9 ms·

I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. The fault here lies wit

I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. The fault here lies with victims answering a prompt to enter their 2FA out of the blue. Just as with passwords and other such info, the bank will never request it for no reason. A hardware token using webauthn protocol is most secure though, yes.

md_ 5y ago
The fault with phishing _always_ lies with the victim, by this logic. Put differently: if you assume the user to be infallible, there's very little reason to use 2FA of any kind. (Don't believe me? Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.)
- jdavis703 5y ago
  I leave my work desk to grab a coffee. An attacker adds a hardware keylogger between my keyboard and computer. When I come back 5 minutes later I don’t sweep for any hardware modifications. Now they have my password.
  - UncleMeat 5y ago
    This threat model is orders of magnitude less likely than something like phishing. It is not scalable for attackers and simply doesn't work for anybody who works from home or works in a location with meaningful physical security. It also isn't defeated by 2FA, since they've physically installed something on your machine to detect your keypresses. They just capture your password and the sms code.
    - jdavis703 5y ago
      The post asked to “Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.” Defense in depth is absolutely a thing. Now does your grandfather need this level of security? Probably not. But that doesn’t mean multi-factor is worthless.
      - UncleMeat 5y ago
        But it isn’t. The key logger steals your second factor code just the same.
    - nyuszika7h 5y ago
      That only works if the site allows replaying codes and it doesn't expire before the attacker logs in with it.
      - UncleMeat 5y ago
        You've installed a physical device. Just have it interfere with the actual code typed to the 2fa page so the target's login fails and automate the login with the correct code.
  - md_ 5y ago
    Sure, I guess. I would tend to argue that with hardware access they can do a number of things, though: - They can install a wifi-enabled* keylogger that exfiltrates your OTP. Yes, they have to use the OTP before you do, but that seems solvable to me--just program the keylogger to transpose one of the six characters that comes after your (now known) password. - They exploit any number of likely plug-and-play vulnerabilities in common OSes (e.g. https://www.thetechherald.com/tech-news/disable-plug-n-play-auto-installers-to-prevent-anyone-getting-system-administrator-privileges-razer-bug-highlights-serious-security-loophole/ https://www.thetechherald.com/tech-news/disable-plug-n-play-...). - They steal your computer. Are you using FDE? If not, your cookies are sitting there on disk waiting for them. - They...steal your phone next time you forget it at your desk. ;) Are there scenarios where TOTP can protect against a non-phishing attack? Yeah, I can construct one if I really have to. (I think you're thinking too locally; my top argument for TOTP would be that I can rarely be sure the identity provider has implemented reasonable quotas against password brute-forcing--and who knows how well they secure things like server logs against rogue insiders?) But if you tell me you use TOTP because you're afraid of a local attacker plugging in a keylogger--and not because of phishing--I think your priorities are out of whack. :) * Or they use a covert channel, but I'm not serious about this part: https://dl.acm.org/doi/10.5555/1267336.1267341 https://dl.acm.org/doi/10.5555/1267336.1267341
  - CyberRage 5y ago
    What? that's absolutely not the reason for 2FA... if he can key-log your passwords, he can keylog your 2FA code... deployment of a keylogger means your host is compromised, from there you can do so much you really don't need someone's password... 2FA is for plain phishing attacks. building phishing attacks against 2FA is significantly harder and usually easier to detect\protect from.
hsbauauvhabzb 5y ago
I work in infosec, I literally write phishing sites. A good phishing site with MFA would easily fool me. How’s grandma gonna stand a chance?
- tialaramex 5y ago
  WebAuthn saves granny though. Because it's so easy that granny can't get confused. The best way forward under WebAuthn is to have her physically send them her Security Key. Now, granny may not be down with the latest Tik Tok trends, but she has seen keys before, and the analogy is strong - so I think she can get this right. To be fair, scammers have been successful with scams that involve an actual bike courier (presumably the scammer or a friend) coming to pick up your bank card, but that at least feels a bit reasonable because it does say the card remains property of the bank, so, sure, have your card back. And I'm also guessing this is a much higher friction scam than the average "Phone support in India" setup. I reckon scam dozens of people for their card this way and somewhere around the 100 victims mark the guy opening the door to your courier has a baseball bat, or worse, and your courier has a bad day.
dotancohen 5y ago
> The fault here lies with victims answering a prompt > to enter their 2FA out of the blue. Go wish 10 random people happy birthday. For some people such a greeting is relevant for one day only. For others, a week. For some people, especially if the don't recognize you and think that "it's been a long time" a whole month is valid. If one is using a dozen services that auth with 2Fa and needs to log in once per day, that's a lot of windows of opportunity. Multiply that by 86,400 numbers phished that day.
UncleMeat 5y ago
We've spent years and years and years trying to train people to resist phishing. It doesn't work. Even actual literal security professionals fall for it. If you use a thing with such common known failure modes, it is your responsibility for using that thing. Phishing is enormously more common than sim-swapping because, as described in TFA, it can be fully automated. Going from SMS to TOTP fixes a rare attack but does not fix a common attack.
- Laforet 5y ago
  So what other options do we have available? We have tried client certificates, hardware tokens, biometrics and a tonne of heuristics. None of these could do much to stop an attack when the user is cooperating with the scammer.
  - UncleMeat 5y ago
