it in half. I’m on my backup but I still find services where I didn’t enroll the backup and have to go through a lengthy process to regain access to my account (or create a new one).
    - jdavis703 5y ago
      Hardware tokens and biometrics are better because it makes it harder for the scammer to describe a plausible scenario to intercept the authentication. In one of the linked articles the scammers pretended to send a one-time token and asked the victim to read it back. This is the same process my top-10 US-based bank uses, so it wouldn’t necessarily raise any red flags.
- ezekg 5y ago
  Sort of off-topic -- but related to "they would never request that" -- recently, I reached out to Hover's support due to a billing issue. The support agent eventually asked me for my 2FA code and I literally sat back in my chair and mumbled "...what?" I told them, "absolutely not." Then I told them that typically, they would request access and then I would have to approve it. They then proceeded to follow protocol. This agent was literally asking to take over my account, and I guess they can bypass passwords but not 2FA. I know Hover != $Bank, but regardless, it made me very uncomfortable and has me second guessing Hover's security practices.
  - flixic 5y ago
    Banking systems in Baltic countries use a unified 2FA system called SmartID[0]. When authenticating to bank via phone, they ask for two things: your user ID (which is not secret), and to authenticate using Smart ID, which means entering a PIN on your phone. However, each PIN entry is accompanied by "code check": bank's support person says their 4 digit code, and you can verify that it matches on request for PIN screen. This neatly prevents someone pretending to be a bank during a call, because each PIN request uses a different "code check". [0]: https://www.smart-id.com https://www.smart-id.com
    - londons_explore 5y ago
      It can still be man-in-the-middle'd. Theres no way to know the attacker isn't calling you on one line while calling your bank on the other. As soon as you've authenticated, they'll continue talking to your bank, and fob you off with some excuse like "oh, the system is down, can you call back tomorrow".
    - btown 5y ago
      Is it still vulnerable to a MITM attack though, e.g. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ? Attacker wants Victim's code. Attacker calls the Bank impersonating Victim, and also calls Victim impersonating the Bank. Bank tells Attacker the code check, Attacker tells Victim the code check, Victim sees the match and enters their PIN into the Smart-ID app, and Attacker's phone session with Bank is now fully authenticated and has no more need for Victim.
- jrochkind1 5y ago
  In the linked article on the words "the scammers can get around that, too" [1], there's an account that claims the legit bank did in the past ask for the 2FA on a phone call, in pretty much exactly the same way the scammers did. > Mitch said his financial institution has in the past verified his identity over the phone by sending him a one-time code to the cell phone number on file for his account, and then asking him to read back that code. The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons". It is very hard for the end-user to tell what 2FA request is "for no reason". I think we need to focus not on what the "reason" is or if it's "out of the blue", but, the equivalent of "call them back" for online too -- don't click on a link in an email, etc. No matter what, it's not easy, especially for less technical users. The linked account is a security professional that fell for it -- I personally don't have the hubris to think I never would. There have been times when an actual bank asks me to do something I know is insecure, and I consider resisting it, but I just didn't have the energy for it, I figured it really was the real bank just being idiotic and I wanted to get on with my day (and guess what, it was, I was right). [1]: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...
  - londons_explore 5y ago
    While "call them back" is good practice, you should remember that even outgoing telephone calls aren't authenticated or encrypted. An advanced enough attacker can totally redirect your outbound calls too - it's just a little harder without an insider in your phone network.
    - smiley1437 5y ago
      So to be safe, I should call them back on a one-time use burner phone? What would you recommend for the call back?
      - 5y ago
- mint2 5y ago
  When you call Amex for a while (and maybe still) will send a onetime password for things that need added verification and ask you to share it with them. The text itself says don’t ever share it.
- time0ut 5y ago
  Some banks will request a 2FA code. I had Citi call me, then send me a code via SMS, then ask for the code on the phone. The SMS looked identical to the one I would get when logging in. My spider sense started tingling and I declined and hung up. Called them back directly and sure enough it was really them.
- hamburglar 5y ago
  Unfortunately, both Microsoft and Apple have conditioned users to just provide their credentials out of the blue when asked. Microsoft in office, which just randomly asks me for my credentials to perform some communication between app components (I see this a lot when opening powerpoints for some reason), and Apple because my iOS devices are constantly wanting me to re-auth with my appleid. So people probably don’t think twice about it. I know my kids think constantly canceling an appleid login prompt without reading it is just part of using an iPad.
  - donmcronald 5y ago
    This is the biggest issue. Some sites ask for your TOTP every time you log in, so a phishing site asking for it won’t seem out of the ordinary.
- dheera 5y ago
  Are there any major US banks that support web'n'auth?
- indymike 5y ago
  > I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. At present, you are right. In the future, this may not be true, especially the "will stop nearly all attempts" part of what you are saying because the weakness in any security strategy is people.
hsbauauvhabzb 5y ago
Hardware tokens were commoditised by yubikey but they really should be TPM based, until there’s critical mass it’ll be a nuanced technology and Yubikey clearly don’t have the clout.
- md_ 5y ago
  TPM-based like...Windows Hello? Both Windows and Mac support host-based FIDO keys. Of course, the downside here is that you...can't move them to a new computer. So they're sort of hard to use on their own, hence people still turn to portable (but less secure) solutions like TOTP and SMS.
