3 ms·

Quite right. Here's another way to reduce the strength of the "something you have" aspect: You're at a one-on-one meeting with a powerful executive. She gets

by jzwinck 12y ago

Quite right. Here's another way to reduce the strength of the "something you have" aspect: You're at a one-on-one meeting with a powerful executive. She gets up to attend to some business outside the room, and leaves you with her cellphone on the table. Before the meeting you logged into Google on your own cellphone and set the wheels in motion, so as soon as she steps out you click "Verify" and Google calls her phone and interacts with "her" to verify the number. In just a minute or so you have convinced Google that her phone can be associated with your Google account. Now this might not be so bad--what are you going to do, set up your 2FA to use the executive's phone? No. The "verify" step you did above was for Google Voice number porting (https://support.google.com/voice/answer/1065667?hl=en https://support.google.com/voice/answer/1065667?hl=en). In a day or two, the executive's phone will stop working, as her plan will be automatically cancelled by her provider, as they are required to respond to Google's porting request (and they will probably not call to confirm). Now you can receive and even place all the calls you want--2FA verifications (including for Google), do some nefarious texting, etc.

jameshart 12y ago
Right, but to carry out that attack you have had to compromise two distinct factors - you had to figure out her password AND get access to her phone. The point of two factor authentication is precisely that that raises the bar. Someone who casually steals her phone is unlikely to be able to figure out her password; someone who compromises her password via the web is unlikely to be able to also steal her phone. But a determined, targeted attacker can certainly knock down both of those barriers. EDIT - realized you meant that this would allow you to associate her phone with your account, without needing any additional compromise other than access to the phone. That is a more subtle case - effectively what you're doing is stealing her phone number, but without stealing her phone, which means she might not notice for a while that the number has even been stolen. Interesting that similar vulnerabilities in domain transfer exist and have been mitigated with the need to obtain porting codes from registrars, as well as having domains 'locked' by default. Is phone number porting not protected similarly? I seem to remember having to provide a password for my old AT&T account in the apple store when I ported my number to Verizon...
- jzwinck 12y ago
  Your edit is correct. And the Google Voice instructions posted at the above link right now are clear: you do not need to interact with your old carrier to get your number on Google Voice. I have tried it myself. I believe what I outlined turns "Something you know and something you have" into "Something you know and something you once had for a minute at a different point in time." This is a significant to the 2FA security model, because the victim may mistakenly believe that even when left alone with her phone, especially if the phone requires a code to access (which is often not needed to answer a call), you would not be able to take control of her accounts unless you were simultaneously using a computer to do so. All you need is to click the "Verify" button on your Google account at the right time, which would likely go unnoticed.
  - jameshart 12y ago
    But all 'something you have' authentication is vulnerable to the theft of the 'something you have' - your attack is just a slightly more sophisticated version of stealing the phone. I don't think it's particularly relevant to the use of a phone as a 2fa device.

by jzwinck 12y ago

jameshart 12y ago

Right, but to carry out that attack you have had to compromise two distinct factors - you had to figure out her password AND get access to her phone. The point of two factor authentication is precisely that that raises the bar. Someone who casually steals her phone is unlikely to be able to figure out her password; someone who compromises her password via the web is unlikely to be able to also steal her phone. But a determined, targeted attacker can certainly knock down both of those barriers. EDIT - realized you meant that this would allow you to associate her phone with your account, without needing any additional compromise other than access to the phone. That is a more subtle case - effectively what you're doing is stealing her phone number, but without stealing her phone, which means she might not notice for a while that the number has even been stolen. Interesting that similar vulnerabilities in domain transfer exist and have been mitigated with the need to obtain porting codes from registrars, as well as having domains 'locked' by default. Is phone number porting not protected similarly? I seem to remember having to provide a password for my old AT&T account in the apple store when I ported my number to Verizon...

jzwinck 12y ago
Your edit is correct. And the Google Voice instructions posted at the above link right now are clear: you do not need to interact with your old carrier to get your number on Google Voice. I have tried it myself. I believe what I outlined turns "Something you know and something you have" into "Something you know and something you once had for a minute at a different point in time." This is a significant to the 2FA security model, because the victim may mistakenly believe that even when left alone with her phone, especially if the phone requires a code to access (which is often not needed to answer a call), you would not be able to take control of her accounts unless you were simultaneously using a computer to do so. All you need is to click the "Verify" button on your Google account at the right time, which would likely go unnoticed.
- jameshart 12y ago
  But all 'something you have' authentication is vulnerable to the theft of the 'something you have' - your attack is just a slightly more sophisticated version of stealing the phone. I don't think it's particularly relevant to the use of a phone as a 2fa device.