    Webauthn works. You cannot sign a message for the wrong origin. The core problem here is that everybody needs access to some sort of hardware to do this and they need systems to handle the inevitable loss of that hardware.
    - withinboredom 5y ago
      Literally Windows and MacOS has this built-in. But you’re right, the hard part is losing the token or it breaking. I slammed one Yubikey in a door, breaking it in half. I’m on my backup but I still find services where I didn’t enroll the backup and have to go through a lengthy process to regain access to my account (or create a new one).
  - jdavis703 5y ago
    Hardware tokens and biometrics are better because it makes it harder for the scammer to describe a plausible scenario to intercept the authentication. In one of the linked articles the scammers pretended to send a one-time token and asked the victim to read it back. This is the same process my top-10 US-based bank uses, so it wouldn’t necessarily raise any red flags.
ezekg 5y ago
Sort of off-topic -- but related to "they would never request that" -- recently, I reached out to Hover's support due to a billing issue. The support agent eventually asked me for my 2FA code and I literally sat back in my chair and mumbled "...what?" I told them, "absolutely not." Then I told them that typically, they would request access and then I would have to approve it. They then proceeded to follow protocol. This agent was literally asking to take over my account, and I guess they can bypass passwords but not 2FA. I know Hover != $Bank, but regardless, it made me very uncomfortable and has me second guessing Hover's security practices.
- flixic 5y ago
  Banking systems in Baltic countries use a unified 2FA system called SmartID[0]. When authenticating to bank via phone, they ask for two things: your user ID (which is not secret), and to authenticate using Smart ID, which means entering a PIN on your phone. However, each PIN entry is accompanied by "code check": bank's support person says their 4 digit code, and you can verify that it matches on request for PIN screen. This neatly prevents someone pretending to be a bank during a call, because each PIN request uses a different "code check". [0]: https://www.smart-id.com https://www.smart-id.com
  - londons_explore 5y ago
    It can still be man-in-the-middle'd. Theres no way to know the attacker isn't calling you on one line while calling your bank on the other. As soon as you've authenticated, they'll continue talking to your bank, and fob you off with some excuse like "oh, the system is down, can you call back tomorrow".
  - btown 5y ago
    Is it still vulnerable to a MITM attack though, e.g. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ? Attacker wants Victim's code. Attacker calls the Bank impersonating Victim, and also calls Victim impersonating the Bank. Bank tells Attacker the code check, Attacker tells Victim the code check, Victim sees the match and enters their PIN into the Smart-ID app, and Attacker's phone session with Bank is now fully authenticated and has no more need for Victim.
jrochkind1 5y ago
In the linked article on the words "the scammers can get around that, too" [1], there's an account that claims the legit bank did in the past ask for the 2FA on a phone call, in pretty much exactly the same way the scammers did. > Mitch said his financial institution has in the past verified his identity over the phone by sending him a one-time code to the cell phone number on file for his account, and then asking him to read back that code. The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons". It is very hard for the end-user to tell what 2FA request is "for no reason". I think we need to focus not on what the "reason" is or if it's "out of the blue", but, the equivalent of "call them back" for online too -- don't click on a link in an email, etc. No matter what, it's not easy, especially for less technical users. The linked account is a security professional that fell for it -- I personally don't have the hubris to think I never would. There have been times when an actual bank asks me to do something I know is insecure, and I consider resisting it, but I just didn't have the energy for it, I figured it really was the real bank just being idiotic and I wanted to get on with my day (and guess what, it was, I was right). [1]: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...
- londons_explore 5y ago
  While "call them back" is good practice, you should remember that even outgoing telephone calls aren't authenticated or encrypted. An advanced enough attacker can totally redirect your outbound calls too - it's just a little harder without an insider in your phone network.
  - smiley1437 5y ago
    So to be safe, I should call them back on a one-time use burner phone? What would you recommend for the call back?
    - 5y ago
mint2 5y ago
When you call Amex for a while (and maybe still) will send a onetime password for things that need added verification and ask you to share it with them. The text itself says don’t ever share it.
time0ut 5y ago
Some banks will request a 2FA code. I had Citi call me, then send me a code via SMS, then ask for the code on the phone. The SMS looked identical to the one I would get when logging in. My spider sense started tingling and I declined and hung up. Called them back directly and sure enough it was really them.
hamburglar 5y ago
Unfortunately, both Microsoft and Apple have conditioned users to just provide their credentials out of the blue when asked. Microsoft in office, which just randomly asks me for my credentials to perform some communication between app components (I see this a lot when opening powerpoints for some reason), and Apple because my iOS devices are constantly wanting me to re-auth with my appleid. So people probably don’t think twice about it. I know my kids think constantly canceling an appleid login prompt without reading it is just part of using an iPad.
- donmcronald 5y ago
  This is the biggest issue. Some sites ask for your TOTP every time you log in, so a phishing site asking for it won’t seem out of the ordinary.
dheera 5y ago
Are there any major US banks that support web'n'auth?
indymike 5y ago
> I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. At present, you are right. In the future, this may not be true, especially the "will stop nearly all attempts" part of what you are saying because the weakness in any security strategy is people.