  - hsbauauvhabzb 5y ago
    Fair point, I’m not super familiar with hello. The problem of cross-computer access is solvable* - add cryptographic trusts to transport encrypted data across insecure hardware. *I didn’t say it’d be great user experience though.
    - md_ 5y ago
      Yep, Apple solves this by moving FIDO key material around via iCloud, I believe. But it requires a good syncing mechanism like that. In principle it's similar to the password manager problem, which is a bit ironic: if everyone used password managers, most of the same security issues would be resolved. (There are a few cases where a FIDO key is better than a password manager, but not many!)
- chopin 5y ago
  The Yubikey at least requires me to press it in an authentication process. If it's software only an attacker could gain access stealthily. It's already hard to trust OS and browser. Therefore I'd prefer a physical interaction on a device where the behavior cannot be altered.
  - hsbauauvhabzb 5y ago
    TPM is a hardware chip which effectively implements the same concepts as yubikeys but predates them by about a decade.
ttul 5y ago
An increasing number of websites are now offering their own authentication app, which uses a secure back channel to push authentication requests down to the user’s device. While it’s a pain to have a dozen authentication apps on your phone, IMHO this method is just as secure as a hardware module while being much more convenient. I’m sure that there is a start up that recently announced itself here on hacker news that is creating a universal authentication app that will allow any website to authenticate users in this way. Great idea.
- withinboredom 5y ago
  Authy?
- donmcronald 5y ago
  How does that help? If I put my credentials into a phishing site and then get a prompt on my phone to approve a login, why wouldn’t I click approve? Plus, then the attacker often gets a cookie showing their device passed 2FA.
  - ttul 5y ago
    The newest authenticators make a fingerprint of your browser and use that to select a random number that they show you in the app, along with other "controls". You have to pick the correct number, which of course the attacker will not have.
- chrisbolt 5y ago
  And what’s the recovery method for the authentication app? If it involves SMS...
  - ttul 5y ago
    The best practice is a piece of paper with backup codes on it. And if you don't store that properly, you're out of luck. Nothing is perfect, but paper in a safe is pretty good. The cryptocurrency world has introduced titanium backup code holders, where the code letters are literally etched into titanium. Bullet proof, fire proof, etc..
ufmace 5y ago
> Hardware tokens with the webauthn protocol It'd be nice, but support for them around the web seems to be mostly terrible. Only a tiny handful of sites support it at all, and most of the ones that do support it don't support more than one, which seems kind of essential to actually use it long-term and guard against the tokens breaking or getting lost or damaged.
- tialaramex 5y ago
  > most of the ones that do support it don't support more than one Do you have any examples besides AWS?
  - ufmace 5y ago
    Well now that you mention it... I had been thinking of Github and Cloudflare, but I actually just checked both of them and they do now allow multiple keys to be registered. So I guess that's gradually getting better. It's still pretty amazing that AWS still doesn't allow multiple 2FA methods though.
u801e 5y ago
> Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol. This could also be done using client side TLS certificates without restricting the application protocol used on top of the TCP connection.
toast0 5y ago
Two factor with a code device (totp, rsa token, sms, etc) isn't effective for phishing, but it is effective against non-interactive attacks like cracking password files or brute force or password reuse. Something like webauthn that ties the token to the usage context and so addresses phishing (until the host security is broken) and also addresses non-interactive attacks is clearly better from that perspective, but it's not as easy to setup two of those as it is to setup TOTP on two devices at the same time or be able to put your SIM in another phone or get a new SIM (this is, or course, a negative if someone else gets a new SIM for your number). And then there's the extra cost (until/unless it's more integrated into devices people already have)
- CyberRage 5y ago
  the hell are you talking about? why make out wrong "facts"? 2FA is very useful against phishing: https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html https://security.googleblog.com/2019/05/new-research-how-eff...
  - toast0 5y ago
    It doesn't work so well if the phishers also make a 2fa phishing page. People confused enough to put in their password on the login page will also put it on the 2fa entry phishing page.
    - CyberRage 5y ago
      I work in the industry if it wasn't obvious though for years now nothing to do with phishing but I do have some experience shall we say. 1. Building a phishing page and can accept 2FA and in real time(remember code is useless after 30 sec) logs in to an account is much harder. most attacks are low quality junk. 2. From a detection standpoint, this is awesome. the attacker has to log in real-time. he will likely send that link to hundreds of people = good telemetry to detect anomalies\fraudulent logins. 3.* Another pain I remember observing was regarding the login process itself. Websites tend to change their log in UI\processes, different websites have different layouts. This makes it frustrating and tedious maintain, bank changes the login prompt, attacker has to modify code to accommodate that. 4. Data doesn't lie, it is not bulletproof but it does offer significantly higher level of protection. saw that in actual enterprise with my own eyes.
qqii 5y ago
Correct me if I'm wrong, but won't WebAuthn with hardware tokens still be vulnerable to MITM phishing attacks? Ones where the attacker sets up a convincingly fake website and forwards the signature to the actual server?
- BenjiWiebe 5y ago
  The signature will be for the convincing fake and won't be valid for the real site. Plus, your hardware key won't even recognize the fake site as an enrolled site, and won't even generate a signature for the fake site! I think that's mostly right anyways. There's a very helpful explanation somewhere upthread and that's what I understood from it.

