4

I had some interesting situation: My Amazon account has 2FA enabled where my smartphone with google authenticator is my second factor.

Due to issues with this phone my second factor basically broke (no longer produced reliable pins). Since I was on a machine which was marked as trusted I could shop etc just with my email+password on this machine.

When I however tried to add a new smartphone as a replacement factor even on my trusted device I was prompted to enter the second factor, which I couldn't. I then had to resort to entering a phone number in the support area and a representative called me back.

Now what happened caused a little bit of doubt on the usefulness of my fancy 2FA: The agent asked me for my email address I used to log in to amazon which I told him. Then the agent sent me a pin to to this email address. After I read back this pin to the agent she suggested to disable the entire 2FA so I could log in, do my things and eventually enable 2FA back again.

Is this a plausible attack vector? I am aware that an attacker needs the password for my amazon account and the password to the mail account for this amazon account, which itself might be not trivial but I am a little irritated that without further ado I could remove the second factor from my authentication. No further information like birth date etc was asked.

(Since my email address did not reuse the amazon password (or any password) and it itself uses a 2FA I regard this threat quite low for my situation, but it still somehow feels odd)

4

Is this a plausible attack vector?

A lot of consumer sites base there security measures on a chain of trust. They trust you to make sure your primary contact method is properly secured. They need a primary contact which in most cases is your email address. All password resets, account management, notifications etc go through this.

Given the size of Amazon and the % of people tech savy enough to set up and manage advanced multi factor auth, I imagine it is a business decision to keep their 2FA as simple as possible. After all it is not their problem if your email account was compromised, which would be a mandatory step to then disable their 2FA.

To be completely secure I would take additional steps to secure the final step in the chain of trust, i.e your email account. Google just launched a very nice feature that creates a multi factor auth system that requires extended checks to reset. You may not be using a Google account but it serves as a good example of how to do it.

Find out more here: https://landing.google.com/advancedprotection/

  • This is the first I've heard of google's advanced protection. Upvote just for that. Also if I can suggest, it might not hurt to directly answer his question. My reading of your answer (and also my opinion) is this: "Yes, this is a plausible attack vector, which amazon allows for these business reasons". However, that isn't immediately obvious from what you have written here. – Conor Mancone Oct 19 '17 at 16:44
0

You're missing a factor: your phone.

Although the 2FA code generator on your phone no longer worked, you were still in control of your phone. This was verified when Amazon called you, rather than you calling them.

In order to receive the call from Amazon, an adversary would need to have physical access to your device or somehow intercept the call. If an adversary has physical access to your device, you'd be boned anyway. Without access to telephone/cellular infrastructure, the only way someone could intercept the call I'm aware of is if they have the correct SIM Card. That requires either stealing yours, which would also require hands on your device and would be noticed rather quickly once you try to access the internet, or hacking yours (see this about a 2013 vulnerability).

I have also heard of social engineering being used on cell phone providers to get a replacement SIM card. A while back a popular YouTube channel claimed this happened to them. I don't recall who and I can't find the video so I may be incorrect on that point.

So while this is an attack vector, it's not much more than someone getting their hands on your phone already.

  • Plot twist: I was allowed to enter any phone number that was going to be called. I decided to use my mobile because I wasn't sure I will be at home when they call my home number. So I would not count on my phone :) – Samuel Nov 19 '17 at 10:08
  • @Samuel Oh damn. Well that would be bad then. Unless it did actually authenticate the cell phone number to match (based on your account or caller ID). If this happens again, you should try setting up a temporary Twilio number with a hidden caller ID. – Rob Rose Nov 19 '17 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.