md_ 5y ago

The fault with phishing _always_ lies with the victim, by this logic. Put differently: if you assume the user to be infallible, there's very little reason to use 2FA of any kind. (Don't believe me? Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.)

jdavis703 5y ago
I leave my work desk to grab a coffee. An attacker adds a hardware keylogger between my keyboard and computer. When I come back 5 minutes later I don’t sweep for any hardware modifications. Now they have my password.
- UncleMeat 5y ago
  This threat model is orders of magnitude less likely than something like phishing. It is not scalable for attackers and simply doesn't work for anybody who works from home or works in a location with meaningful physical security. It also isn't defeated by 2FA, since they've physically installed something on your machine to detect your keypresses. They just capture your password and the sms code.
  - jdavis703 5y ago
    The post asked to “Describe to me a threat which applies to an infallible password-only user which is mitigated by non-FIDO2 second factors.” Defense in depth is absolutely a thing. Now does your grandfather need this level of security? Probably not. But that doesn’t mean multi-factor is worthless.
    - UncleMeat 5y ago
      But it isn’t. The key logger steals your second factor code just the same.
  - nyuszika7h 5y ago
    That only works if the site allows replaying codes and it doesn't expire before the attacker logs in with it.
    - UncleMeat 5y ago
      You've installed a physical device. Just have it interfere with the actual code typed to the 2fa page so the target's login fails and automate the login with the correct code.
- md_ 5y ago
  Sure, I guess. I would tend to argue that with hardware access they can do a number of things, though: - They can install a wifi-enabled* keylogger that exfiltrates your OTP. Yes, they have to use the OTP before you do, but that seems solvable to me--just program the keylogger to transpose one of the six characters that comes after your (now known) password. - They exploit any number of likely plug-and-play vulnerabilities in common OSes (e.g. https://www.thetechherald.com/tech-news/disable-plug-n-play-auto-installers-to-prevent-anyone-getting-system-administrator-privileges-razer-bug-highlights-serious-security-loophole/ https://www.thetechherald.com/tech-news/disable-plug-n-play-...). - They steal your computer. Are you using FDE? If not, your cookies are sitting there on disk waiting for them. - They...steal your phone next time you forget it at your desk. ;) Are there scenarios where TOTP can protect against a non-phishing attack? Yeah, I can construct one if I really have to. (I think you're thinking too locally; my top argument for TOTP would be that I can rarely be sure the identity provider has implemented reasonable quotas against password brute-forcing--and who knows how well they secure things like server logs against rogue insiders?) But if you tell me you use TOTP because you're afraid of a local attacker plugging in a keylogger--and not because of phishing--I think your priorities are out of whack. :) * Or they use a covert channel, but I'm not serious about this part: https://dl.acm.org/doi/10.5555/1267336.1267341 https://dl.acm.org/doi/10.5555/1267336.1267341
- CyberRage 5y ago
  What? that's absolutely not the reason for 2FA... if he can key-log your passwords, he can keylog your 2FA code... deployment of a keylogger means your host is compromised, from there you can do so much you really don't need someone's password... 2FA is for plain phishing attacks. building phishing attacks against 2FA is significantly harder and usually easier to detect\protect from.