thunderbong 5y ago

Key point from the article - > This service (and all others mentioned in this story) assumes the customer already has the target’s login credentials through some means. > OTP Agency customers would enter a target’s phone number and name, and then the service would initiate an automated phone call that alerts that person about unauthorized activity on their account. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”), and that code would then get relayed back to the bad guy customers’ panel at the OTP Agency website.

nextos 5y ago
There are OTP algorithms that allow both parties to identify each other (not just one way where the server confirms the identity of the client), so you can't be subject to a MITM attack. In EU, 2FA is mandatory, but it's really frustrating that the law allows to use SMS codes as a second factor. The typical hack in my country is to use a rogue employee in a phone shop to clone a SIM card, and then you are screwed up.
- jrimbault 5y ago
  Can eSIM be cloned ?
  - g_p 5y ago
    Yes - eSIM is just the same keys used in 3GPP, but distributed differently. You could do a "SIM swap" to a traditional SIM in exactly the same way, using phone customer support or retail store IT.
- tinus_hn 5y ago
  And of course allow resetting the password over sms.
deleted 5y ago
[deleted]

jaywalk 5y ago

Push notifications to a smartphone app for login approvals is by far the most convenient 2FA method and also more secure than TOTP or SMS. I use it wherever I can.

tialaramex 5y ago
Push notifications mean that if you believe you're logging in, and the crook is actually logging in, (not a coincidence, they understand how this works) you get a push notify, which you accept because you think you're logging in, and you thereby let the crook in. Brilliant. Prefer WebAuthn.
- jaywalk 5y ago
  With Okta, it tells you the approximate location of where the login request is coming from. So unless the crook happens to be in the same city as me, I'm going to immediately see that something is wrong and decline the request. Not perfect, sure. Webauthn is definitely more secure, but far less convenient.
  - iudqnolq 5y ago
    Look up city on social media, buy a VPN. If you're on a mobile network the location is often off by a city or so anyway.
    - eikenberry 5y ago
      It's about raising the bar, not making it impossible.
      - tialaramex 5y ago
        Why isn't it about making it functionally impossible? You can break WebAuthn if you can guess a 128-bit AES key. You won't, but it's not impossible it's just astronomically unlikely if everybody spends their lifetime trying. That's why Google gave all its employees Security Keys. Instead of "Well, we spend a little bit of money on some half-solution but we just raised the bar and so we'll have to spend more forever and always risk phishing attacks" they just solved the problem. This saves you extra money because your adversaries stop trying. Not only are remaining attacks unsuccessful, they become much rarer and the associated clean-up (even if it's just helpdesk reassuring employees that although they fell for that scam email claiming to be from HR their credentials are fine) cost is reduced. Think about SSH. People scan and attack every SSH server on the public IPv4 Internet. But not on IPv6. Why not? Because it's statistically useless to attempt with 128-bit addresses. You're just wasting your time and money.

iou 5y ago

I don't think this is "the rise", inline attacks had been a known weakness of these security mechanisms almost since inception.

