Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?

  • 3
    The generic answer is "Yes, anything's possible". If you want a more specific answer, you'll need to give us more specific information like what type of 2FA (SMS, app, physical token, fingerprint, iris)? What type of service is this for (Gmail, github, ...)? What kind of attacker are you trying to protect against (your kid sister, some random hacker trying to bruteforce your password, the NSA)? – Mike Ounsworth Jun 15 '16 at 21:36
  • its about some random hacker who want to gain access to login into my bank account where bank uses 2FA for authentication by sending OTP through an automated call or SMS. – abhishek Jun 16 '16 at 16:29
  • Yes it is possible. Especially SMS are highly insecure. Apps can intercept the SMS on the phone. Also the SMS can be intercepted on the air. – cornelinux Jun 16 '16 at 18:38

You don't say what kind of 2FA process you are using and which kind of phone you have. But if the hacker manages to install a privileged application to your phone he might be able to capture 2FA tokens send with SMS or extracts the secrets from some OTP apps you use.

And installing an app to your phone without having physical access might be easier than you believe, like sending a MMS or using a drive-by download.

| improve this answer | |
  • also if 2FA is done via a text message and the attacker cloned your sim card and or intercepted the sms message – CaffeineAddiction Jun 15 '16 at 21:13

The difficulty of bypassing 2FA depends on the mechanism used for the second factor, but with SMS codes it's definitely possible and has been done before. In an actual incident recently, hackers were able to trick Verizon employees into redirecting the texts to a different phone by simply impersonating the subscriber.

| improve this answer | |

The short answer is yes.

They could install malware onto your phone, add an SMS redirect, hack a phone service, or just hack the target site.

| improve this answer | |

In case of codes sent with SMS or email, in addition to an already mentioned maliciuos app being planted on a device:

  • recently a social engineering hack has been revealed where an attacker sends a message convincing the victim to forward (or input on attacker site) the legitimate authentication message (login attempt from the attacker) that will follow

  • you can subvert the security yourself by running apps like Google Hangouts (configured to handle SMS) or Pushbullet which forward the message or just the contents of screen notifications to other devices that might not be in your vicinity, but might automatically display the contents (like a tablet left at your office)

| improve this answer | |

Yes. I speak from experience. Our company account has been hacked while we had 2FA in place.

  • Service provider: Amazon AWS
  • The technique: social engineering.

The hacker convinced the AWS servicedesk to disable 2FA.

The other answers here all talk about hacking your phone, or the website. This "hack" is another route and very effective.

If the hacker can somehow take over your email, that's another way. Many 2FA mechanisms have a reset or failback via email. If they control your mail, they can reset anything that can be reset via mail.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.