0

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. I believe that an attacker can publish an app in the store that is dedicated to intercept your 2FA SMS (for example) and force the installation on your device simply by hacking your account password.

I'm also conscious that some vendors use a mitigation approach like sending you an e-mail to advise you of a new access to your account, but the attacker can still lock you out for a limited time.

So the question, is this a real threat to two factor authentication security based on smartphone (not dedicated device) or is a reasonable risk that we can afford?

2

Relying on mobile as a second factor is somewhat haphazard anyway - there are increasing numbers of people relying on mobiles as primary internet access devices (especially in countries with limited wired infrastructure), so an app on a phone, an SMS, or an email can end up on the same device the attacker is using. This already causes problems - try making a payment with Paypal's mobile app if you have 2FA enabled, and it won't let you, since it attempts to protect against this kind of attack. They don't seem to have a good solution to it though.

There are obvious mitigation strategies to the attack in the paper referenced: phones could restrict installation from browsers (e.g. require a code displayed on the browser to be entered on the phone by hand, or disable the function by default, in a similar way to Bluetooth pairing methods, so the phone user needs to be actively looking for installation attempts for them to work), the app stores could be more proactive in detecting SMS reading functions, or the 2FA receiving pages could prompt for extra verification details (e.g. require the site password to be entered, which would add obstacles to session stealing attacks, or prompt for specific characters of the sent code, making human interaction easier than automated entry).

For most accounts, though, it's probably a low risk. If you use a strong password for your app store account, it should be hard for an attacker to trigger such a background load, and you should always pay attention to new applications being installed on your device. There are always applications that slip through any monitoring system, so the problem would appear to be the blind trust placed by the phone in the app store automated install process - a case of usability with a security downside.

1

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device.

2FA relies on the idea that the the device is actually fully owned by the user. If applications are installed which controlled by the attacker are able to intercept SMS etc the device is no longer fully owned by the user, since the attacker controls a major part of it.

This does not break 2FA by itself but it breaks the cheap 2FA implemented on insecure devices. This is actually no surprise.

Proper 2FA on devices with reduced functionality still work. This includes OTP generating software on a restricted smartphone (i.e. no other apps installed, no internet or mobile connection...). Also tamper resistant hardware tokens like smart cards or OTP tokens still work. All these are more secure but also more costly compared to implementing 2FA on a general purpose smartphone. costly.

  • +1 for differentiating 2FA by itself and the cheap implementation! – cornelinux Jul 20 '16 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.