hsbauauvhabzb 5y ago

I work in infosec, I literally write phishing sites. A good phishing site with MFA would easily fool me. How’s grandma gonna stand a chance?

tialaramex 5y ago
WebAuthn saves granny though. Because it's so easy that granny can't get confused. The best way forward under WebAuthn is to have her physically send them her Security Key. Now, granny may not be down with the latest Tik Tok trends, but she has seen keys before, and the analogy is strong - so I think she can get this right. To be fair, scammers have been successful with scams that involve an actual bike courier (presumably the scammer or a friend) coming to pick up your bank card, but that at least feels a bit reasonable because it does say the card remains property of the bank, so, sure, have your card back. And I'm also guessing this is a much higher friction scam than the average "Phone support in India" setup. I reckon scam dozens of people for their card this way and somewhere around the 100 victims mark the guy opening the door to your courier has a baseball bat, or worse, and your courier has a bad day.

dotancohen 5y ago

> The fault here lies with victims answering a prompt > to enter their 2FA out of the blue. Go wish 10 random people happy birthday. For some people such a greeting is relevant for one day only. For others, a week. For some people, especially if the don't recognize you and think that "it's been a long time" a whole month is valid. If one is using a dozen services that auth with 2Fa and needs to log in once per day, that's a lot of windows of opportunity. Multiply that by 86,400 numbers phished that day.

UncleMeat 5y ago

We've spent years and years and years trying to train people to resist phishing. It doesn't work. Even actual literal security professionals fall for it. If you use a thing with such common known failure modes, it is your responsibility for using that thing. Phishing is enormously more common than sim-swapping because, as described in TFA, it can be fully automated. Going from SMS to TOTP fixes a rare attack but does not fix a common attack.

Laforet 5y ago
So what other options do we have available? We have tried client certificates, hardware tokens, biometrics and a tonne of heuristics. None of these could do much to stop an attack when the user is cooperating with the scammer.
- UncleMeat 5y ago
  Webauthn works. You cannot sign a message for the wrong origin. The core problem here is that everybody needs access to some sort of hardware to do this and they need systems to handle the inevitable loss of that hardware.
  - withinboredom 5y ago
    Literally Windows and MacOS has this built-in. But you’re right, the hard part is losing the token or it breaking. I slammed one Yubikey in a door, breaking it in half. I’m on my backup but I still find services where I didn’t enroll the backup and have to go through a lengthy process to regain access to my account (or create a new one).
- jdavis703 5y ago
  Hardware tokens and biometrics are better because it makes it harder for the scammer to describe a plausible scenario to intercept the authentication. In one of the linked articles the scammers pretended to send a one-time token and asked the victim to read it back. This is the same process my top-10 US-based bank uses, so it wouldn’t necessarily raise any red flags.

