2

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own machine. (described in detail here https://www.wandera.com/bypassing-2fa/). In this attack scenario, 2fa gives a false sense of security and makes it more likely to fall victim to phishing. After all if my only protection against getting phished is checking the certificate and URL, then I'll be more likely to double check it compared to just having bought into a brand new shiny 2nd factor that touts itself to be fool proof.

If I get phished like this with the 2nd factor, the hacker is in and as long as they don't log out, they can stay in for a very long time causing all kinds of trouble.

Clearly the 2fa has a disadvantage of creating a false sense of security. The only advantages I could see is for users who share the same password across different services or for making subsequent logins using the same credentials impossible. Aren't those advantages too small relative to the disadvantage?

Obviously the answer here is re-education. Tell users to use 2fa but be keep being vigilant - make them aware of this type of attack and how nasty it is even with 2fa. But that's hard to do considering how many 2fa solutions are pushed as "THE" ultimate final solution for phishing. It's just not true and in many ways it makes the problem worse - especially for websites. Am I missing something?

  • 4
    I see they don't mention that U2F and webauthn do prevent this sort of phishing, which isn't surprising considering that they're in the business of blocking phishing domains. – AndrolGenhald Sep 6 '18 at 17:06
  • You are right U2F is better, but it's interesting that it faces some challenges: yubico.com/support/security-advisories/ysa-2018-02 – user3280964 Sep 6 '18 at 17:25
  • Thanks for that link, I hadn't seen that! I would note though that that's an implementation issue, not an issue with the protocol itself. Implementation issues are always a concern, but they can be fixed much easier than a design flaw (and as you can see it was fixed relatively quickly). – AndrolGenhald Sep 6 '18 at 17:29
  • Indeed, this isn't actually anything new. 2FA over SMS has been effectively "deprecated" as a security measure for a while now, and google in particular (who I mention because that is what they use a an example in your linked article) has been trying to move users over to new 2FA methods for a while: zdnet.com/article/… – Conor Mancone Sep 6 '18 at 18:10
  • 1
    Google's improved prompts are good. I also like the "is this me?" question. Much better than just hitting allow/deny in other authenticators. But, it's still just a stop gap. Given that botnets span the entire globe it should be easy for the MitM to intercept device and browser info and spoof it. Then you just have to proxy to the closest bot (relative to the real user) and you're good. User won't be able to tell the difference at all. – user3280964 Sep 6 '18 at 19:57
9

Yes, TOTP and HOTP (in addition to email, SMS, etc) are vulnerable to this. Why do we use them? Because they're easy to implement, and they do provide some protection. As long as the majority of people aren't using any sort of 2nd factor, phishers will predominantly target those users, as MitM phishing (debatably) takes more effort.

I've said it before and I'll say it again, once most people have started using 2FA for their important accounts, this sort of MitM phishing will become much more common. The way to prevent this is U2F or WebAuthn, which both use public key cryptography to authenticate to the server, and communicate with the browser to verify that the domain name you've visited matches the domain you registered the key for.

If you want to see a longer and (in my opinion) less biased blog post on the issue, I skimmed this Evilginx 2 blog post and it seems to cover everything pretty well (and even has some stuff about how phishing domains can avoid scanners that try to block them).

I was focused on phishing, but as Ajedi32 points out, 2FA is useful for more than just preventing phishing. It's useful whenever your password may be compromised but the second factor isn't.

  • Would you say that OTP 2fa is not designed to protect against this? ie OTP is meant to prove the identity of the end user, not the identity of the server. I suppose this would still be a false sense of security if these 2FA methods are marketed as "Prevent your accounts from being hacked!" – Mike Ounsworth Sep 6 '18 at 17:50
  • 1
    @ConorMancone But the phisher still gets into your account. Why does it matter if the 2FA is intercepted or not? – Mike Ounsworth Sep 6 '18 at 18:00
  • 1
    @ConorMancone The 2FA isn't intercepted, but the session that's being authenticated is still the phisher's session isn't it? Is there some standard or paper we can read on this? I'm interested in it as well. – AndrolGenhald Sep 6 '18 at 18:00
  • 1
    I'm not actually sure the Desktop / Phone distinction matters. @ConorMancone Please tell my why this attack scenario doesn't work: User browses to phishing site, believing they are on the real site, which shows the usual "Please enter password, 2FA will be conducted out of band". They enter their password. Phisher then (within the second) goes to the real site and enters their password. The user gets a push notification on their phone saying "Are you trying to log in?". They click Yes because they are trying to log in. Phisher is now in to their account. – Mike Ounsworth Sep 6 '18 at 18:15
  • 1
    @MikeOunsworth that's a good point I hadn't considered. The google login flow provides specific information about who is trying to login (browser, geoip location, etc...) so a diligent user can see there is a problem, but it's not foolproof – Conor Mancone Sep 6 '18 at 18:22
3

Because 2FA protects against more than just phishing.

One major threat 2FA protects against is credential stuffing, where attackers take passwords stolen from other services in data breaches and try using those same credentials to log in to your account. Credential stuffing is a fairly common cause of account compromise, with numerous instances of successful attacks occurring over the years.

As you said, it's true that attack doesn't work if you use unique, randomly-generated passwords for each site; but then again phishing doesn't work either if you only ever enter your password on the site you originally signed up on. The fact that it's possible for diligent users to defend against both those attacks doesn't mean they're no longer a problem.

2FA also protects against many other bad practices which commonly afflict password-based authentication, such as weak passwords, passwords written down on post-it notes attached to the user's monitor, etc.

Additionally, 2FA also provides limited resistance against other attacks such as keylogging and phishing by forcing the attacker to use the captured credentials immediately and limiting the duration of compromise to a single login session. There are also some, much better forms of 2FA such as U2F/WebAuthN tokens which provide strong defense against phishing, as they integrate with the user's browser and can therefore ensure credentials are only ever provided to the site they were intended to be used for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.