7

Suppose I setup an online account with 2FA on my phone, and an attacker gains access to my phone. My phone is logged into my email account. The attacker knows my online service's account username or find the username from my emails. Then he requests an email password reset, and he uses the 2FA app on the phone to authorize the reset request. Now he has both the password and 2FA.

Is this scenario possible? How do I prevent it? What should I do in case I lose my phone to avoid this attack?

  • How would the attacker unlock your phone? – Limit Jun 23 '17 at 23:00
  • 1
    @Limit I consider the phone lock a weak security. It is quite easy to observe the unlock pattern or pin, or people can just snatch your phone in an unlocked state. Family members or spouses also commonly manage to gain access to the phone. – bamoqi Jun 24 '17 at 6:27
8

As @Limit pointed out in the comment under your question, the attacker would first need to unlock your phone. Which is a problem. But not impossible. But for the sake of argument, let's assume the attacker stole your phone in an unlocked position (you were sitting at a coffee shop, checking the internet, put it down, turned to talk to someone, and someone else swiped it for example).

To answer in a word, yes. This compromise is completely possible, and part of the reason I personally have a slight disgust to the ways some companies are rolling out 2FA. Especially google, who knows for a fact that the user that uses their authenticator on their phone likely also has their email on the very same device.

The security trinity is supposed to be this:

  • Something you are (username, fingerprint, retina)
  • Something you know (password, key-file, other data blob)
  • Something you have (OTP generator, Keyfob, yubikey)

The problem is that the user desires convenience, and this always presents a threat to this model. The key factor in the way the trinity works is that these things aren't supposed to overlap.

  • don't use your username as your password
  • don't use the same key-file for your "password" as your yubikey's public key (or worse private)
  • etc...

However this line is becoming increasingly blurred, because many users desire all of their tech related tasks to be aggregated on one device. It creates the situation where a person turns a password (something you know) into essentially a device that autocompletes the password when required. Effectively turning it into something you have since you are no longer required to know it, simply posses the device.

This situation is made worse by allowing that same device to also house the software authentication mechanism that is supposed to turn the device into a replacement for keyfobs.

What this ultimately creates is the false sense of security where the user thinks they have the trinity of username-password-authenticator but really only has a username and two authenticators, and both of them are one device.

This is made even worse if you think about how much of our lives are linked to said e-mail account. Not just your email itself, but any service that also registered with that email likely also has a reset policy that utilizes it. Thus allowing the attacker to also transfer ownership of any services to themselves through your one device. Furthermore the email also provides an easy to use interface that will search for the services you have signed up for. All they must do is search for "please verify your email by clicking here:" and out comes a list of domains where you have attempted to register.

This is something I try to advise people on whenever I see it. Each security step must be segregated as much as possible within reasonable usability constraints. If you have the google authenticator on your mobile, don't allow your email to remember the password to your gmail. If you do allow it, use the authenticator on another device, such as an ipad, another phone or your computer. There are some great alternatives to traditional authenticators that work with phones and don't require any operations to be done on the phone itself. Like the Yubikey NEO which has NFC enabled. Even if your phone is stolen, the yubikey likely wont be (Please don't attach it to the key-chain that hangs from your phones...).

These methods keep each part of the trinity separated, and thus, mitigate the problem somewhat. It's always important to clearly define the line between each part of your security structure. Otherwise they start to mesh together until, as in this case, they effectively become the same part of that trinity, leaving a void where one of them once stood.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.