7

I am doing a survey on various 2FA solutions, and recently I came across “Push” 2FA (e.g Duo Security). In this solution, the site (e.g. a banking site) pushes a notification to the user’s mobile phone, and the user taps on “Yes” if the transaction is legitimate, or “No” if it isn't.

Now, assuming the user password has already been compromised and only the second factor is standing in the way, wouldn’t a carefully crafted malware residing on the user’s phone simply be able to generate the “Yes” tap? How can the 2FA app even be sure the user inputs are coming from the user and not from a malware?

I keep hearing that app sandboxed, as in Android, prevents one app from interacting from another. Does this mean a malware can’t generate spurious inputs that mimic user inputs to the 2FA app?

  • I like your question but it would be good to clarify (including in the question title) whether you are asking specifically about Android malware (yes, the appropriate type of malware would be able to generate fake 'Yes' presses) or about whether push 2FA is secure against malware residing on a single device (yes, since you need to compromise the factors both on the device used to initiate login and on the additional device). – Steve Dodier-Lazaro Jan 27 '16 at 13:31
  • Edited title and content for better clarity – fox_hound_33 Feb 11 '16 at 7:25
7

I'll be writing from the assumption that 2FA is used with two separate devices. A single device with 2FA doesn't make any sense to me considering the risks associated with malware.


Is it possible to trick 2FA?

Now, wouldn’t a malware residing on the user’s phone simply be able to generate the “Yes” tap?

Yes, this is possible.

Pretty much nothing is safe from malware that enables root-access to a device. If you have 2FA enabled, and you have a keylogger, or some form of remote administration tool on the device, you could easily bypass almost all forms of 2FA using various different methods.

However, 2FA greatly mitigates this risk. While it is possible for malware to do this, it's also a lot less likely for an attacker to have control of every device in your possession.

How can the 2FA app even be sure the user inputs are coming from the user and not from a malware.

In most cases, this is assumed.

Like I said, it's very unlikely for an attacker to have breached all of your devices. Furthermore, if an attacker has access to your device, "generating a tap" isn't required; they only need to phantom-click the "X", and "Y" bounds of the device screen where the image button would appear.

Here's how it would work:

  1. Get the user's device resolution either through the system, or from a list of known devices and their resolutions.
  2. Perform a calculation of the device resolution against the expected position of the Push 2FA button. You know it will be within a certain % of the screen. In fact, this is how video games usually position UI elements.
  3. Malware initiates a "click" anywhere on that button's expected regions.
  4. ???
  5. Profit.

Wait, how can you force a click? Well, a piece of malware on Android could do something like this:

dispatchTouchEvent(
   MotionEvent.obtain(downTime, eventTime, action, x, y, pressure, size, 
                      metaState, xPrecision, yPrecision, deviceId, edgeFlags));

So what good is Two-Factor Authentication, then?

2FA is offering tremendous protection against someone who managed to get your password, but who doesn't have access to your computer or mobile phone.

Or maybe they have access to your computer, but not your phone. If they have access to your computer, non-Push-2FA can be bypassed quickly under the right circumstances. A keylogger, for example.

Maybe you found the malware on your device, and removed it. They might still have your password, but can't really do anything unless they also have access to your secondary authentication method.

It helps prevent unauthorized access from people who may have found, or even guessed your password. It also prevents people from hijacking your sessions.

2FA is not a one-size-fits-all solution - it's just another layer of protection. I would recommend using it.

I keep hearing that app sandboxing, as in Android, prevents one app from interacting from another. Does this mean a malware can’t generate spurious inputs that mimic user inputs to the 2FA app

That really depends. If you have root access to a device through an exploit, you also very likely have access to whatever sandboxing is occurring as well. It's relatively easy to programmatically "click" on a phone's screen region.

  • 2
    This answer assumes that the Push app runs on a different device than the primary authentication, and correctly describes the advantages in that case. Alas, for example the German bank Sparkasse promotes using the banking app and the Push TAN app on the same phone for simplified user experience. As shown on 32C3, the concerns of the asker are valid in that case. – Michael Karcher Jan 27 '16 at 7:57
  • @MichaelKarcher Correct. I don't see why a Push 2FA would be used no the same device. I'll update the answer. – Mark Buffalo Jan 27 '16 at 11:50
  • 1
    There's also an input event permission and a permission to draw on top of other windows on Android, as far as I recall. This comes into factor for how you'd build an auth spoofing attack on a sandboxed system. – Steve Dodier-Lazaro Jan 27 '16 at 13:32
  • @Mark Buffalo Appreciate the great explanation and the code snippet. Regarding the tap generation, assuming the device is un-rooted/non-jail broken, would it be possible for a piece of malware to generate taps on another app's window or even on the device's native windows (like home-screen, settings etc.)? I would assume this is not possible as this is fundamental to security and app isolation. If not, pretty much any app on your device would be able to launch and interact with any other app via spurious taps. – fox_hound_33 Feb 11 '16 at 7:42
  • 1
    To add to the discussion, a point in favor of OOB method is robustness to Phishing. The victim is lured to a fake site and made to enter OTPs, SMS/GRID Codes etc., which the attacker promptly uses for nefarious activities. In OOB push 2FA (assuming the user's device is secure) there is clear separation of the 2FA channel from the site. At least the user would know something is 'fishy' as the website he/she is looking at paints a different picture than what the app on his/her device is telling. Also, as no codes are involved, fraudsters calling victims and asking for codes/OTPs is eliminated. – fox_hound_33 Feb 11 '16 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.