Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

two-factor authentication process that uses one-time random code,I think season hijack can be used, I would like to know if there are more techniques to crack it.

With season hijack, I think that if I season hijacked a victim that use 2FA it will allow me to bypass that process and access his account directly.

share|improve this question
Depends entirely on the two factors used, fingerprints can be faked (jelly finger), pseudo-random number generators will produce the same if given the same seed... The point is an attacker now has to crack both factors, not just one. – ewanm89 Nov 11 '12 at 12:54
Ah, I think i need to add more detail, I am thinking about the peseudo-random codes generated by Facebook,Google and others for two-factor authentication process.. – Hamza Al-sbaihi Nov 11 '12 at 12:56
@ewanm89 I would've gone with the facial recognition option, since most implementations I've seen fall to a photograph of a face! – Polynomial Nov 11 '12 at 13:10
1  
@Polynomial there is an easy fix for that, give the computer stereoscopic vision, but yeah. – ewanm89 Nov 11 '12 at 13:22
@ewanm89 Yeah, the only ones I've seen that beat photographs are the ones that take multiple shots and stitch them together to produce a "3D" map. – Polynomial Nov 11 '12 at 14:46
show 3 more comments

closed as not a real question by Rook, Scott Pack, AviD♦ Nov 14 '12 at 10:07

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

2 Answers

up vote 3 down vote

Hey so I think you are missing the point when you ask this question. Lets take an ATM for example. You need your bank card and a 4 digit pin. 4 digit pin has 10^4 possibilities and could potentially be guessable.

Also its important to look at the bits of information you need. The card falls under "Something you have" and the pin falls under "Something you know". This is important part of 2 factor auth because it makes it highly unlikely you will aquire both

the problem with trying to crack the pin is there are other security mechanisms in place. At the ATM they use a throttle where you can only attempt to log in X number of times before they take your card. On the internet they will use a throttle and after a few tries they will force you to enter a recaptcha or they will have a required delay between failed attempts (a few added seconds before the page will let you try again) or just lock you out of the account

So....to answer your question. 2 factor auth might be crackable but there are steps taken to prevent you from cracking and make it extremely unlikely that an attacker will crack it. I don't understand your question very well so I went with this generic answer

edit: I looked at facebook like you asked. The pin they send you is 6 digits send to your phone via SMS. They do allow you to download an app to generate them on your phone which could be interesting to look at. They don't throttle logins but they do give you a "Facebook Notification" saying someone has tried to log into your account unsuccessfully.

Not Surprisingly you must have the correct password to get to the point to enter the pin.

If you are trying to crack it you are going to have to send a lot of traffic to Facebook and they will notify the person you are attempting to crack. Also, the person will get a text message with a code saying that someone has attempted to log in (with the correct password).

I would say as an attacker.....their facebook probably isn't a good place to go after remotely if they are using 2 factor authentication. It may actually be easier just own their box first and go to facebook from their computer that they have already logged in from.

share|improve this answer
In the detail, I mentioned that my question is about two-factor mechanism that provide you with one-time code to enter. Such as Facebook two-factor mechanism. – Hamza Al-sbaihi Nov 11 '12 at 14:50
up vote 2 down vote

You ask for an answer specific to the 2FA mechanism which websites like gmail provide.

Your passwords fall under something you know, the one time code provided to you through a phone app or something similar is something you have.

Can you bruteforce the one time code? Very unlikely - you only have a 30 second window before the code changes. Also, most online services lock the account out after a certain number of failed attempts.

In your question you mentioned session hijacking. You should probably do a little more reading on the subject as session hijacking not really relevant to the 2FA authentication, although it is a very real threat.

share|improve this answer
I meant if I season hajicked a victim, it will not require me to go through 2FA process, is this a possible way to bypass 2FA? – Hamza Al-sbaihi Nov 12 '12 at 18:58
1  
If you do not go through the 2FA system then you have bypassed the 2FA... – Rell3oT Nov 13 '12 at 14:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.