ezekg 5y ago

Sort of off-topic -- but related to "they would never request that" -- recently, I reached out to Hover's support due to a billing issue. The support agent eventually asked me for my 2FA code and I literally sat back in my chair and mumbled "...what?" I told them, "absolutely not." Then I told them that typically, they would request access and then I would have to approve it. They then proceeded to follow protocol. This agent was literally asking to take over my account, and I guess they can bypass passwords but not 2FA. I know Hover != $Bank, but regardless, it made me very uncomfortable and has me second guessing Hover's security practices.

flixic 5y ago
Banking systems in Baltic countries use a unified 2FA system called SmartID[0]. When authenticating to bank via phone, they ask for two things: your user ID (which is not secret), and to authenticate using Smart ID, which means entering a PIN on your phone. However, each PIN entry is accompanied by "code check": bank's support person says their 4 digit code, and you can verify that it matches on request for PIN screen. This neatly prevents someone pretending to be a bank during a call, because each PIN request uses a different "code check". [0]: https://www.smart-id.com https://www.smart-id.com
- londons_explore 5y ago
  It can still be man-in-the-middle'd. Theres no way to know the attacker isn't calling you on one line while calling your bank on the other. As soon as you've authenticated, they'll continue talking to your bank, and fob you off with some excuse like "oh, the system is down, can you call back tomorrow".
- btown 5y ago
  Is it still vulnerable to a MITM attack though, e.g. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ? Attacker wants Victim's code. Attacker calls the Bank impersonating Victim, and also calls Victim impersonating the Bank. Bank tells Attacker the code check, Attacker tells Victim the code check, Victim sees the match and enters their PIN into the Smart-ID app, and Attacker's phone session with Bank is now fully authenticated and has no more need for Victim.

jrochkind1 5y ago

In the linked article on the words "the scammers can get around that, too" [1], there's an account that claims the legit bank did in the past ask for the 2FA on a phone call, in pretty much exactly the same way the scammers did. > Mitch said his financial institution has in the past verified his identity over the phone by sending him a one-time code to the cell phone number on file for his account, and then asking him to read back that code. The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons". It is very hard for the end-user to tell what 2FA request is "for no reason". I think we need to focus not on what the "reason" is or if it's "out of the blue", but, the equivalent of "call them back" for online too -- don't click on a link in an email, etc. No matter what, it's not easy, especially for less technical users. The linked account is a security professional that fell for it -- I personally don't have the hubris to think I never would. There have been times when an actual bank asks me to do something I know is insecure, and I consider resisting it, but I just didn't have the energy for it, I figured it really was the real bank just being idiotic and I wanted to get on with my day (and guess what, it was, I was right). [1]: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...

londons_explore 5y ago
While "call them back" is good practice, you should remember that even outgoing telephone calls aren't authenticated or encrypted. An advanced enough attacker can totally redirect your outbound calls too - it's just a little harder without an insider in your phone network.
- smiley1437 5y ago
  So to be safe, I should call them back on a one-time use burner phone? What would you recommend for the call back?
  - 5y ago

mint2 5y ago

When you call Amex for a while (and maybe still) will send a onetime password for things that need added verification and ask you to share it with them. The text itself says don’t ever share it.

time0ut 5y ago

Some banks will request a 2FA code. I had Citi call me, then send me a code via SMS, then ask for the code on the phone. The SMS looked identical to the one I would get when logging in. My spider sense started tingling and I declined and hung up. Called them back directly and sure enough it was really them.

hamburglar 5y ago

Unfortunately, both Microsoft and Apple have conditioned users to just provide their credentials out of the blue when asked. Microsoft in office, which just randomly asks me for my credentials to perform some communication between app components (I see this a lot when opening powerpoints for some reason), and Apple because my iOS devices are constantly wanting me to re-auth with my appleid. So people probably don’t think twice about it. I know my kids think constantly canceling an appleid login prompt without reading it is just part of using an iPad.

donmcronald 5y ago
This is the biggest issue. Some sites ask for your TOTP every time you log in, so a phishing site asking for it won’t seem out of the ordinary.

dheera 5y ago

Are there any major US banks that support web'n'auth?

indymike 5y ago

> I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account. At present, you are right. In the future, this may not be true, especially the "will stop nearly all attempts" part of what you are saying because the weakness in any security strategy is people.