https://doubleoctopus.com/blog/threats-and-alerts/bypassing-2fa/ Read the results of the largest US-based study focused on workforce passwordless authentication with Ponemon Institute The State of Workforce Passwordless Authentication report aa * Solutions + All Solutions o Passwordless Authentication o Desktop MFA o Next-Generation MFA o Remote Access o Admin Authentication o Phishing Prevention o Single Sign-On + [Mask-Group] Passwordless for On-Prem Active Directory and Everything Else Read Our Solution Overview * Product + Product Overview + Octopus Enterprise + Octopus Pro + Octopus Starter + Octopus Lite + Deep Dive * Partners + Tech Partners o ForgeRock o Lenovo o Okta o Yubico + Integrations o Workstations o Active Directory o Citrix o VPNs o View All * Resources + OctoCampus + Blog + Resource Center + Security Wiki + Support Center * Company + About + News & Events + Channels * Pricing * Let's talk * Get a demo Back to Octopus blog November 4th, 2019 Bypassing 2FA [svg][blog_post_] Bypassing 2FA Blog Monday November 4, 2019 Bypassing 2FA Two factor authentication is all the rage right now. Consumers and business users alike are encouraged to use 2FA. It is often heralded as the ultimate solution to protect us against the dangers of identity theft and corporate data breaches. Don't get me wrong, 2FA is immensely better than a primitive login, but it is still not all that it is made out to be. Here is the deal: passwords are fundamentally unsafe. As long as passwords stay in the mix, defending accounts with additional layers of security (no matter how robust ) is a band-aid solution at best. Read more * Every SaaS vendor: "Please add a phone number to keep your password secure." * Hackers: "Lol" Two factor authentication is all the rage right now. Consumers and business users alike are encouraged to use 2FA. It is often heralded as the ultimate solution to protect us against the dangers of identity theft and corporate data breaches. Don't get me wrong, 2FA is immensely better than a primitive login, but it is still not all that it is made out to be. Here is the deal: passwords are fundamentally unsafe. As long as passwords stay in the mix, defending accounts with additional layers of security (no matter how robust ) is a band-aid solution at best. 2FA fails to address the root cause and the motherload of all breaches - the passwords and the humans who create them. In this post we will focus on methods currently used by threat actors to bypass 2FA to demonstrate that the path to a stronger security and a true peace of mind lies in the realm of passwordless authentication. How do hackers bypass Two Factor Authentication? To begin with, hackers can use multiple exploit flows to target password-based 2FA logins, let's dig into a few common techniques for bypassing 2FA in action: Necro browser All genius solutions are simple - this is one of them. Two tools Muraena and NecroBrowser automate phishing attacks that can bypass 2FA. Most defenses won't stop them for a simple reason - these attacks go directly to the root cause of almost all breaches - the users. The way it works is the same as any phishing scheme, save for one significant upgrade. Instead of simply creating a fake website that looks like a legitimate one to trick users into typing in their passwords, the toolkit acts as a proxy between the victim and a legitimate website. Once the user attempts to login - the request is sent on behalf of the user to the service. The user, mistakenly thinking that they are on the legit login page, hands in both the password and the 2FA PIN directly into the hands of the attacker. Behind the scenes, the attacker logs-in using both factors on the actual login page and voila - they have complete access to the system. Fully automatically and in real time. Simple right? The biggest issue with NecroBrowser is that although the setup for such an attack is relatively complex, since it is a completely automated tool, bypassing 2FA becomes accessible to almost anyone, regardless of their technological prowess. Man in the browser attack Man-in-the-browser attacks require some legwork. First, a hacker prepares in advance by infecting an endpoint with a Trojan virus. This is usually done by asking the user "nicely" with the help of phishing, social engineering and spear-phishing techniques. Once the Trojan is active, the attacker is capable of controlling all of the user's internet activities. Threat actor gets unabated access to the browser history and activity, and even sees what the user types in. Yes, including passwords. Many Trojans designed for man-in-the-browser types of attacks can then generate code for extra input fields to appear on websites the user visits, including the ones required for stealing 2FA tokens. Many users have trusted their browser with too much personal information... They really shouldn't have. Man in the browser - Secret Double OctopusMan in the browser - Secret Double Octopus Social engineering and phishing Manipulating the users into doing their bidding is hackers' weapon of choice for a good reason: it works. Because social engineering uses human psychology against the users, no technology can effectively block social engineering attacks when passwords, and by extension humans are involved. There are several ways social engineering can be leveraged to bypass 2FA: Scenario one: The hacker has user credentials. Goes phishing. * The hacker sends a warning message to the user. The message says something along these lines: "Your user account has been accessed from a suspicious IP address if the IP does not belong to you please reply with the verification code sent to your number." * At the same time, the hacker uses a username and password to log into the targeted service. * The service provider sends 2FA code to the connected device, thinking that the request came from the user * The user responds to the fake warning message with the verification code they just received The result: Voila, the hacker was able to bypass the second step of 2FA. Scenario Two: The hacker has no credentials to get a ride on. Still goes phishing. The hacker does not know the username, password, phone number or the verification code. And still, uses social engineering and phishing attacks to get all of this (and more.) * The hacker first creates a persuasive email that looks like it is coming from the targeted service itself. * The email has a link that looks real. Once the user clicks the link, they are taken to a fake login page * When the user attempts to login on the fake page, the hacker uses the user credentials to simultaneously sign-in on the real website. * The real website sends a verification code to the number associated with the legitimate user * The user gets the 2FA token and enters it on the fake