Endpoint

5/17/2018
05:42 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cracking 2FA: How It's Done and How to Stay Safe

Two-factor authentication is a common best security practice but not ironclad. Here's how it can be bypassed, and how you can improve security.
Previous
1 of 8
Next

(Image: Golubovystock via Shutterstock)

(Image: Golubovystock via Shutterstock)

Two-factor authentication is common but hackable. If you haven't implemented 2FA, there's a good chance you're in the process. It's a growing best practice, especially in the workplace where growing stores of sensitive data demand employees strengthen their login security.

But 2FA isn't a guaranteed shield against cyberattacks. It can be bypassed, as most recently demonstrated by KnowBe4 chief hacking officer Kevin Mitnick in a hack last week. Mitnick used a phishing attack to prompt users for their LinkedIn credentials. When they were entered into the fake login page, the attacker could access their username, password, and session cookie. When Mitnick plugged the target's session cookie into his browser, he didn't need the second-factor code to log into the LinkedIn account.

Cracking 2FA isn't new; hackers have presented these types of exploits as concepts at conferences like Black Hat. But Mitnick's demo put the code into context for everyday users and showed them their second factor is hackable.

A challenge with implementing two-factor authentication is enforcing a policy that employees may consider inconvenient.

"It's always a matter of trying to balance usability and security," says Joe Diamond, director of security product management at Okta. Most companies err on the side of usability to stay on employees' good sides, but they run the risk of neglecting stronger security factors.

Here, we take a closer look at cyberattacks that can bypass two-factor authentication: how they are done, when they typically happen, which methods are most and least common, and how you can protect your employees from these types of exploits.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
williamconor
50%
50%
williamconor,
User Rank: Apprentice
9/17/2018 | 11:14:11 AM
Cracking the SS7 Network
NIST, the National Institute of Standards and Technology issued guidance that found SMS insecure and no longer suitable as a strong authentication mechanism...

I am using WebADM Multi-Factor Authentication with Hardware Token (U2F) and Hardware Security Modules (HSM) in order to comply with the highest security requirements...

This Security Solution from RCDevs is like a Swiss Army Knife.

It is even free up to 40 users.
NeverEnoughToys
100%
0%
NeverEnoughToys,
User Rank: Apprentice
5/23/2018 | 4:07:11 PM
That's not really cracking 2FA
Most of these aren't about cracking 2FA.  They are about bypassing 2FA.  The SS7 and SMS type examples could be argued as cracking, but they are really about breaking into SS7/SMS - the 2FA compromise is simply a welcome result or side effect. 

SMS is not secure and should never have been used for 2FA, but convenience wins (as the article points out).  Time based generators are much more secure (yep, and less convenient).
RyanSepe
0%
100%
RyanSepe,
User Rank: Ninja
5/21/2018 | 10:18:28 AM
Phishing
As a Security Engineer, I always stress the dangers of phishing and this is a perfect example as to why. It subverts most of the security safeguards at an organization with minimal effort as it exploits an open medium. This is why there has been a very steady transition from server side attacks to client side attacks. 
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
4 Ways to Fight the Email Security Threat
Asaf Cidon, Vice President, Content Security Services, at Barracuda Networks,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.