Man in the middle attacks for Out of band Authentication

Question

I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows:

"In authentication, out-of-band refers to utilizing two separate networks or channels, one of which being different from the primary network or channel, simultaneously used to communicate between two parties or devices for identifying a user. A cellular network is commonly used for out-of-band authentication. An example of out-of-band authentication is when an online banking user is accessing their online bank account with a login and a one time password is sent to their mobile phone via SMS to identify them. The primary channel would be the online login screen where the user enters their login information and the second separate channel would be the cellular network. This added layer of security prevents the likelihood of hackers and malware from compromising access to the complete authentication process, however, this method of authenticating a user is known to be vulnerable to man-in-the-middle (MITM) attacks."

Can someone please explain why the bold line stands true? To put it in a different way, how is an out of band authentication like sms vulnerable to man in the middle attacks?

Answer 1

The threat is when the MITM owns the login screen.

If, for instance you click a link in an email that purports to be a link for https://yourbank.example but is actually a link to http://yourbank.evilbob.example, and enter the username and password you use for your bank website, Evil Bob merely needs to forward those on.

Then, https://yourbank.example which doesn't know that that it's EvilBob's website submitting your credentials and not you, dutifully sends an auth code to your phone and waits for your response. However, you're still on http://yourbank.evilbob.example, which has accepted your username and password and presented you with an input field to type in the auth code you're going to receive on your phone.

So, you type the auth code into http://yourbank.evilbob.example, which turns around and submits it to https://yourbank.example, and Evil Bob's website is now logged into your online banking interface.

That is the man in the middle threat for out of band two factor auth.

Answer 2

I wrote the original wikipedia article quoted above. Some of the comments being offered above are correct, while others are not. In short, ALL out-of-band methods are vulnerable to man-in-the-middle attacks because the authenticating entity cannot verify the authenticity of the entity supplying the authentication credentials. Whether this involves a hardware token, "dumb" token, or a code sent to a telephone, the process remains vulnerable. While connected fobs are more secure, they nevertheless rely on information being transmitted from the fob to the waiting website (which may be a counterfeit website constructed solely to obtain that information). The only process currently mitigating all man-in-the-middle attacks is the virtual token process, which is a commercial offering based on the "complex device identification" standard recommended by the FFIEC.

Answer 3

Out of band authentication relies on the added difficulty an attacker faces when trying to simultaneously eavesdrop on two communications. This difficulty arises due to the two channels being completely separated.

An attacker that can bring the two channels together defeats this defence. In the case of the Zeus malware, an infected PC attempts to infect mobile devices over USB or bluetooth. Once this has occurred, the attacker controls each of the client terminals used in the two-band authentication, he has effectively brought the channels together.

Zeus in particular will attempt to login via the PC, wait for the SMS to arrive on the mobile device, and communicate the SMS back to the PC (malware to malware). All this happens without any indication to the user of either device.

The problem here is that we are using two smart devices as client terminals. Smart devices have protocol stacks and software vulnerabilities. 'Dumb' hardware tokens such as HOTP fobs do not have these issues and cannot be subverted, which is one reason to prefer their usage.

Answer 4

Haha, there is an out-of-band mutual authentication technology that is in the standardization process in ITU-T SG17 as X.oobsa. It is the only way to compete with the MITM attack using out-of-band mutual authentication. What you mentioned is all about out-of-band user authentication technology that checks the authenticity of the user only. Out-of-band mutual authentication allows the user to check the authenticity of the service first and then give the user credential to the service provider using a mobile device. Check out the standard document. It already become the standard technology in South Korea.

TTAK.KO-12.0383 모바일 단말을 이용한 대역 외 서버 인증 프레임워크