5 ms·
Well now that you mention it, I enabled 2FA :awkward:
by tomaszsobota 4y ago
Well now that you mention it, I enabled 2FA :awkward:
- sp332 4y agoGood, but the attacker spammed 2FA requests at an employee until they convinced them to accept one. Other than FIDO I think, most forms of 2FA are vulnerable to this.
- worble 4y agoI'm not sure what you mean, unless they have access to my 2FA app how can they get access to my codes?
- bdsa 4y agoBy setting up a dummy login screen that you unwittingly enter a valid code into (which I believe is the current best guess for how it was achieved in this case.)
- SargeDebian 4y agoSome corporate 2FA apps send a push notification to a mobile device. Because of how that is set up, it doesn't always (A) show what the login is for because it shows the name of the SSO app instead of the actual application, (B) show other correct data, e.g. if the user is on a VPN, the location may be the VPN endpoint because of IP-address based locations, and (C) it doesn't always show on the user's device that a login needs to take place, because it may be an Exchange connection refreshing periodically in the background So, some people just accept whatever pushes they get.
- sp332 4y agoSee this screenshot https://mobile.twitter.com/GossiTheDog/status/1570717994397073410/photo/1 https://mobile.twitter.com/GossiTheDog/status/15707179943970...
- amalcon 4y agoYou can obviously rate limit the requests, and there are other tricks as well. I tend to think FIDO is better than push notifications for other (related) reasons, but it's not impossible to mitigate this kind of attack.