I'll be writing from the assumption that 2FA is used with two separate devices. A single device with 2FA doesn't make any sense to me considering the risks associated with malware.
Is it possible to trick 2FA?
Now, wouldn’t a malware residing on the user’s phone simply be able to generate the “Yes” tap?
Yes, this is possible.
Pretty much nothing is safe from malware that enables root-access to a device. If you have 2FA enabled, and you have a keylogger, or some form of remote administration tool on the device, you could easily bypass almost all forms of 2FA using various different methods.
However, 2FA greatly mitigates this risk. While it is possible for malware to do this, it's also a lot less likely for an attacker to have control of every device in your possession.
How can the 2FA app even be sure the user inputs are coming from the user and not from a malware.
In most cases, this is assumed.
Like I said, it's very unlikely for an attacker to have breached all of your devices. Furthermore, if an attacker has access to your device, "generating a tap" isn't required; they only need to phantom-click the "X", and "Y" bounds of the device screen where the image button would appear.
Here's how it would work:
- Get the user's device resolution either through the system, or from a list of known devices and their resolutions.
- Perform a calculation of the device resolution against the expected position of the Push 2FA button. You know it will be within a certain
% of the screen. In fact, this is how video games usually position UI elements.
- Malware initiates a "click" anywhere on that button's expected regions.
- ???
- Profit.
Wait, how can you force a click? Well, a piece of malware on Android could do something like this:
dispatchTouchEvent(
MotionEvent.obtain(downTime, eventTime, action, x, y, pressure, size,
metaState, xPrecision, yPrecision, deviceId, edgeFlags));
So what good is Two-Factor Authentication, then?
2FA is offering tremendous protection against someone who managed to get your password, but who doesn't have access to your computer or mobile phone.
Or maybe they have access to your computer, but not your phone. If they have access to your computer, non-Push-2FA can be bypassed quickly under the right circumstances. A keylogger, for example.
Maybe you found the malware on your device, and removed it. They might still have your password, but can't really do anything unless they also have access to your secondary authentication method.
It helps prevent unauthorized access from people who may have found, or even guessed your password. It also prevents people from hijacking your sessions.
2FA is not a one-size-fits-all solution - it's just another layer of protection. I would recommend using it.
I keep hearing that app sandboxing, as in Android, prevents one app from interacting from another. Does this mean a malware can’t generate spurious inputs that mimic user inputs to the 2FA app
That really depends. If you have root access to a device through an exploit, you also very likely have access to whatever sandboxing is occurring as well. It's relatively easy to programmatically "click" on a phone's screen region.
