10 ms·
How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn
- Siecje 12y agoWhy is it a phone call and not a text message
- mjs 12y agoAt least if you have a recovery email address configured, you can only initiate the process that sends codes to phones via a link sent to the recovery email address. So being able to intercept codes sent to a phone is not enough: you also need to have control over the recovery email address.
- PythonicAlpha 12y ago2FA based on mobile phones is a very weak method of security. It goes worse, when using smartphones. When you use your smartphone to access internet services (worse: make banking) secured by 2FA, your 2FA is reduced to 1FA, Trojaner prone security. There are also already cases known, where attackers just made phone companies send a "replacement" sim card and the attackers intercept those. Thus the second factor was very simple out. Some phone companies are more aware now, but all is very much prone to social engineering. So: 2FA is only a good idea, when using some dedicated device, else it just makes the barrier a little higher, sometimes not so much, as you think.
- Oletros 12y agoWhy a 2FA based on mobile phones using Authenticator app is a very weak method?
- iLoch 12y agoI never use TFA if it's SMS based. I don't understand why every company isn't using the standard TOTP TFA with a secret key, that way I can manage who has access to my TFA codes very easily. I just scan a barcode on my phone once and I'm able to generate TFA codes for myself, what's better than that?
- kabdib 12y agoGoogle's response _The attack presupposes a compromised password, and the actual vulnerability appears to lie in the fact that the Telcos provide inadequate protection of their voicemail system. Please report this to the telcos directly._ ... is reprehensible. It's a problem with the design as a whole, Google's customers are going to experience the flaw, and just passing the buck doesn't make the problem go away. I'm really disappointed in Google.
- izacus 12y agoWhy? How is that a Google problem, when you use voice as your backup password system and you're not securing it properly?
- pygy_ 12y agoMost people are not aware of the attack vector (spoofing the phone number to reach the voice mail).
- ilyanep 12y agoAs a large company that serves millions of users in many of their most sensitive online endeavors, is it more responsible to throw your hands up and hope that many of the hundreds of telcos out there will fix their own security, or implement a relatively easy fix that will automatically secure all of your customers from this issue regardless of third-party security?
- csense 12y agoThe entire point of 2FA is to make password compromise insufficient to gain access to an account. Which makes this response just baffling. I initially thought that the lack of any technical countermeasure might be a legitimate reason for Google to do nothing, but after I thought about it for a moment, I realized that when the 2FA system calls the user, it could simply prompt the user to do something before sending the verification code -- that way, the 2FA provider knows they aren't sending the code to voicemail. Simple and effective, and later in the post I found the author and multiple companies came up with that idea on their own.
- monsur 12y agoHang on. The first step of this exploit is that "The attacker logs into the victims account on a 2FA enabled web application". How does the attacker do this if the account has 2FA enabled in the first place? And if the attacker can already log into the victim's site, why are the other steps even necessary?
- danielpal 12y agoSorry, couldn't resist. Shameful self-promotion, but this is why companies shouldn't implement their own two-factor authentication. Getting everything right is hard and chances are that you aren't reading or informed of the latest attacks. At Authy we are obsessed with Two-Factor Authentication and spend a huge amount of time looking at whats happening in the ecosystem, which new attacks do we need to be aware of etc. It might look easy to build a quick two-factor authentication system, but history will repeat itself, and like passwords we'll see lots of bad and insecure implementations because its harder than what people think.
- primitivesuave 12y agoAuthy is an awesome piece of technology, I definitely think some day it will be the standard.
- enscr 12y agoYou should add a line in your response saying that 'Authy isn't vulnerable to the voicemail attack'. Good job for being dedicated to the service.
- deleted 12y ago[deleted]
- enscr 12y agoAssuming you aren't compromising someone's account that was left logged-in or a stolen phone: Note down all information about the account creation, frequent contacts, services used .. basically all dashboard data and then contact Google. If you have a secondary recovery address, that's even better.
- deleted 12y ago[deleted]
- zobzu 12y agoso you're saying authy is better than google, etc and will never suffer from any security issue?
- raesene3 12y agoInteresting article, I've always thought that phones are one of the weaker links in the 2FA chain (but a lot cheaper than dedicated tokens). The general use of SMS/voice mail has another potential weak point which is where people start using VOIP services a lot. If an attacker has compromised someone's client computer with the usual set of trojans and they use something like Skype to receive SMS and voice calls, 2FA which relies on tokens via SMS or voice could be easily compromised as the attacker will already have access to them..
