Seems like your intent is to defeat Two-Factor Authentication. There are a few ways to do this, some of which use your setup.
What is Two-Factor Authentication?
Two-Factor Authentication is essentially an added layer of security. If someone steals your password, and you have 2FA enabled, it is unlikely that they'd be allowed to log in without additional login details. For example, the World of Warcraft authenticator, a text message, or an email containing an access code.
Is Your Attack Possible?
- Is this thing working in a real scenario? 2FA can't block access of the attacker?
This is two questions:
- This is likely working in a real scenario.
- Correct, 2FA is relatively dumb when it comes to detecting something like this. 2FA only tries to verify, with an additional layer of security, that you are who you say you are when connecting from an unknown source.
However, https poses a challenge. How do you get the user to install a fake certificate in their browser? Most browsers are going to warn the individuals right off the bat if something is going on. Do you think most users will click, "I understand the risks, let me visit anwyay"?
You may not even need to use ssl
in some cases. You could probably redirect them to http://
instead of https://
, and they wouldn't notice it. A tech-savvy user may not even realize it.
Moreover, I would modify your attack:
- Collect their browser fingerprint
- After they attempt to login, redirect them to the true Facebook website with a login action.
- Use their browser fingerprint to log in.
Why? Because Facebook will alert them of the login. If it matches the IP address they're connecting from, and it shows the same browser fingerprint, then Facebook would likely presume you're just using Incognito mode with another browser window since your cookie sessions are different.
- Can you host offline https site and fake certificates to make less suspicious the site?
What you are describing is essentially a man-in-the-middle attack
alongside DNS hijacking
for the purposes of phishing
.
Yes, this is definitely possible. I've done something like this before as a test to try and defeat World of Warcraft's authenticator (I was bored, and wanted to see if it could be done; only did it to myself), and it worked pretty well - but I did not use DNS hijacking for that, only a MiTM.
How do you defeat Two-Factor Authentication?
I realize some of these methods will not be a direct response to your question. I'm simply providing an alternative viewpoint, as your goal is to break 2FA. You have to think outside the box.
In many cases, 2FA can be defeated by a keylogger
/ trojan
.
- "But Mr. Buffalo, why would I use a keylogger? How would I even infect them?" If you control the rogue access point, you can direct the user to a fake login page, or an EULA page with a "continue" button, and you can host a drive-by-download exploit on the page. Most users aren't going to look for this.
- In cases where different IP addresses and browser fingerprints are detected by the login system and rejected, such as World of Warcraft's secret auto-ban program that bans individuals connecting to North American servers who are located in China, and other "high-risk" countries, even if they're legitimate users, then you can defeat these detection systems by using the victim's internet connection as a proxy.
2FA can be defeated with your method, but would be even better if modified with the above suggestions.
- In cases of web browsing, you should also steal the victim's browser fingerprint and use it. This is a lot more work than you think, but if you pull it off, then it will appear to originate from the victim's machine, and not yours. Scary, isn't it? Someone could impersonate you with incredible precision, and even get you in trouble for breaking the law when it wasn't you who did it. This is a good reason why IP addresses can't be considered a person.
In either scenario, it requires a lot of work.
2FA can't block access of the attacker?
means... – Matthew Peters Nov 19 '15 at 14:11