2

Let's say someone is logging onto Dropbox in the library, but the computer has a keylogger on it that steals their password. Fortunately, they are using two factor authentication, which could have prevented this... almost. But there's a checkbox "trust this computer". The user doesn't check it, but the keylogger is able to check it silently, giving them a token which gives permanent access to their account.

Even if this isn't the main purpose of two factor authentication, wouldn't its utility be massively improved without this checkbox? There are other ways to allow the user to trust the computer they are on, such as texting them two codes, one for temporary access and another for permanent. That way the decision of whether to allow permanent access would be entirely up to the user, and the keylogger wouldn't be able to interfere with it.

  • 5
    It's best practice to not use public computers with key loggers installed. – TTT Aug 13 '15 at 18:26
  • without knowing more about the system in question this question isn't really answerable. What might stop it could be a variety of things (like the application asking for further auth. before trusting the browser, heuristics looking for odd patterns of access, notification to the user that they're logged in from multiple locations etc). The "silent ticking" you describe may or may not be possible, but it depends on the implementation and the attackers. – Rory McCune Aug 13 '15 at 19:01
  • @schroeder: Yes, as the checkbox is the reason it doesn't prevent account theft using keyloggers. – Gelatin Aug 13 '15 at 20:33
  • Since I removed my answer, how is the key logger checking the trust this computer box if it isn't actively part of your sessions. I guess you don't "trust" a public computer which is why two factor uses another method to send and authenticate you. – Shane Andrie Aug 13 '15 at 20:47
  • I don't mean just a keylogger, I mean software with root access. Keylogger seemed like the best way to describe it. – Gelatin Aug 13 '15 at 21:28
1

There are different types of two factor authentication. Some types will protect against the threat you describe, others will not.

Here are some common types of 2FA that will keep you protected against the key logger:

  • Texting a one time use code to a mobile phone.
  • Emailing a one time use code with the assumption that the user will not check the email on the compromised computer. (Receives the email on a mobile phone.)
  • Some sort of token using a time-based mobile app.

Typically the above types of 2FA do not have an option for "remember this computer" which would disable the 2FA portion of the login. If they had a "remember this computer" option, that would drastically reduce security, as you suggested.

There are some weaker types of 2FA that may contain a "remember this computer" option. Typically they would be an additional security question such as what is your favorite food, or mother's maiden name, etc. If there is only one security question, then your answer is going to be recorded by the key logger as well, so the "remember this computer" option is irrelevant. The only situation where the key logger with the ability to silently check the "remember this computer" box would be useful (to the attacker), is when you have multiple security questions set up which are presented on a round robin basis, and only 1 of them is captured by the key logger.

As a side note, if you are worried about key loggers, I suggest when typing in a password on a public computer, that you type in part of it with the keyboard and the rest of it with the mouse and the virtual on-screen keyboard. This will thwart someone watching the screen or a key-logger. Someone would need to have both going at the same time to capture your full password.

  • Some software keyloggers work at a level which will receive keypresses from some virtual keyboards. And a compromised computer could easily harvest values from password fields by other means. – Random832 Aug 14 '15 at 5:25
  • @Random832 - I agree. Pretty much any interaction you make with a compromised computer can be recorded. I was simply guessing that most keyloggers would not capture virtual keyboard presses. We would need to know if the majority of keyloggers in use today do capture that or not, and if so, my last suggestion is probably a waste of time. The suggestion would have to be revised to: Don't type passwords into any computer that isn't fully under your control, unless you have true 2FA in place. – TTT Aug 15 '15 at 19:34
  • AFAIK Generally virtual keyboards will use SendInput in order to work as a keyboard in most situations, this is very low-level and keyloggers will receive it without doing any special work. Some virtual keyboards might use SendMessage instead, and this is harder to intercept and I don't know if Keyloggers deal with it. – Random832 Aug 15 '15 at 22:36
1

I think I have a better understanding of what you asking now:

Having "a trust this computer" is not really a security weakness. This feature is to tell the company that this is a common computer you log in from and more of a user convenience.

In order to have malicious software perform this check in your place, they would need to perform Session Hijacking. Two Factor Authentication doesn't prevent this. Session Hijacking is about stealing sessions keys and using them to impersonate an already logged on user. At this point the Attacker already has access to your account, ticking a box or not.

In a key logging scenario, you trying to scrap login in information, than authenticate with it at a latter date. Two factor authentication come in handy here. As the Attacker will still need your sent key.

In your scenario an Attacker would:

  1. Have to scrap your login info.
  2. Hijack your current session.
  3. Check the trusted this computer box.

If the attacker wanted to gain access outside of the current session, they would need to "log in" from the PC that they trusted as attempting to login from a different device would trigger the two factor authentication.

Most scrapers are designed to send cred back to a controlled server. Your scenario is not impossible but unlikely for generic user attacks. At this point, your looking at a targeted attack since this is device specific.

  • There's an important difference between having access for a session and having access permanently. Why is it device specific? It's trivial to move a cookie from one computer to another, which is the only way a website can really identify a device. With "trust this computer", the computer is the one effectively making the decision about whether it should be trusted. – Gelatin Aug 13 '15 at 22:21
  • As an educated guess, the companies don't rely specifically on a cookie for identifying a "Trusted Device". At this point your looking at device finger printing, and other layered security approaches. – Shane Andrie Aug 13 '15 at 22:33
  • I'm pretty sure there is nothing about a browser which can't be copied elsewhere, except the ip address, which is usually dynamic. – Gelatin Aug 13 '15 at 22:35
  • Even if there wasn't, nothing stops the keylogger from continuing to access the account from the same computer. – Gelatin Aug 13 '15 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.