- zobzu 12y agodedicated tokens are actually cheap. you can get one for 10-20 bucks
- rdl 12y agoThe problem with most dedicated tokens is you probably don't want to use the same token across multiple services. It is a financial and physical logistical cost to have one per service. I'd love a cheap hw token which could support around 32 simultaneous totp seeds. It would cost an extra 2 digits on the display and maybe an extra button (but hold vs press could be multiplexed so you get both)
- growse 12y agoI use a YubiKey NEO which has the ability to store multiple TOTP tokens on it. You have to arse around with it first and install a jar to the token to give it that capability (I remember it's all official from YubiKey, they just don't ship the keys with that capability). Then, I simply NFC it to my Android phone, and the YubiKey neo app shows the 2FA tokens for all the secrets on that key. You can also password encrypt the key, so that someone can't just steal the key off you. Adding new secrets is also easy, I just scan the QR with the app, touch the key to the phone, give it a name and it's added. I've got around 12 TOTP secrets on there, works very well.
- rdl 12y ago
- Shank 12y agoI love how Google's response is akin to "well, if the password is compromised...anything is possible" logic and tagged as won't fix. Facebook and Linkedin of all people immediately triaged and started fixing the issue. Unacceptable response from a company promoting its services as identity and communication platforms.
- judk 12y agoThat's a backwards and false reading. 1. Google said that if your telco is insecure, you are insecure. If you knowingly choose to use an insecure telco for sensitive communications, you can't expect every system to refuse to communicate with you. 2. From the article, Google already offers a secure 2FA, in fact Google invented and open sourced it! Do FB and LI even offer a secure 2FA at all? > disable 2FA on Google via texts or phone calls, and enable Google Authenticator based 2FA
- deleted 12y ago[deleted]
- meowface 12y agoAgreed. Google is usually very good with security fixes, so it's surprising that they're basically filing this as a non-issue. They're right that it isn't exactly a flaw in their systems, but they still have a relatively simple way of mitigating attacks against the telcos' security.
- TwoBit 12y ago
- enscr 12y agoVery comprehensive and will written post. Also, good job on the due diligence of alerting all concerned parties and posting detailed responses. Google's reply is too complacent. Despite this being Telco's fault, Authy & Duosecurity are better at mitigating it.
- beyondcompute 12y agoYes, the Google's response (if it is real) to this problem is embarrassing. "It is not our problem that we practically post your credentials to open access at some occasions" [as this post shows using voicemail is akin to doing this in case of significant number of providers]. That's so disregarding to customers.
- rdl 12y agoI hate 2fa based on SMS or voice auth. Requiring proving control of a number is decent as an anti spam or flooding technique, but is horrible for authentication of anything high value enough to justify 2fa. I also strongly prefer 2fa systems which allow me to enroll my own hardware token or use a software token (eg AWS IAM) vs systems which supply the seed so I can't (CloudFlare is depressingly the only service I use which still suffers from this, despite being otherwise pretty awesome.)
- shurcooL 12y agoI really dislike SMS-based 2FA and do not use it at all. Imagine you're traveling, now you may have to pay 75 cents just to login somewhere. Google Authenticator-based 2FA avoids all these problems.
- rdl 12y agoMy problem is that banning cellphones and blocking cell signals is common in secure spaces, so cell based 2fa fails there, too.
- iagooar 12y agoHow can you pay for incoming SMS?
- rdl 12y agoRoaming, or USA.
- greenpresident 12y agoThere are no roaming charges for incoming SMS in the EU.
- TillE 12y agoTo clarify: there are no charges for incoming SMS to EU numbers, no matter where in the world your phone happens to be.
- nwh 12y agoFor the Optus (and their MVNO) it's fairly trivial to just nuke the voicemail completely with a call to a specific code. Seriously, who even uses it anyway? Bear in mind that in Australia we are charged a clear dollar a minute to retrieve voicemail messages.
- justincormack 12y agoSpoofing could re enable it too I guess?
- nwh 12y agoThey're a code that you type in rather than a number to call. I really have no idea how they work, but I imagine they're some sort of non-text non-call sort of thing? Don't really have anything sensible to google so I can't find out for sure. Hadn't thought of that though.
- justincormack 12y agoI imagine they are some kind of text, but not sure either...
- Theodores 12y agoTo use an automotive analogy this is a bit like using social engineering techniques (e.g. pretending to be from the electricity company) to enter someone's house and then, once in, getting paperwork pertaining to their car. Theoretically you could then ordering a new set of keys from a locksmith, doorstepping the locksmith (when he arrives with the replacement key). You could then steal the car. Realising this stunt could work with any of the manufacturers that the locksmith can get keys for, you could then complain about how useless their cars were, that their locks were essentially broken. Of course, the attack would be entirely theoretical as the car 'stolen' would be one's own (because you were testing this attack vector so you could blog about it). He should have got a job with News International. Essentially their 'phone hacking' relied on standard, factory set voicemail codes and their 'work' only came to disgust the general public when they deleted voicemail messages off a murdered teenager's phone, in so doing giving the parents false hope that she was still alive (as they were able to leave new messages as the voicemail inbox was no longer full). Had the 'journalists' at News International known about this little trick for 2FA then, would they have really been able to glean anything useful? Yes, however, it would have been a one-time trick. As soon as some junior royal (or footballer or politician) realised that they could no longer login to Facebook/whatever (because the password had been reset), they would have to reset it for themselves, plus they would have emails in their main inbox stating that their password had been changed. During this time the Facebook/whatever account could be thoroughly gone through, however, on-going access would be unlikely. So, in practical situations, e.g. getting scoops for 'newspapers', there is still limited use to this technique.
- JulianRaphael 12y agoMaybe Google's incredibly irresponsible response hints at their general strategy regarding authentication on the internet: they are already pushing for the replacement passwords. I'm quoting: "[Google plans] to release an ultra-secure and easy to use identity verification platform that eliminates the need for long, user-generated passwords. Dubbed U2F (Universal 2nd Factor), the consumer-facing side of this initiative will be a USB dongle called the YubiKey Neo. Built to Google’s specifications by security specialist Yubico, the YubiKey Neo is a small, durable and driverless device that requires no battery. Plugged into your computer’s USB port it will add a second, highly secure layer of verification when you point Google’s Chrome browser to your Gmail or Google Docs account. You’ll initiate the login by typing your username and a simple PIN. The browser will then communicate directly with the YubiKey Neo, using encrypted data, to authorize account access. With U2F verification, if someone wanted to login surreptitiously to your account, he or she would need to know your username and PIN while simultaneously having physical possession of that specific YubiKey Neo." Furthermore, they had Regina Dugan, former DARPA director and now their VP of Engineering, Advanced Technology and Projects, on stage at All Things Digital in 2013 talking about electric tattoos and edible passwords which would turn your whole body into an authentication token with a 18bit ESG light signal. (Link to talk: https://www.youtube.com/watch?v=fzB1EcocAF8 https://www.youtube.com/watch?v=fzB1EcocAF8). So maybe they just don't care because they won't use 2-factor-authentication for much longer anyway.
- noisy_boy 12y agoThat will be a problem where USB ports are disabled (which is increasingly becoming a standard security practice). E.g. my workplace has separate PCs for accessing Gmail etc. but those still have USB ports disabled.
- noisy_boy 12y agoAm I missing something or the fact that once gmail password is compromised, the attacker could easily change the phone no. or set it to use Google Authenticator? Further steps regarding voicemail etc. will be moot after that.
- dtech 12y agoYou need to login to change the settings. If 2 factor authentication is enabled only a password isn't enough to login. That is exactly what 2FA means.
- lxgr 12y agoUnfortunately, modifying the 2FA settings for a Google account doesn't require the second factor again if the user is logged in; the password is sufficient.
- kolev 12y agoCan those services that require interaction be tricked by hacking the voicemail and recording a message with touch tones in them? Fortunately, most that require # also use it in voicemail greeting recording to end the recording, but the example, there are some that require any key, which probably is vulnerable.
- kolev 12y agoMicrosoft and other services don't use 2FA for all services. I'm sure this can also be exploited to log into vulnerable service without 2FA and then being logged, change the password. My favorite is services that use secret challenge responses to reset passwords. Some of those "secret" questions are colors, car makes, etc., which narrows down the choices to just a few. It's unfortunate that many idiots carry the title of "software engineer" when they completely hack basic analytical thinking and basic math skills to prevent such exploits!
- DangerousPie 12y agoAs far as I'm aware Microsoft (and presumably others) will require you to generate a one-time app password if a service does not support 2FA. And to generate that password, you need to be logged in with 2FA.
