1

At work we use an authentication system called Swivel Secure without implementation specifically when connecting to our customers devices such as: routers, switches, firewalls, etc we must provide a OTC (for 2FA of course)

For example if I connect to a switch I must provide: username, password & a OTC in order to get a OTC we must visit a link which generates an image (See below example)

A link typically looks the following way - https://PinSecurity.StackExchange.com:8443//proxy/SCImage?username=JoshJones

Secrity String Image

If you're unfamiliar with a turing image, essentially each user has a pin (which can be changed) the top numbers correspond to the numbers that can be used in a users pin & the bottom numbers are the required numbers for successful authentication.

For example: if my pin is 1234 using the image above my OTC for successful authentication would be 3087.

In Swivel there is an option which allows you to configure getting that SCImage as just a string by replacing SCIMage with SCText, I asked a developer at Swivel about this and he said: "it is disabled by default as it's inherently insecure" I found this statement to be very vague and unfortunately he didn't ever respond to my request for expansion.

How exactly is it more unsecure to generate the security string as text? I realise that it's more readable in-terms of getting it into the computer E.G you could just scrape the HTML to get the security string whereas with the image you would have to use some kind of OCR software / library to obtain the characters in the image which can be hard especially if the image is very scrambled.

So how is it less secure to generate this security string as text? It's not even like you could iterate over all combinations because there is a locking mechanism upon too many retries so you cannot get someones pin without essentially guessing it, etc

If someone could clear this up for me that'd be great. I expect I am missing something and just not thinking properly.

EDIT Following a discussion I had with DMB on the basis that one of his comments was a little unclear. We've come to the conclusion that the only REAL difference here is the time that would be spent by an attacker.

His point was that it takes them a lot less time to get the paragraph tag from the HTML than it does to use OCR software to get the required digits from the image, which I agree with (Hence why I mentioned this in my post)

IF somebody else has something else to add then please do so, otherwise I am going to write an answer and mark it as answered. I would be interested to know what OTHER risks there would be when getting the security string as TEXT rather than as an IMAGE, thanks.

|improve this question
  • "you could just scrape the HTML to get the security string whereas with the image you would have to use some kind of OCR" This right here. As far as I know, It would take more resources(like time) to get the string from an image and the probability of getting the wrong character will increase. Whereas inputing a string read from the same place in html, would be lightning fast for any bot. – dmb May 3 '18 at 19:24
  • So that's literally the ONLY difference? As I said I cannot see any security concerns with generating this as a string. The only thing it would do is make it harder for an attacker correct? Which was my thought before I posted the question as you can tell with the lines in my post. – J.J May 3 '18 at 19:29
  • Yes, for me to make an attack harder is to make it more secure, not by a lot tho. I believe that your confusion comes from " It's not even like you could iterate over all combinations" because if the string is on the html it will get copied right away. For a bot-grid of a 100 bots, every single one will login at first try with the string in html, but if put an image with the string, it would need to get processed and many will fail. Its like locking your bike on the street with a thin cable vs hardened steel chain. Both can be cutted, one is easier. – dmb May 3 '18 at 19:54
  • I fail to understand what you mean with the "bot grid" line. How would that make sense? They cannot work out the pin therefor they wouldn't be able to login first time... They'd have to find the pin so if its not 1234, 9999, 0000 or anything very obvious then how would that work? I think you've perhaps misunderstood my question. – J.J May 3 '18 at 20:04
  • 1
    @PwdRsch So yeah the numbers in the middle change on every refresh an the numbers at the top always stay the same. Your pin is only valid for one authentication attempt so if you fail at typing it you must refresh figure out the new OTC and try again upon failing five times your account is locked and can only be unlocked by the system administrator. – J.J May 4 '18 at 17:02
2

The other security risk is that this is not really 2FA.

In 2FA, the user's OTC would be quasi-randomly generated in a way that requires the use of a separate device, like a token, as proof of something they have. In the case of SMS OTP, it uses a separate channel (cellular) to connect to a separate device.

In here, the code is instead the user's PIN that's hand-encrypted with a substitution cipher. That's still something the user knows, so this is 1FA done twice.

Some of the risks such 1FA*2 opens compared to 2FA include:

  • A compromised PC will log the image (cipher key) and the 'OTC', which trivially decipher to the PIN, providing full credentials.
  • The same can be done with MITM, but it needs to intercept both the login and the OTC websites.
  • Since manual encryption takes effort and produces mistakes, users are very likely to pick PINs that simplify the task. That's an ascending sequence of digits near the beginning ('1234') or the end ('7890'), shifted by 1-2 digits ('3456') by the more security-conscious.

Whether it's a text string or a Turing image, intercepted traffic compromises the system. The need for OCR is just a hassle for the most unsophisticated attackers. Since security is always a compromise vs usability, it can be best to drop the PIN and just send the user their OTC. That's less for the user to remember and less visible security, so a bit more chance they'll pick a stronger password.

|improve this answer
  • This is a good answer - you're right it's not really 2FA. Just as a side note you can actually set Swivel up to send the security strings to a mobile device via SMS. But good point! – J.J May 4 '18 at 7:03
0

With the help of dmb we've come to the conclusion (as far as we can tell) that the ONLY real difference here is speed.

As he mentioned (and I outlined in my question) if the security string is an image rather than text it makes it a lot harder for someone to get that information into the computer to then later use in a script, etc. This is due to the way the images are displayed as the whole point of a Turing image is to make the text less readable / scramble it to prevent the use of bots.

However, the longer it takes an attacker to get that information technically it makes the system more secure, we agreed on the point that the longer it takes an attacker the better. The problem with having a security string as text is it's very, very easy to get that information into the computer / script as I mentioned in my question one way of doing this would be to scrape the pages HTML.

Thanks for your responses on this one! I believe I've got my answer, if anybody has anything to add please feel free.

|improve this answer
  • 1
    It may be far easier than you think to perform the OCR. This is largely equivalent to an relatively simple CAPTCHA test. I'm not a captcha expert, but from what I've heard, getting captcha to work properly isn't trivial, and beating it is often far easier than the designer might think. – Steve Sether May 4 '18 at 15:58
  • Steve that's an interesting point as I've heard it's a lot easier to get it to work than people expect also. Thanks for the comment! However; whilst it may be EASIER than I think, it is certainly not FASTER. Which is kind of the point that's being made, the security difference here is that an image would take more time to obtain than text. – J.J May 4 '18 at 16:00
  • Modern spam software makes EASY work of OCR. In my experience running two large forums, it makes absolutely no difference whether you have CAPTCHA off completely or set it to the best obscured-text-as-an-image available. Either way you get 40-50 spammers a day. And such CAPTCHA is far more obscure than the example above, to the point that humans have trouble with it. It's not faster to decode turing images, but I can't imagine an attack where this extra microsecond can make the difference. – Therac May 4 '18 at 17:50
  • Fair enough thanks for the insight! On that basis are you saying that text or image one is not more "inherently insecure" than the other? – J.J May 4 '18 at 18:08
  • @JoshJones I'd say that an image based might make low level attackers try somewhere else, but it's unlikely to detract anyone serious. – Steve Sether May 5 '18 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.