login site * The hacker gets the code as well and uses it to complete login on the real website. The result: Voila, the hacker was able to bypass the second step of 2FA. Privilege escalation Once attackers have gained access to a corporate account, they then look for vulnerabilities, design flaws or configuration oversights to gain elevated access to protected resources all the way from the user level up to the Kernel level. Once they have done that, they can manipulate 2FA settings. For example, modify the phone number associated with the account so that the OTP is now sent to the attacker's device. Preventing by removing the target - taking the human element out of the equation In a password-first world humans are the last line of defense against hackers. This is a very precarious situation we got ourselves here, since 100% of data breaches involve humans. Humans create easy to guess passwords, reuse passwords across services, write them down, share them, and often give them away without even realizing that they are doing it. To be fair, it is the very nature of passwords that puts humans in the center of the security universe. It is shocking to contemplate, but it 2019, the outdated and outmoded password still remains the most common method of authentication. 2FA doesn't change that - it only makes the situation a bit more palatable by adding more factors on top. Basically, hackers can target 2FA authentication in an almost endless amount of ways: * Bruteforce the 2FA PINs * Intercept 2FA PINs "in transit" * Reroute 2FA to attacker's device * Get 2FA PIN directly from the user, with spoofing and social engineering * Steal session tokens after 2FA occurs and log into the account without going through 2FA at all * Exploit bugs such as 2FA tokens that don't expire, no rate limiting on 2FA text box. * And here comes the big one: sometimes people just leave huge troves of data lying around that includes 2FA tokens. (Happens more often than you'd think.) All Hail Passwordless Authentication The way out of this mess is simple - let go of passwords. Forget password managers and complicated password policies - they haven't worked in the past, and they definitely won't work in the future. Passwordless authentication is 100% human proof. It means that we finally have an authentication method that doesn't rely on the weakest link in security. It is time to let the whole paradigm of security that relies on user-controlled passwords behind - the technology has finally caught up. The Octopus Authenticator of Secret Double Octopus is the only passwordless solution offering seamless, mathematically unbreakable authentication that doesn't require humans to come-up with, manage, memorize or input passwords. Octopus provides the very highest in authentication assurance while completely removing password related hustle from the user experience. Written by [svg][7-1-1024x536] Secret Double Octopus Staff IMPORTANT UPDATE POSITION With a combined experience of over 100 years in the cybersecurity industry, our staff shares their knowledge and vision. Previous article True Cost of Password Based Authentication [svg][blog_post_] True Real Cost of Passwords Blog Thursday October 3, 2019 True Cost of Password Based Authentication Just because you don't have to pay anything extra to buy this common form of authentication, it doesn't mean that passwords are free. Far from it, quite often passwords end up costing enterprises much more than what they have bargained for. Although the cost of passwords rarely comes up in management meetings, authenticating identity using... Read more Next article Password Managers - Convenience is Not Security [svg][blog_post_] Password Managers Blog Wednesday November 13, 2019 Password Managers - Convenience is Not Security Project Zero has recently disclosed that a security vulnerability left some of LastPass 16 million users exposed to the risk of credential compromise. In an ironic twist, LastPass, the supposedly secure gatekeeper of passwords, could leak the last password used to any website visited. The vulnerability has since been patched, but maybe it is time... Read more More Things That Might Interest You Octocampus Modern Enterprise Authentication explained * Saiba mais Resource Center Everything you need to know about our Authentication platform * Saiba mais The Security Wiki Learn about Authentication methods, protocols, encryption, and more * Saiba mais [svg][res_webina] Webinar Wednesday February 17, 2021 Implementing Enterprise Passwordless Authentication Watch Secret Double Octopus's & ForgeRock's joint webinar to learn how ForgeRock users can boost security and improve productivity by deploying passwordless authentication for workstations and everything else. Read more Watch Now [svg][res_paper_] Remote Access Security Paper Wednesday August 18, 2021 MFA for the Remote Workforce Today's employees depend on easy and highly secure access to everything they need, wherever they are. See how passwordless authentication makes remote access seamless and trouble-free for enterprise employees and administrators! Read more Download Whitepaper About us Secret Double Octopus is the passwordless authentication solution for the enterprise. We liberate end-users and security teams from the burden of passwords with the simplicity and security of strong passwordless authentication. The Octopus Passwordless Enterprise(tm) technology provides unified user experience and a consistent way to access workstations, remote services, cloud applications and on-prem systems while providing stronger protection against cyber-attacks. From being named a Gartner "Cool Vendor" in 2016, our 4th generation platform is now serving mid-sized to Fortune 50 customers around the globe. Tweets by double_octopus Keep in Touch! Sign Up For Our Octopus Updates. * * * * Solutions + Multi Factor Authentification + Passwordless Authentication + Desktop MFA + Single Sign-On + Remote Access + Admin Authentification + Phishing Prevention * Products + Octopus Passwordless Enterprise + Octopus Pro + Octopus Starter + Octopus Lite + Deep dive + FIDO * Resources + OctoCampus + Resources Library + Octopus Blog + News And Events + Security Wiki * Partners & Integrations + ForgeRock + Okta + Yubico + Lenovo + All Integrations + About + Pricing * Company + About Us + Channels + Support Center + Pricing [svg][SDO-logoblue] * * * (c) 2021 Secret Double Octopus | All Rights Reserved * Privacy Policy * Terms and Conditions * This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. * Accept * Read More In what matter did you want to talk to us? x Request a Demo Schedule a personalized demo with our experts and get on the path to full passwordless authentication! x x [svg][thank-you-] Thank you for getting in touch, we'll contact you soon!