IncRnd 5y ago
That's not what the article said. "The rise" doesn't refer to the attack but to the increase in the OTP Interception "bots". [1] [1] (The Rise) of (One-Time Password Interception Bots)

upofadown 5y ago

"Oh no! Criminals are phishing our customers to get their passwords." Lets give them a code to enter... "On no! Criminals are phishing our customers to get their code."

hoofedear 5y ago
Would a fix to this be to make OTP’s 10 seconds rather than 30? Or is that not feasible/doesn’t make a difference?
- lucb1e 5y ago
  Just run through the scenario you have in mind: would the attacker not be able to easily automate the forwarding of the OTP? Would grandmas still be able to use online banking? It's a trade-off, and validity periods so short that the user has to race a potential attacker, I don't think that's viable.
jszymborski 5y ago
In all fairness, I see OTP/2FAs as more of a solution to credential stuffing than anything else.
- CyberRage 5y ago
  TOTP is definitely helpful vs phishing. They only last for 30 seconds, requiring better infrastructure(automated logins) which also tremendously helps with detection. The vast majority of phishing is just storing passwords for later attempts. TOTP by design can be stronger than password. the seed can be pseudo-randomly generated therefore you cannot guess the code without it, even if you have previously generated codes.
deleted 5y ago
[deleted]

loteck 5y ago

I get a lot of eye rolling when I go around pointing out that one-time codes are not, by definition, multi-factor auth. Google and some other services properly refer to this auth method as "two-step verification." Something you know. Something you have. Something you are. Known passwords of any type are all in the first category, and they will always be highly phishable, and using more than one of the same factor will never be "multi-factor."

glenstein 5y ago
I've always had trouble conceptually with two factor authentication conceived of in this way. If a phone is something you have, then it gives you a code, and you put in that code, so it's really just a code. If it's something you have, well, probably a key right? A usb key? But it's a code on the USB key. If it's something about you (voice, fingerprint, etc), or a location, it's ultimately something represented as information. That's not to say it's a bad philosophy or less secure. It's better, not worse. But it seems to be conceived of and framed in a way as though it's appealing to something other than stuff that gets turned into computer-accessible information. The one "hard" category that seems to make sense to me has to do with hard-wired networks, and having to be in a physical place to access a system that is not online. That creates a real distinction that doesn't boil down to some form of computer-comprehensible information.
- loteck 5y ago
  But you yourself don't know the code on the hardware token, nor do you yourself know the information gathering, encoding or decoding for biometric information. Those are still pieces of information, but they aren't "something you know." To your later point, some later versions of these original authentication factors have added "somewhere you are" to the list.
  - e12e 5y ago
    There's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc. The otp is proof that you "possess" the otp secret. Then again, it's a shared secret - so if the server side is compromised - all bets are off. Here client certificates/public key crypto does better.

croes 5y ago

Isn't the same way the used to get entry from a TAN list? Pose as a valid receiver, ask for authentication, pass it through to access whatever you want. Don't give an answer if you didn't initiate the process.

EB66 5y ago

There's an interesting way you can implement TOTP that avoids the phishing problem described in the article. The method doesn't work for all situations, but it works for many -- it works particularly well if all you're trying to do is protect access to a mobile app. At my company we have a mobile app and we use TOTP for MFA. But instead of requiring a separate app like Google Authenticator to generate and type in 6 digit codes, we store the TOTP secret and generate the 6 digit codes all internally. In other words, we bundle the functionality of Google Authenticator directly into our own app. From the user's perspective, it's wonderfully simple: the user scans a QR code on our website and they're instantly enrolled in MFA. Then for all subsequent logins, they just type in their username and password -- the 6 digit TOTP code generation is handled silently in the background. With this approach you get all the benefits of TOTP-based MFA, but without the phishing risk. For all the mobile apps out there that offer TOTP as a form of MFA, I'm surprised how many of them require you to use a separate authenticator app.

wepple 5y ago
So the TOTP seed is deployed to a specific users mobile app?
- EB66 5y ago
  Yep, that's correct.
  - wepple 5y ago
    Really fascinating idea I hadn’t heard of before. Felt “icky” at first pass, but it’s no different to having a separate TOTP gen app, in fact given it stops you from having to copy/paste the code around, possibly less exposure there. The only downsides I can think of is that if the app local data is exposed, you possibly lose your cached creds and the TOTP seed.. but most apps are toast if there’s a full local data exposure. I guess the other challenge is if you have to do a (full) app reinstall, you’ve got to re do the MFA config. But app reinstalls seem extremely rare these days (basically only when you get a new phone) Very fascinating idea

3np 5y ago

So, it sounds like one could use this to legitimately recover an account where one has lost the phone number, the service provider requires SMS auth to get back in? Using it on yourself and it becomes account recovery as a service.

lucb1e 5y ago

> an uptick in services on the cybercrime underground that allow attackers to intercept one-time password (OTP) tokens [...] we’ve seen actors provide access to services that call victims, appear as a legitimate call from a specific bank and deceive victims into typing an OTP or other verification code So not intercept, just phish.

xvector 5y ago

Hopefully banks loose enough money to this that they finally allow for WebAuthn only login

anotheraccount9 5y ago

Would a yubike helps against this?