- kolev 12y agoNot everywhere. For example, Skype doesn't do 2FA neither does the Windows 8 login if you use a Microsoft Account.
- kolev 12y agoThird comment on this post, but anyway. Why are 2FA providers still using SMS and not USSD (http://en.wikipedia.org/wiki/Unstructured_Supplementary_Service_Data http://en.wikipedia.org/wiki/Unstructured_Supplementary_Serv...)?
- lxgr 12y agoWhat would be the advantage of using USSD?
- matthiasl 12y agoI'm not Kolev, so I don't know his reasoning. But I can guess. USSD is interactive. That lets you keep the one-time password's validity time short since you know when the subscriber sees the one-time password. The other is that it's straightforward to require an interactive step, e.g. "press 7 to get a code". The interactive step makes an attack based on SMS forwarding harder. The short timeout makes an attack based on having limited access to a victim's phone harder. Not sure if the security improvements are worth the useability problems---people aren't familiar with USSD and, because it's not used as often, mobile terminal software for it is likely to be buggier.
- kolev 12y agoYes, that, plus, supposedly, apps like Facebook Messenger and Google Hangouts won't see those messages.
- the_mitsuhiko 12y agoFor a start, because USSD is provider specific and unless you are the provider you need to initiate it with a special USSD code from the phone which you need to register in every network you want to operate in.
- kolev 12y agoNexmo offers it (although it's in Beta like pretty much every meaningful service): https://www.nexmo.com/tour/USSD.html https://www.nexmo.com/tour/USSD.html
- thret 12y agoHere's an idea: get rid of voicemail completely. The only person, the ONLY person I know who has used mine is my father, and his message is always "Sorry I missed you, call me when you can." Which I know already, thanks.
- MichaelApproved 12y ago> Here's an idea: get rid of voicemail completely. The only person, the ONLY person I know who has used mine is my father The only person you know is your father. There are millions of people who still rely on voicemail to communicate. > and his message is always "Sorry I missed you, call me when you can." Which I know already, thanks. You wouldn't know that if your mobile phone was out of range and didn't receive the missed call.
- andreasvc 12y ago> You wouldn't know that if your mobile phone was out of range and didn't receive the missed call. You could, actually. My provider sends a text message when that happens, which you receive when you're in range again.
- MichaelApproved 12y agoYou could, I can't. I use Verizon and they don't offer that feature.
- sspiff 12y agoI disabled it on my previous provider through a bunch of obscure operations that seemed like black magic to me. Unfortunately, I haven't figured out how to disable it on my current provider. I don't know why providers make this so hard for their users. Perhaps it's because the providers make money from those brief, useless voicemail connections? I assume the caller is billed just like he made a normal phone call. I personally hate listening to a machine and playbacks of recorded messages, but my employer uses my voicemail sometimes so I guess I'll have to cope.
- pritambaral 12y ago
- jameshart 12y agoSeems to generally demonstrate that sending a token to a voicemail is secured at best by voicemail PIN; he's demonstrated effectively that it certainly doesn't require possession of the phone. That turns two factor authentication -something you know, something you have - into 'wish-it-was-two-factor-authentication' - something you know, and something else you know. Sounds like the right approach is indeed to not give away 2fa codes when the recipient hasn't demonstrated that they have the user's phone in their hand
- jzwinck 12y agoQuite right. Here's another way to reduce the strength of the "something you have" aspect: You're at a one-on-one meeting with a powerful executive. She gets up to attend to some business outside the room, and leaves you with her cellphone on the table. Before the meeting you logged into Google on your own cellphone and set the wheels in motion, so as soon as she steps out you click "Verify" and Google calls her phone and interacts with "her" to verify the number. In just a minute or so you have convinced Google that her phone can be associated with your Google account. Now this might not be so bad--what are you going to do, set up your 2FA to use the executive's phone? No. The "verify" step you did above was for Google Voice number porting (https://support.google.com/voice/answer/1065667?hl=en https://support.google.com/voice/answer/1065667?hl=en). In a day or two, the executive's phone will stop working, as her plan will be automatically cancelled by her provider, as they are required to respond to Google's porting request (and they will probably not call to confirm). Now you can receive and even place all the calls you want--2FA verifications (including for Google), do some nefarious texting, etc.
