14 ms·
Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA
- TheDudeMan 5y ago> That’s where older, weaker forms of MFA come in. They include one-time passwords sent through SMS or generated by mobile apps like Google Authenticator That reference to Google Authenticator being weaker is not consistent with the rest of the article.
- tgsovlerkhgsel 5y agoAll of the OTP-based MFA methods are phishable, the phisher just has to bother enough to relay the stolen credential immediately.
- TheDudeMan 5y agoSeems like a much higher barrier than clicking a single button that is in your face.
- eli 5y agoNot really. There are ready to use phishing scripts that collect a TOTP and instantly relay it to the auto server
- TheDudeMan 5y agoThis article is not about phishing scripts.
- fomine3 5y agoAnyway what 2FA method is MITM--style-phishing-proof?
- tgsovlerkhgsel 5y agoU2F/FIDO/WebAuthN security keys.
- pornel 5y agoIt is, but only a little. It's still vulnerable to MITM, phishing websites, and fake support calls. OTOH hardware keys are much more foolproof. It's insufficient to merely ask victim to press a button. To bypass them you need to pwn the OS (not impossible, but harder than social engineering) or have physical access to victim's key (requires leaving mom's basement).
- lolinder 5y agoGenuinely curious: how is a hardware key invulnerable to a phishing website? Don't they just act as a keyboard to type in the OTP automatically? What stops a MITM from relaying it on?
- tgsovlerkhgsel 5y agoSome of them do, and they're obviously just as insecure. The ones implementing U2F/FIDO/WebAuthN or whatever the standard is called today will sign a cryptographic challenge, and the response includes the origin on which it was requested (i.e. the legit website will reject the response because the origin is the phishing site).
- tialaramex 5y agoTo expand on what the other reply said about FIDO authentication/ WebAuthn Security Keys (there are a lot of names for related technologies including U2F which was the predecessor technology), WebAuthn recruits the web browser to solve the phishing problem. The web browser definitely knows which DNS name this site has, because it's mechanically necessary in order to fetch web pages from it. So while the user may be confused and believe this is their bank, the browser is quite clear this is fakebank.phishing.example. Then WebAuthn has the browser tell the hardware token which site we're authenticating against, and the authentication credentials are distinct for every possible site. There are a few more wrinkles to make even it even better, but this is already enough that it's utterly pointless to try to phish Security Keys.
- JumpCrisscross 5y ago> no limit is placed on the amount of [2FA phone] calls that can be made I thought this was going to be a story about one-time password interception [1]. Instead, it's something much, much dumber. [1] https://krebsonsecurity.com/2021/09/the-rise-of-one-time-password-interception-bots/ https://krebsonsecurity.com/2021/09/the-rise-of-one-time-pas...
- pkulak 5y agoI've noticed that Google actually randomizes the position of the Accept and Deny buttons on their 2FA popups. I guess this is to force you to read the entire text, but I have on more than one occasion Deny'ed my own request because of this. I think someone would have to hit me with about 4 2FA requests before I ham fisted the wrong button.
- m00dy 5y ago> MFA Request Bombing Has anyone experienced this personally ?
- annoyingnoob 5y agoOnly when the Azure Information Protection client was buggy and causing constant auth requests.
- jgrahamc 5y agoUse hardware tokens. FIDO2 works.
- morpheuskafka 5y agoI would expect that an engineer would recognize that (1) a massive volume of MFA notifications is extremely suspicious and should be reported immediately to security and (2) if they are trying to sleep they can just mute or turn off the phone. This was a major failure of training. For a nontechnical employee I could get how they could not recognize this as an attack. But if you are getting annoying calls and don't know why, why not just unplug/turn off the phone? On the other hand, slipping a single MFA notification in during the normal workday seems like a much better approach. Even if the employee doesn't accept the notification, they'd likely assume that it was a tab they opened earlier and closed before finishing the login, not something to report.
- vasco 5y agoThe article already mentions the alternative of slipping in a low volume of MFA notifications instead as an alternative that is less suspicious. You only need one person to accept. And I think you overestimate how much attention engineers pay to any security or compliance type of training.
- spoiler 5y ago> On the other hand, slipping a single MFA notification in during the normal workday seems like a much better approach. Even if the employee doesn't accept the notification, they'd likely assume that it was a tab they opened earlier and closed before finishing the login, not something to report. This gave me anxiety!
- beaconstudios 5y agoPersonal responsibility is the weakest form of system improvement because it's guaranteed to vary between people. Expecting people to always behave perfectly within your scope is a recipe for disappointment!
- ben_w 5y agoWorse, I assumed every 2FA provider did something to mitigate request spamming as soon as someone realised you could use a premium rate number back when SMS messages were commonly used instead of apps for 2FA.
- kokanee 5y agoI'm always on the edge of my seat waiting to learn what mind-blowing technique the "band of elite hackers working for Russia’s Foreign Intelligence Service" came up with. And it's always something along the lines of "they kept sending emails until somebody clicked the link."
- mooreds 5y agoHumans are the weakest link. Either the human clicking, or the person who designed the system that allowed them to click.
