Does this concept attack work to harvest credentials and 2FA using offline fake site?

Question

My concept is this:

1. Client connects to Malicious\Eviltwin AP
2. Client connects to www.facebook.com but this one is a fake offline site by the fake dns server
3. Client enters user and password ---> attacker gets credentials
4. Attacker use the creds to enter into 2Factor Auth page of facebook
5. Attacker replicate/prompts 2FA fake page also offline and gets the 2FA Code
6. Attacker gain full access to the account
7. Sends error message to client and then prompt him into the real facebook

My questions are:

• Is this thing working in a real scenario? 2FA can't block access of the attacker?
• Can you host offline https site and fake certificates to make less suspicious the site?

Answer 1

Seems like your intent is to defeat Two-Factor Authentication. There are a few ways to do this, some of which use your setup.

What is Two-Factor Authentication?

Two-Factor Authentication is essentially an added layer of security. If someone steals your password, and you have 2FA enabled, it is unlikely that they'd be allowed to log in without additional login details. For example, the World of Warcraft authenticator, a text message, or an email containing an access code.

---

Is Your Attack Possible?

1. Is this thing working in a real scenario? 2FA can't block access of the attacker?

This is two questions:

1. This is likely working in a real scenario.
2. Correct, 2FA is relatively dumb when it comes to detecting something like this. 2FA only tries to verify, with an additional layer of security, that you are who you say you are when connecting from an unknown source.

However, https poses a challenge. How do you get the user to install a fake certificate in their browser? Most browsers are going to warn the individuals right off the bat if something is going on. Do you think most users will click, "I understand the risks, let me visit anwyay"?

You may not even need to use ssl in some cases. You could probably redirect them to http:// instead of https://, and they wouldn't notice it. A tech-savvy user may not even realize it.

Moreover, I would modify your attack:

1. Collect their browser fingerprint
2. After they attempt to login, redirect them to the true Facebook website with a login action.
3. Use their browser fingerprint to log in.

Why? Because Facebook will alert them of the login. If it matches the IP address they're connecting from, and it shows the same browser fingerprint, then Facebook would likely presume you're just using Incognito mode with another browser window since your cookie sessions are different.

2. Can you host offline https site and fake certificates to make less suspicious the site?

What you are describing is essentially a man-in-the-middle attack alongside DNS hijacking for the purposes of phishing.

Yes, this is definitely possible. I've done something like this before as a test to try and defeat World of Warcraft's authenticator (I was bored, and wanted to see if it could be done; only did it to myself), and it worked pretty well - but I did not use DNS hijacking for that, only a MiTM.

---

How do you defeat Two-Factor Authentication?

I realize some of these methods will not be a direct response to your question. I'm simply providing an alternative viewpoint, as your goal is to break 2FA. You have to think outside the box.

• In many cases, 2FA can be defeated by a keylogger / trojan.

  • "But Mr. Buffalo, why would I use a keylogger? How would I even infect them?" If you control the rogue access point, you can direct the user to a fake login page, or an EULA page with a "continue" button, and you can host a drive-by-download exploit on the page. Most users aren't going to look for this.
  • In cases where different IP addresses and browser fingerprints are detected by the login system and rejected, such as World of Warcraft's secret auto-ban program that bans individuals connecting to North American servers who are located in China, and other "high-risk" countries, even if they're legitimate users, then you can defeat these detection systems by using the victim's internet connection as a proxy.

• 2FA can be defeated with your method, but would be even better if modified with the above suggestions.

  • In cases of web browsing, you should also steal the victim's browser fingerprint and use it. This is a lot more work than you think, but if you pull it off, then it will appear to originate from the victim's machine, and not yours. Scary, isn't it? Someone could impersonate you with incredible precision, and even get you in trouble for breaking the law when it wasn't you who did it. This is a good reason why IP addresses can't be considered a person.

In either scenario, it requires a lot of work.

Answer 2

It seems like you have already tried it; what were the results? In theory your attack could work however there are a few key items to consider:

• The biggest hold up is time, you would need to automate this process so you can essentially prompt the victim in near real time for the 2FA key. This may lead to issues because of its complex setup and maintenance.
• Facebook does log the IP addresses and last login attempts so a savvy user could identify this, but this isnt so much of a show stopper.
• Some 2FA setups may detect that the 2FA device and actual browser logging into facebook are mismatched and fail to log in (or prompt for more security questions).

The bottom line is that it may simply be easier to perform a rubber hose attack to get whatever data you are really after because at the end of the day your attack requires a lot of setup and is really only effective if you know at least some amount about your intended target.

Answer 3

To trigger the server to make a 2FA Code, you need to be the server, using a social engineering attack vector will not be enough, you can only duplicate the webpage but not the code that generates and sends the key....

Assuming that you can build a server, your server must have the original servers key, has to be trusted by the receivers 2FA system and must mimic it in it's entirety.

Assuming (1/Million Chance), that you even can do this, the 2FA upon entry invalidates (i.e. After the 2FA is used, it is worthless) so even if you harvest it, it is invalid.