6 ms·

>I wrote a Python script that ran on a Raspberry Pi, that would pull the 2FA code from an Android emulator running on another machine running the 2FA app, and t

>I wrote a Python script that ran on a Raspberry Pi, that would pull the 2FA code from an Android emulator running on another machine running the 2FA app, and then the script would paste the 2FA code in to MS Teams running on the corporate laptop using a USB keyboard/mouse h/w emulator That's amazingly brilliant, but Unfortunately it wouldn't work everywhere as in our org, the 2FA app will only be allowed to be installed on our company provided phones bound to our company issued phone numbers/SIM. Also, depending on your company and employment agreement, if your Raspberry PI gets compromised by an attacker and uses your 2FA to gain access to your AWS account for example, and causes damage, then your employer can hang you out to dry in court. I already saw one case where an ex-employee is being sued by his former employer because he decided to be clever and knowingly worked around the company's security policy measures, which he agreed to adhere to in his employment contract. Workaround which lead to an attacker getting his keys and stealing customer data from AWS buckets. Ouch!

detaro 5y ago
need to automate the company phone then. Not impossible.
- ChuckNorris89 5y ago
  Don't think iPhones are open to invasive automation tasks. At least that's their main sales pitch in regards to security vs Android that's more open to these kinds of things.
  - detaro 5y ago
    You can tape a touch simulator to it (or use a fake mouse, afaik that's nowadays supported) and monitor the screen with a camera. If it requires FaceID or TouchID it's getting trickier, but even that's probably doable in an environment you control.
    - ChuckNorris89 5y ago
      Or...you can take all that time and energy you'd invest building this complex Rube Goldberg machine that just proves you're present 9-5, and instead, invest it in finding a job that's not so toxic. Seems more healthy for your mental wellbeing in the long run, as toxic policies in workplaces rarely come alone but tend to come sequentially one after another as time goes on if the terror managers don't change or enough employee don't jump ship simultaneously to trigger a management change.
      - detaro 5y ago
        Sure, but I'd apply that at the point of the original posters setup already.
      - xeromal 5y ago
        You seem to take this seriously but putting something together like this is exactly what makes programming/engineering fun. lol. I love putting together weird crap like this.
        justinlloyd 5y ago
        I build a lot of things that like that. From putting a space invaders game on my digital resume website, to an autonomous R/C car that can evade a pursuing dog that jinks left and right like a rabbit, to an internet controlled robot arm used as a cat toy, to a touch screen cat toy that exhibits predator/prey response from the feline interacting with it that results in a paper about improper toe bean rejection because there are not enough science papers written about cats interacting with touch screens, to figuring out which way up a piece of material has been loaded in to a CNC, to "open the pod bay doors" that will open my garage door, to an interactive smart home screen that monitors where my cats, phone, wallet and amazon packages are (and also displays the weather), to a multi-camera streaming setup that is voice activated "Hey producer, roll VT" that talks to me like Cortana from Halo, to a computer vision system for recognizing electronic components and sorting them into appropriate piles, to a remote operated cat litter cleaning robot arm, to cataloguing every book read, science paper digested, class attended, movie watched and album listened too since 1984. And then there is the weird stuff.
  - justinlloyd 5y ago
    I created a computer vision based bot that would play an iPhone match-3 game. A lazy Saturday afternoon of work. It was fun.
moltar 5y ago
You could automate it with a camera and OCR even if the software is locked. ;)
- nousermane 5y ago
  Yeah, "webcam pointed at a security token" is a classic: https://smallhacks.wordpress.com/2012/11/11/reading-codes-from-rsa-secureid-token/ https://smallhacks.wordpress.com/2012/11/11/reading-codes-fr...
tyingq 5y ago
Almost all of the 2FA apps are just using bog standard TOTP, and have a way of getting to the cleartext OATH seed that's needed to automate it. It's typically just a few lines of Powershell, Perl, Python, etc, to take the seed, interval, and current time to spit out the right code. Pretty much, if they offer a phone app, you can replicate the 2FA codes yourself. Edit: Of course, protect the seed with gpg or similar if you do this.
justinlloyd 5y ago
Hackers would be better of looking for a flaw in the security envelope in the enterprise than in the security envelope of my internal network. I am pretty confident in stating that the only way you could compromise the Raspberry Pi is if you had physical access to it, and you'd still need to get past the encrypted filesystem and the password on the OS. I think there are higher value targets with less security than a Raspberry Pi that lets me sign in to MSTeams at a specific time of day. Would I deploy this on anything that was critical or mattered? No. Would I let one of my team deploy this on anything that was critical or mattered? Also no. As a footnote, I can guarantee I could make it work on your company provided phones too. Even when they're locked and with a biometric scan requirement and the inability to run any non-approved software.

detaro 5y ago

need to automate the company phone then. Not impossible.

