My Android 7.0 phone is somewhat lagging behind on the security updates, a situation I cannot change unfortunately (unless I would root the phone).

I am not too concerned about this in general since I don't run critical apps on the phone - with one exception: I'm using Google Authenticator to generate 2FA keys on this phone.

Hence the question: are there any known exploits directly targeting Authenticator, or (indirectly) by allowing an attacker to read out the keys as they generated on a compromised phone?

  • 1
    If such a thing were public knowledge, it would likely come up in a Google search. However, that does not seem to be the case. – multithr3at3d Apr 17 '18 at 17:16
  • If there are, it would appear they've never been reported publicly. cvedetails.com/product/25037/… – nbering Apr 17 '18 at 17:17
  • @multithr3at3d Good point. Can't completely shake the feeling though that this was the most polite LMGTFY I've ever received ;) – Bert Zangle Apr 18 '18 at 11:29

One thing I found in previous research. The database is a simple sqlite database which can be copied to extract keys and recreate the QR codes. If somebody were able to exploit your phone and root it they, in theory, could copy this database.

Disclaimer: I haven't personally done any of this, so no guarantees.

Extracting the database: https://gist.github.com/jbinto/8876658

Creating QR codes from the DB: https://gist.github.com/naftulikay/5702d57eb4cb6ef6e7e8

| improve this answer | |
  • 1
    You need to have a rooted phone for this to work. On Android, apps without root privileges cannot read other apps' data. – ThoriumBR Apr 17 '18 at 21:36
  • Yep, it'd require someone to root your phone (that's mentioned in the answer). That's not too difficult with an old, unpatched OS. Hit an evil website, download a malicious app, etc. Hell, even bluetooth and wifi aren't safe. trendmicro.com/vinfo/us/security/news/mobile-safety/… – theoneandonly2 Apr 17 '18 at 21:43
  • That's interesting, and might answer my question (to the negative). Just to clarify: the information needed to recreate the 2FA seeds is stored in an unencrypted sqlite database, right? Meaning that the only line of defense is that Android doesn't under normal circumstances allow another app to read this database -- which however wouldn't necessarily hold any longer if the phone would be rooted/compromised. – Bert Zangle Apr 18 '18 at 11:35
  • (follow-up) It seems like there's an app called "Authenticator Plus" that would solve, or at least: mitigate the problem by adding an app-internal encryption layer to store the key data. I still need to look into whether the app itself is trustworthy, but it seems that could be a replacement for default Authenticator then to prevent key info being extracted in plain text on a rooted phone, right? – Bert Zangle Apr 18 '18 at 11:47
  • 1
    Authenticator Plus appears to solve the encryption problem. And yes, your interpretation of my response is correct. – theoneandonly2 Apr 18 '18 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.