Endpoint

5/17/2018
05:42 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cracking 2FA: How It's Done and How to Stay Safe

Two-factor authentication is a common best security practice but not ironclad. Here's how it can be bypassed, and how you can improve security.
Previous
1 of 8
Next

(Image: Golubovystock via Shutterstock)

(Image: Golubovystock via Shutterstock)

Two-factor authentication is common but hackable. If you haven't implemented 2FA, there's a good chance you're in the process. It's a growing best practice, especially in the workplace where growing stores of sensitive data demand employees strengthen their login security.

But 2FA isn't a guaranteed shield against cyberattacks. It can be bypassed, as most recently demonstrated by KnowBe4 chief hacking officer Kevin Mitnick in a hack last week. Mitnick used a phishing attack to prompt users for their LinkedIn credentials. When they were entered into the fake login page, the attacker could access their username, password, and session cookie. When Mitnick plugged the target's session cookie into his browser, he didn't need the second-factor code to log into the LinkedIn account.

Cracking 2FA isn't new; hackers have presented these types of exploits as concepts at conferences like Black Hat. But Mitnick's demo put the code into context for everyday users and showed them their second factor is hackable.

A challenge with implementing two-factor authentication is enforcing a policy that employees may consider inconvenient.

"It's always a matter of trying to balance usability and security," says Joe Diamond, director of security product management at Okta. Most companies err on the side of usability to stay on employees' good sides, but they run the risk of neglecting stronger security factors.

Here, we take a closer look at cyberattacks that can bypass two-factor authentication: how they are done, when they typically happen, which methods are most and least common, and how you can protect your employees from these types of exploits.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NeverEnoughToys
100%
0%
NeverEnoughToys,
User Rank: Apprentice
5/23/2018 | 4:07:11 PM
That's not really cracking 2FA
Most of these aren't about cracking 2FA.  They are about bypassing 2FA.  The SS7 and SMS type examples could be argued as cracking, but they are really about breaking into SS7/SMS - the 2FA compromise is simply a welcome result or side effect. 

SMS is not secure and should never have been used for 2FA, but convenience wins (as the article points out).  Time based generators are much more secure (yep, and less convenient).
RyanSepe
0%
100%
RyanSepe,
User Rank: Ninja
5/21/2018 | 10:18:28 AM
Phishing
As a Security Engineer, I always stress the dangers of phishing and this is a perfect example as to why. It subverts most of the security safeguards at an organization with minimal effort as it exploits an open medium. This is why there has been a very steady transition from server side attacks to client side attacks. 
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.