- anyfactor 5y agoIf a system doesn't consider the human element in it's design the system as a whole is weak. There is no computer vs human. I am tired of hearing computers doesn't make mistakes and it is only humans that do. Even if they found a bug in kernel or some obscure memory fault, some people will spin it up as human mistake and chalk it up and move on. System designs needs to be holistic and accountable to errors. Everyone thinks they are smart but constant attacks only need you to be careless for a mere moment.
- sva_ 5y agoOften, yes. Maybe even most commonly. But not always. The NSO's zero-click iMessage exploit uncovered by Google Project Zero & Citizen Lab was absolutely mindblowing to me. [Of course, NSO Group is not "Russia's Foreign Intelligence Service", but I presume that wasn't your point.] https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- thrashh 5y agoAnother classic buffer overflow Making file format parsers sketchy since file format parsers started existing
- tialaramex 5y ago
- deleted 5y ago[deleted]
- rmsaksida 5y agoIsn't manual TOTP MFA (using codes generated by Google Authenticator or similar) significantly more secure than those MFA prompts? I don't understand the push for MFA prompts when the previous technology worked just fine and was probably more secure. What's the benefit to MFA prompts other than slightly better UX?
- 6yyyyyy 5y agoIt forces you to install the vendor's proprietary authentication app on your mobile device.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- woeh 5y agoIn case of one time passwords you can ignore the proprietary app and use your favourite authenticator to generate an otp password. If the site or app poses no choice, just say that you want to use their "Proprietary Authenticator" and you just continue with your own password manager. It works for me with 1password. As a sanity check too see if it works; you always have to use a first OTP to activate the multifactor authentication.
- 6yyyyyy 5y agoThat's my point: OTP lets you use your own app. Notification-based OTP requires a proprietary app.
- Melatonic 5y agoI dont think either are more or less secure than the other - they both verify you have the physical device on you (which theoretically you need to unlock) and they are time-based. I would say the TOTP MFA is easier because you do not have to deal with re inputting the code (which expires) but also then you need another app installed.
- ffhhj 5y agoWasn't the same old trick SIM swapping?
- tempfs 5y agoYes, and trolling LinkedIn for people that they could just socially engineer or otherwise bribe into gaining access from.
- exabrial 5y agoCrusty person with an opinion here. Google wankers forcefully added "Google Prompts" as a 2FA method, without consent, and disabled removing it. Of course people are going to hit "authorize". Oh and if you remove the Google app, you can thankfully use the YouTube app (like that's a good idea). A _video streaming_ app now has the keys to the kingdom. Man I feel secure. Just use hardware keys. It's not difficult. My 70 year parents use them. I explained "This is like your front door key, but for you account. It's safe to put this in whenever the computer prompts you for it."
- tempnow987 5y agoI've also found this works fine. The new ones seem to have wireless built in now as well (good for phones). And you can have more than one key on the physical key (I don't like the the microsoft / duo / etrade VIP secure / etc) endless app list!
- tialaramex 5y agoToday's fun fact: On cheaper devices (anything cheaper than say Yubico's Security Key 2 product, and even often for common uses with products in that range too) there actually isn't ever "more than one key on the physical key". They have a single key baked inside them (typically an AES symmetric key) You can use them to authenticate as you on an unlimited number of sites because they're not actually remembering the private keys used to authenticate so they don't need to store them anywhere! Let's watch how that trick is done, starting with a much more expensive device that has plenty of storage, an iPhone. When you enrol the iPhone as an authenticator, the standard requires it to provide a very large ID number for that enrolment, and it warns implementers these aren't serial numbers if they're picking an ID use random numbers. The iPhone signs a message with a proof of freshness (random numbers the Relying Party picked), a proof of who the message is for (a hash of the Relying Party's DNS name) an elliptic curve public key it just picked at random, all signed with the corresponding private key. This is sent to the Relying Party (ie a web site) along with the ID number and enrolment has succeeded. The iPhone just stores all that in Flash because hey, it has gigabytes of flash storage so who cares. When you need to authenticate to some web site, the site gives back the ID number, the iPhone finds the right entry in Flash, retrieves the private key and produces a new signed message to authenticate. However, the ID is so big for a good reason -- a whole elliptic curve private key can fit with space for an AEAD tag to spare. So instead of gigabytes of flash storage a $15 FIDO authenticator just uses AES to encrypt the random private key for this site (using the symmetric key baked inside it), and provides that encrypted message as the ID number for the enrolment. Then it can forget the private key! When a site wants you to authenticate later, the site gives back the ID number (always a big random-looking number anyway remember) and your authenticator decrypts the ID number to get back the private key for that site, signs the authentication message and immediately forgets the private key again. It's genius. If you came up with this idea independently of reading about FIDO/ WebAuthn congratulations you might have a future in cryptographic engineering.
- petilon 5y agoMicrosoft's MFA is terrible. You install an app called Authenticator. Then when you login the Authenticator app gets a push notification, and the user has to say whether to allow the login or not. If you accidentally press Yes, the attacker gets in. And here's why this is a serious problem: When you use Remote Desktop to work, any time you have a network issue RDP automatically reconnects and you get an Authenticator notification. So during the work day you get frequent prompts that are automatically initiated by RDP reconnects. You get used to automatically saying Yes to the prompt. So when one of these prompts is initiated by an attacker's login there is no way to know, and you automatically answer Yes.
