Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows:

"In authentication, out-of-band refers to utilizing two separate networks or channels, one of which being different from the primary network or channel, simultaneously used to communicate between two parties or devices for identifying a user. A cellular network is commonly used for out-of-band authentication. An example of out-of-band authentication is when an online banking user is accessing their online bank account with a login and a one time password is sent to their mobile phone via SMS to identify them. The primary channel would be the online login screen where the user enters their login information and the second separate channel would be the cellular network. This added layer of security prevents the likelihood of hackers and malware from compromising access to the complete authentication process, however, this method of authenticating a user is known to be vulnerable to man-in-the-middle (MITM) attacks."

Can someone please explain why the bold line stands true? To put it in a different way, how is an out of band authentication like sms vulnerable to man in the middle attacks?

share|improve this question

migrated from stackoverflow.com May 6 '13 at 20:43

This question came from our site for professional and enthusiast programmers.

2 Answers 2

The threat is when the MITM owns the login screen.

If, for instance you click a link in an email that purports to be a link for https://yourbank.example but is actually a link to http://yourbank.evilbob.example, and enter the username and password you use for your bank website, Evil Bob merely needs to forward those on.

Then, https://yourbank.example which doesn't know that that it's EvilBob's website submitting your credentials and not you, dutifully sends an auth code to your phone and waits for your response. However, you're still on http://yourbank.evilbob.example, which has accepted your username and password and presented you with an input field to type in the auth code you're going to receive on your phone.

So, you type the auth code into http://yourbank.evilbob.example, which turns around and submits it to https://yourbank.example, and Evil Bob's website is now logged into your online banking interface.

That is the man in the middle threat for out of band two factor auth.

share|improve this answer

Out of band authentication relies on the added difficulty an attacker faces when trying to simultaneously eavesdrop on two communications. This difficulty arises due to the two channels being completely separated.

An attacker that can bring the two channels together defeats this defence. In the case of the Zeus malware, an infected PC attempts to infect mobile devices over USB or bluetooth. Once this has occurred, the attacker controls each of the client terminals used in the two-band authentication, he has effectively brought the channels together.

Zeus in particular will attempt to login via the PC, wait for the SMS to arrive on the mobile device, and communicate the SMS back to the PC (malware to malware). All this happens without any indication to the user of either device.

The problem here is that we are using two smart devices as client terminals. Smart devices have protocol stacks and software vulnerabilities. 'Dumb' hardware tokens such as HOTP fobs do not have these issues and cannot be subverted, which is one reason to prefer their usage.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.