- jameshart 12y agoRight, but to carry out that attack you have had to compromise two distinct factors - you had to figure out her password AND get access to her phone. The point of two factor authentication is precisely that that raises the bar. Someone who casually steals her phone is unlikely to be able to figure out her password; someone who compromises her password via the web is unlikely to be able to also steal her phone. But a determined, targeted attacker can certainly knock down both of those barriers. EDIT - realized you meant that this would allow you to associate her phone with your account, without needing any additional compromise other than access to the phone. That is a more subtle case - effectively what you're doing is stealing her phone number, but without stealing her phone, which means she might not notice for a while that the number has even been stolen. Interesting that similar vulnerabilities in domain transfer exist and have been mitigated with the need to obtain porting codes from registrars, as well as having domains 'locked' by default. Is phone number porting not protected similarly? I seem to remember having to provide a password for my old AT&T account in the apple store when I ported my number to Verizon...
- crb 12y agoWould recording a DTMF tone as your voicemail greeting get around the "press any key to get your code" prompt?
- quasque 12y agoIt would be interesting to see if the DTMF tone could be recorded, or if the voicemail system would capture it first and abort the recording. Maybe it depends on which tone is played? Investigating the extra A, B, C and D DTMF tones may be of use in this scenario, just in case voicemail systems don't recognise them as commands but 2FA callbacks allow them for confirmation.
- jpollock 12y agoIt depends on the quality of the codec used by the VM system. Any compression is likely to destroy the code. VoIP protocols usually send DTMF as specific messages for this reason. However I wouldn't be surprised if it worked.
- hetman 12y agoSending tones in band actually works reasonably well on mobile networks. It's not 100% reliable which is why alternate signaling is used, especially when the signal quality is low.
- kolev 12y agoPeople don't tend to read comments - I asked about this same thing below, but, for example, PhoneFactor, uses the #, which is often used to end recording, so, "any key" is dangerous, # is not as much.
- currysausage 12y agoWow, this Open Sans font is just plain unreadable on Windows (7) machines. It might be the fault of Windows' subpar font rendering, but here, the font is just too thin and blurry to be read. Damn, how I miss the days of simple HTML pages with no styling at all. Not beautiful, but readable, usable, fast, and ... yes, somehow beautiful in a pragmatic and very nerdy sense.
- currysausage 12y agoJust checked on my hi-res Nexus 4 screen: While not as blurry as on my W7 machine, the font is still unreadably thin. Seriously, why do people believe it was a good idea to make the font so thin that you can only read it with severe eye pain?
- tgb 12y agoSaves ink! ;-)
- laurent123456 12y agoWeb fonts are the new Flash. They make pages slow to load, hard to read and bring users no benefits. Thankfully they can be blocked easily with Adblocks or similar filters.
- izacus 12y agoHmm around here in EU pretty much noone uses voicemail (and is disabled by default on most mobile accounts). Is that such a huge issue in US?
- why-el 12y agoI moved to Germany five months ago and just last week my co-worker convinced me to disable voicemail on my cell phone. :)
- derfniw 12y agoI wonder where in the EU you live then. My experience in the Netherlands is that voicemail is often on by default with a at least a 'this is the voicemail of <telnr> leave a message after the beeb' greeting in it.
- cturner 12y agoA different issue - but around phone companies and security. When your contract is running low, they call you and ask you to tell you them your security information as part of resigning you under new terms. To emphasise: they cold call you and claim to be from the firm (which you don't know - it might be a phishing attack), and then ask you for your security details. They socialise their customers towards being vulnerable to phishing attacks. I had this ages ago with an Australian provider (Telstra), and recently in the UK (O2). Having followed up, I know it to be O2 policy that they are happy to do this. They... defended it on commercial grounds around practicality. I'm sure that I'm not the only one to have though this is crazy. I raised an incident but as you'd expect it went nowhere. Has anyone else tried to pick it up with firms that do it? Imagine a simple piece of legislation that banned calling and asking for security information. Would there be edge-cases that would make this a bad law?
- mjs 12y agoWhen this has happened to me, I ask for proof that they are from the company concerned, or that they already have my details. So far they've always been happy to do this, although I always have to go first…
- cstrat 12y agoProbably should note, for all Australian readers: All vulnerable endpoints for Optus Voicemail have been fixed. Including the endpoint I used to bypass their initial fix.
- tedchs 12y agoIf your telco has broken voicemail, I suggest using Google Voice and doing the dance to forward your no-answer/busy calls there.