Does two factor authentication prevent social engineering attacks

Question

After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password.

Considering three different additional methods of authentication, smartcard, mobile phone and biometrics, how much do these make social engineering harder?

A smart card that is not easily copyable can be still borrowed out too a "friendly" sys admin. A mobile phone is maybe not so easily borrowed out, but users will be happy to read the authentication code from it. Biometrics seems harder, but depending on the system the biometrics (like fingerprint) can be "copied".

With just password authentication, social engineering attacks seems to be the weak link. Will using any of the two-factor methods described above make social engineering so hard that hackers will not even bother trying?

Answer 1

Social engineering is hard to mitigate problem. Why? Because it's targeting the weakest security point of all system: users.

So indeed, the more complicated the system is, the more complicated for attacker it gets. But usually, they get information because someone does not respect the protocol, e.g. sending confidential data by fax, giving information to people they did not authenticate by phone. So even if you put on fingerprint solution, with 3 access card and a guard supervisor, if the authenticated users gives the last draft to someone they think is a colleague by mail... all of this is vain.

The best prevention against Social Engineering is : awareness. You will have better to form user not to do bad things than hardening process. The more complicated the procedures gets, the harder users will try to avoid it because they thing they will lost time. And people don't like is. But if you can show them example of bad behaviour, or company that gets "hacked" by social engineers etc, they may understand that the measures are here for the good of the security. But if anyone is ready to give their password to their "admin" over the phone... this is hopeless.

As a conclusion, two factor authentication may improve security against social eng. in that way it could make people aware that credentials is really theirs and are part of their identity (e.g. fingerprint is part of your body). But all security measures would be useless without a good awareness of users.

Answer 2

My metaphor for social engineering is that it's like water - it will find the point of least resistance and work it's way in.

When user's have two factor authentication, then you're right that you may seal up one point in the leaky dam of access to the system - I would hope that most users won't blindly hand over their token, and with the security awareness training that usually comes with getting a token, there's some chance that users may be more cautious of many types of attack.

But that doesn't mean you're safe from the other types of social engineering attacks, and it quickly raises the question of what the lost token reporting process is. There's a fine line between screwing over folks to have lots of travel as part of their job, and making it too easy for an attacker to call in as a legitimate user with a lost token who wants his token forwarded to his hotel in another city...

Or my favorite attack which is getting physical access to the building with a badge that looks right, but has virtually no power electronically... offices are full of helpful people who will hold the door for you whether they know you or not! Doesn't work when you have systems that REQUIRE that every person authenticates in and out of the room, but most main entrances won't work that way - it's just not practical.

Answer 3

You have it right when you say that adding an extra authentication requirement makes social engineering harder - it makes most types of attack harder - but it really doesn't stop social engineering.

In my experience, while dramatically reducing the total number of attacks, it actually increases the percentage of social engineering attacks - many purely technical attacks fail under 2 factor authentication, so attackers may try to engineer the users into providing that 2nd factor or an alternative.

It is a definite net improvement in all ways, with the possible exception of user satisfaction (extra authentication done badly annoys users) but even here, if it is done well and users see the security benefits without suffering usability issues, it can demonstrate improvement across the board.

Answer 4

The factors in two-factor authentication is often "something you know", and "something you have" or "something you are".

A social engineering attack against the second factor depends on if its either a physical possession, or your own body.

Lets divide this up into two possible social engineering scenarios:

Something you have:

This can either be a sort of one-time-pad, or a physical item such as a smartcard. You can obtain both of these, but for the one-time-pad kind of authentication, its also possible to ask the user to read this out to you. How you would do this, is fully dependent on the scenario you are in.

Something you are:

This goes into the realm of biometrics. Various implementations have various weaknesses. An mechanism who rely on fingerprints alone would fail, since the user is in reality leaving their password on every surface they touch. Here is mythbuster on the case: http://www.spendonlife.com/blog/bypassing-biometric-security Can you please hold this clean milk glass for a second?

For the other biometrics, where there are no weaknesses, you could still apply some social engineering to make people to perform the authentication for you.

As a side note, there will be a huge difference in methods depending on if this is a physical security or digital security. Posing as fed-ex would be more successful in tail-gating than for remote authentication to a digital fortress.

Enough ranting, hope this had some valuable insight in reply to your question.

Answer 5

The answer is "yes", two factor authentication will protect against most social engineering attacks (but not all).

The most common social-engineering attacks are against social media sites like Twitter and Facebook. Your users choose the same passwords for those sites as for your systems. When they get tricked out of their password for those sites, it compromises your systems as well. Several of the hacking stories that have appeared in the news happened this way: when sysadmins got tricked out of their password on social networking sites.

Likewise, it's pretty good against social engineering attacks targeting your organization. Even if I call up a user pretending to be from IT and get the password, I can't use that password to VPN in.

It's not complete protection, of course, nothing is. I can also call the user and pretend to be from IT, and have them download a "virus" onto their computer. I can also do a "man-in-the-middle" attack, where I trick the user to log onto my computer, which then turns around and takes those credentials to log into your systems -- with the second factor and everything.

But despite the fact that it's not complete protection, the answer is "yes", two-factor authentication has proven to be one of the most effective ways to reduce threats in organizations. It's proven more effective than anti-virus, for example.