ChuckNorris89 5y ago
Don't think iPhones are open to invasive automation tasks. At least that's their main sales pitch in regards to security vs Android that's more open to these kinds of things.
- detaro 5y ago
  You can tape a touch simulator to it (or use a fake mouse, afaik that's nowadays supported) and monitor the screen with a camera. If it requires FaceID or TouchID it's getting trickier, but even that's probably doable in an environment you control.
  - ChuckNorris89 5y ago
    Or...you can take all that time and energy you'd invest building this complex Rube Goldberg machine that just proves you're present 9-5, and instead, invest it in finding a job that's not so toxic. Seems more healthy for your mental wellbeing in the long run, as toxic policies in workplaces rarely come alone but tend to come sequentially one after another as time goes on if the terror managers don't change or enough employee don't jump ship simultaneously to trigger a management change.
    - detaro 5y ago
      Sure, but I'd apply that at the point of the original posters setup already.
    - xeromal 5y ago
      You seem to take this seriously but putting something together like this is exactly what makes programming/engineering fun. lol. I love putting together weird crap like this.
      - justinlloyd 5y ago
        I build a lot of things that like that. From putting a space invaders game on my digital resume website, to an autonomous R/C car that can evade a pursuing dog that jinks left and right like a rabbit, to an internet controlled robot arm used as a cat toy, to a touch screen cat toy that exhibits predator/prey response from the feline interacting with it that results in a paper about improper toe bean rejection because there are not enough science papers written about cats interacting with touch screens, to figuring out which way up a piece of material has been loaded in to a CNC, to "open the pod bay doors" that will open my garage door, to an interactive smart home screen that monitors where my cats, phone, wallet and amazon packages are (and also displays the weather), to a multi-camera streaming setup that is voice activated "Hey producer, roll VT" that talks to me like Cortana from Halo, to a computer vision system for recognizing electronic components and sorting them into appropriate piles, to a remote operated cat litter cleaning robot arm, to cataloguing every book read, science paper digested, class attended, movie watched and album listened too since 1984. And then there is the weird stuff.
- justinlloyd 5y ago
  I created a computer vision based bot that would play an iPhone match-3 game. A lazy Saturday afternoon of work. It was fun.

moltar 5y ago

You could automate it with a camera and OCR even if the software is locked. ;)

nousermane 5y ago
Yeah, "webcam pointed at a security token" is a classic: https://smallhacks.wordpress.com/2012/11/11/reading-codes-from-rsa-secureid-token/ https://smallhacks.wordpress.com/2012/11/11/reading-codes-fr...

tyingq 5y ago

Almost all of the 2FA apps are just using bog standard TOTP, and have a way of getting to the cleartext OATH seed that's needed to automate it. It's typically just a few lines of Powershell, Perl, Python, etc, to take the seed, interval, and current time to spit out the right code. Pretty much, if they offer a phone app, you can replicate the 2FA codes yourself. Edit: Of course, protect the seed with gpg or similar if you do this.

justinlloyd 5y ago

Hackers would be better of looking for a flaw in the security envelope in the enterprise than in the security envelope of my internal network. I am pretty confident in stating that the only way you could compromise the Raspberry Pi is if you had physical access to it, and you'd still need to get past the encrypted filesystem and the password on the OS. I think there are higher value targets with less security than a Raspberry Pi that lets me sign in to MSTeams at a specific time of day. Would I deploy this on anything that was critical or mattered? No. Would I let one of my team deploy this on anything that was critical or mattered? Also no. As a footnote, I can guarantee I could make it work on your company provided phones too. Even when they're locked and with a biometric scan requirement and the inability to run any non-approved software.