Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/17/2018
05:42 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cracking 2FA: How It's Done and How to Stay Safe

Two-factor authentication is a common best security practice but not ironclad. Here's how it can be bypassed, and how you can improve security.
Previous
1 of 8
Next

(Image: Golubovystock via Shutterstock)

(Image: Golubovystock via Shutterstock)

Two-factor authentication is common but hackable. If you haven't implemented 2FA, there's a good chance you're in the process. It's a growing best practice, especially in the workplace where growing stores of sensitive data demand employees strengthen their login security.

But 2FA isn't a guaranteed shield against cyberattacks. It can be bypassed, as most recently demonstrated by KnowBe4 chief hacking officer Kevin Mitnick in a hack last week. Mitnick used a phishing attack to prompt users for their LinkedIn credentials. When they were entered into the fake login page, the attacker could access their username, password, and session cookie. When Mitnick plugged the target's session cookie into his browser, he didn't need the second-factor code to log into the LinkedIn account.

Cracking 2FA isn't new; hackers have presented these types of exploits as concepts at conferences like Black Hat. But Mitnick's demo put the code into context for everyday users and showed them their second factor is hackable.

A challenge with implementing two-factor authentication is enforcing a policy that employees may consider inconvenient.

"It's always a matter of trying to balance usability and security," says Joe Diamond, director of security product management at Okta. Most companies err on the side of usability to stay on employees' good sides, but they run the risk of neglecting stronger security factors.

Here, we take a closer look at cyberattacks that can bypass two-factor authentication: how they are done, when they typically happen, which methods are most and least common, and how you can protect your employees from these types of exploits.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
williamconor
50%
50%
williamconor,
User Rank: Apprentice
9/17/2018 | 11:14:11 AM
Cracking the SS7 Network
NIST, the National Institute of Standards and Technology issued guidance that found SMS insecure and no longer suitable as a strong authentication mechanism...

I am using WebADM Multi-Factor Authentication with Hardware Token (U2F) and Hardware Security Modules (HSM) in order to comply with the highest security requirements...

This Security Solution from RCDevs is like a Swiss Army Knife.

It is even free up to 40 users.
NeverEnoughToys
100%
0%
NeverEnoughToys,
User Rank: Apprentice
5/23/2018 | 4:07:11 PM
That's not really cracking 2FA
Most of these aren't about cracking 2FA.  They are about bypassing 2FA.  The SS7 and SMS type examples could be argued as cracking, but they are really about breaking into SS7/SMS - the 2FA compromise is simply a welcome result or side effect. 

SMS is not secure and should never have been used for 2FA, but convenience wins (as the article points out).  Time based generators are much more secure (yep, and less convenient).
RyanSepe
0%
100%
RyanSepe,
User Rank: Ninja
5/21/2018 | 10:18:28 AM
Phishing
As a Security Engineer, I always stress the dangers of phishing and this is a perfect example as to why. It subverts most of the security safeguards at an organization with minimal effort as it exploits an open medium. This is why there has been a very steady transition from server side attacks to client side attacks. 
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7843
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7846
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7847
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the context of the current user.
CVE-2019-7848
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7850
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.