2

My Android 7.0 phone is somewhat lagging behind on the security updates, a situation I cannot change unfortunately (unless I would root the phone).

I am not too concerned about this in general since I don't run critical apps on the phone - with one exception: I'm using Google Authenticator to generate 2FA keys on this phone.

Hence the question: are there any known exploits directly targeting Authenticator, or (indirectly) by allowing an attacker to read out the keys as they generated on a compromised phone?

3
  • 1
    If such a thing were public knowledge, it would likely come up in a Google search. However, that does not seem to be the case. Commented Apr 17, 2018 at 17:16
  • If there are, it would appear they've never been reported publicly. cvedetails.com/product/25037/…
    – nbering
    Commented Apr 17, 2018 at 17:17
  • @multithr3at3d Good point. Can't completely shake the feeling though that this was the most polite LMGTFY I've ever received ;) Commented Apr 18, 2018 at 11:29

1 Answer 1

2

One thing I found in previous research. The database is a simple sqlite database which can be copied to extract keys and recreate the QR codes. If somebody were able to exploit your phone and root it they, in theory, could copy this database.

Disclaimer: I haven't personally done any of this, so no guarantees.

Extracting the database: https://gist.github.com/jbinto/8876658

Creating QR codes from the DB: https://gist.github.com/naftulikay/5702d57eb4cb6ef6e7e8

5
  • 1
    You need to have a rooted phone for this to work. On Android, apps without root privileges cannot read other apps' data.
    – ThoriumBR
    Commented Apr 17, 2018 at 21:36
  • Yep, it'd require someone to root your phone (that's mentioned in the answer). That's not too difficult with an old, unpatched OS. Hit an evil website, download a malicious app, etc. Hell, even bluetooth and wifi aren't safe. trendmicro.com/vinfo/us/security/news/mobile-safety/… Commented Apr 17, 2018 at 21:43
  • That's interesting, and might answer my question (to the negative). Just to clarify: the information needed to recreate the 2FA seeds is stored in an unencrypted sqlite database, right? Meaning that the only line of defense is that Android doesn't under normal circumstances allow another app to read this database -- which however wouldn't necessarily hold any longer if the phone would be rooted/compromised. Commented Apr 18, 2018 at 11:35
  • (follow-up) It seems like there's an app called "Authenticator Plus" that would solve, or at least: mitigate the problem by adding an app-internal encryption layer to store the key data. I still need to look into whether the app itself is trustworthy, but it seems that could be a replacement for default Authenticator then to prevent key info being extracted in plain text on a rooted phone, right? Commented Apr 18, 2018 at 11:47
  • 1
    Authenticator Plus appears to solve the encryption problem. And yes, your interpretation of my response is correct. Commented Apr 18, 2018 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .