Endpoint

5/17/2018
05:42 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cracking 2FA: How It's Done and How to Stay Safe

Two-factor authentication is a common best security practice but not ironclad. Here's how it can be bypassed, and how you can improve security.
Previous
1 of 8
Next

(Image: Golubovystock via Shutterstock)

(Image: Golubovystock via Shutterstock)

Two-factor authentication is common but hackable. If you haven't implemented 2FA, there's a good chance you're in the process. It's a growing best practice, especially in the workplace where growing stores of sensitive data demand employees strengthen their login security.

But 2FA isn't a guaranteed shield against cyberattacks. It can be bypassed, as most recently demonstrated by KnowBe4 chief hacking officer Kevin Mitnick in a hack last week. Mitnick used a phishing attack to prompt users for their LinkedIn credentials. When they were entered into the fake login page, the attacker could access their username, password, and session cookie. When Mitnick plugged the target's session cookie into his browser, he didn't need the second-factor code to log into the LinkedIn account.

Cracking 2FA isn't new; hackers have presented these types of exploits as concepts at conferences like Black Hat. But Mitnick's demo put the code into context for everyday users and showed them their second factor is hackable.

A challenge with implementing two-factor authentication is enforcing a policy that employees may consider inconvenient.

"It's always a matter of trying to balance usability and security," says Joe Diamond, director of security product management at Okta. Most companies err on the side of usability to stay on employees' good sides, but they run the risk of neglecting stronger security factors.

Here, we take a closer look at cyberattacks that can bypass two-factor authentication: how they are done, when they typically happen, which methods are most and least common, and how you can protect your employees from these types of exploits.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NeverEnoughToys
100%
0%
NeverEnoughToys,
User Rank: Apprentice
5/23/2018 | 4:07:11 PM
That's not really cracking 2FA
Most of these aren't about cracking 2FA.  They are about bypassing 2FA.  The SS7 and SMS type examples could be argued as cracking, but they are really about breaking into SS7/SMS - the 2FA compromise is simply a welcome result or side effect. 

SMS is not secure and should never have been used for 2FA, but convenience wins (as the article points out).  Time based generators are much more secure (yep, and less convenient).
RyanSepe
0%
100%
RyanSepe,
User Rank: Ninja
5/21/2018 | 10:18:28 AM
Phishing
As a Security Engineer, I always stress the dangers of phishing and this is a perfect example as to why. It subverts most of the security safeguards at an organization with minimal effort as it exploits an open medium. This is why there has been a very steady transition from server side attacks to client side attacks. 
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Risk, Privacy, and Information Security Officer, AvePoint, Inc.,  8/20/2018
Ohio Man Sentenced To 15 Months For BEC Scam
Dark Reading Staff 8/20/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15667
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an external application to send arbitrary emails from an active account without authentication. The handler has no restriction on who can...
CVE-2018-15668
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate atta...
CVE-2018-15669
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are...
CVE-2018-15670
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if t...
CVE-2018-15671
PUBLISHED: 2018-08-21
An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attempted parse of a crafted HDF file. This results in denial of service.