- onaworkcomputer 5y agoDon't you have to provide some information as part of the confirmation? Whenever something requests MFA, it will show a two digit number, and in the Authenticator app, I will be presented with three numbers and can only confirm the prompt if I select the same number that was shown by the requestor. My work MSFT account is even more locked down and requires me to type in the number.
- petilon 5y agoNo, if you are on iPhone, Face Id authenticates, then you press a button to allow. That's it. There is no number to type anywhere.
- onaworkcomputer 5y agoOof. I wonder if admins can disable push notifications and just fall back to TOTP instead? Though it does sound like that would not be convenient if you have to enter a TOTP every time an RDP connection get interrupted.
- scoopertrooper 5y ago... you can still do the code based flow if you want...
- mistrial9 5y ago
- habibur 5y agoIf they could login without knowing the password when MFA is enabled, then 2FA/MFA is making it less secure than simply having a strong password and nothing else.
- bagels 5y agoMost 2fa is really just 2 1fa systems because people forget passwords or lose tokens.
- adolph 5y agoI've seen this used in real life. The 2fa app is easier to click through so the web app pinged 2fa prompt instead of presenting a password prompt.
- rmbyrro 5y agoKnowing the password is easy. With so many breaches and how often people reuse passwords...
- Klasiaster 5y agoNo one external should be able to trigger this, it should only be the owner that takes action of, e.g., opening a code generator or requesting an SMS/phone call through dialing from the right number.
- vinay_ys 5y agoCurrently I only trust these 3 factors of authentication used in combination correctly: 1. Memory (enter the site-specific password via the password manager which is unlocked by a password is from your memory). 2. Device (device-internal-hardware backed certificate bound to this device). 3. Physical Presence (FIDO2 Key touch) Most importantly, it is extremely important how secure the reset auth flows is. And if any one of the three factors need to be reset, then the system should require the other two to be valid, plus it should require an in-person identity verification (if implemented correctly, video KYC should be acceptable). Plus there should be a reset-buddy designated by the user who should second/vouch the user's initiation of reset. Without all of these (2 factors of auth from the user plus system automated video kyc + reset-buddy vouching), even the admin shouldn't be able reset auth of any accounts. This is crucial. Plus there should be a pre-cooloff period after reset request is raised but before it is actually processed, and a post-cooloff periods for any additional factor reseting, and regaining full privileges. Independently, there should be fraud/risk systems for safeguarding any sensitive operations (like creating additional users, exfiltration of data etc).
- TacticalCoder 5y ago> Plus there should be a pre-cooloff period after reset request is raised but before it is actually processed, and a post-cooloff periods for any additional factor reseting, and regaining full privileges. That's, to me, the biggest one. It is quite a trivial idea, it's really not hard to add to any login process and yet very few this. But all hope is not lost for there are some sites that have seen the light and implement precisely that cool of.
- kobalsky 5y agothis reminds me of Interactive Broker's iOS MFA. if someone tries to login and you happen to be using their app, the face ID triggers automatically without prompting you to accept. you would have to be very fast to point the phone away from your face to avoid it.
- kyle-rb 5y agoCan't wait until companies expand their fake-phishing email programs to include this. Randomly like once a month your phone will get spammed at 1am and if you allow the request, then you have to attend a phishing training session.
- cratermoon 5y agoOne job I worked on involved updating my employer's authentication and bringing in MFA and other modern authentication techniques. We initially enabled just the MFA that required the use to have an authenticator app and enter the code into the site along with their password. Guess what? That didn't satisfy the product owner or marketing, so we were required to enable the other form of MFA, which sends a message to the user's device and requires them to just press the OK on the app and allow it. But at least we were able to hold the line on sending one-time codes via SMS.
- deleted 5y ago[deleted]
- linuxhansl 5y agoI gave a talk on that almost 20 years ago... Basically you have (1) something you know (like a password), (2) something you have (like some device or key), and (3) something you are (like a fingerprint and iris scan). Back then the accepted trade-off was that have any two of these three is good enough for most case, and for really critical stuff you need all three. The MFAs in question here attempt (1) and (2), but do a bad job on (2).
- obelixotic 5y ago
- deleted 5y ago[deleted]
- Plasmoid2000ad 5y agoSome of this is expectations and how you train your users I think. I know at least in my experience, running a Windows machine I can get random prompts to sign-in at random times from Outlook, Team, Visual Studio for Azure resources, from powershell scripts with zero context as to what they are for. Some of them will prompt for login, as I have multiple AAD account, others will just pick one AAD account and skip the password as things are cached. I'm then getting seemingly phantom login prompts and phantom authenticator requests by design. I'm denying them when I'm not certain what they are, and for secure environments I'm using a yubikey - but that's not what I expect most people to do faced with this.
- PUSH_AX 5y agoThe article seems to lump Google Authenticator and push style authentication prompts together (as old broken MFA), but I'm unsure how you spam someone with requests for the former?
- theknocker 5y ago