Two-Factor Authentication 5 Ways to Bypass It and 5 Ways to Mitigate Its Weaknesses

1. Phishing scams with fake login pages – 

Over the years, phishing attacks have not only increased in number (they accounted for a whopping 93% of all data breaches in 2018), but have also moved beyond their traditional playground of email to messaging and social media apps (particularly on mobile devices).

An attack begins when an unsuspecting user is presented a fake site that is a fairly accurate copy of a page they normally access. Because the page looks ‘familiar’, it is able to capture their user credentials without them knowing that they have been fooled. Traditional phishing detection and 2FA methods cannot recognize such pages and therefore are unable to protect the user. The user’s data that is captured by bad actors is then used to steal their money or identity, or to perpetrate other crimes.

2. Technical support scams – 

A criminal convinces a user (or users) to install TeamViewer or some other kind of remote login software. He then installs a functioning backdoor which provides full backdoor capability to the user’s device. Access details to these compromised machines are then sold on the Dark Web for enormous sums of money. 2FA cannot prevent such a phishing scheme from compromising the machine and accomplishing its nefarious goals.

3. Scareware – 

As the name indicates, scareware is a way to frighten an unsuspecting user into taking a particular action that benefits a criminal. A hacker initiates a security ‘alert’ in the form of a popup that looks like a genuine warning from a real provider. This alert prompts a user to reset their password due to a ‘security threat or breach’. The password is captured by the hacker to take control of the system.

The malware may even claim that the user’s files have been infected and that they need to purchase software to fix the so-called problem. But they actually end up

Two-Factor Authentication: 5 Ways to Bypass It and 5 Ways to Mitigate Its Weaknesses

downloading malware masquerading as antivirus software that then steals their data, money or identity.

4. Man-in-the-Browser (MitB) attacks – 

Some types of browser extensions such as ad blockers offer bad actors a workaround for devices that rely heavily on two-factor authentication. These extensions – many of them free – often act as ‘Man-in-the-Middle’ spyware to monitor a user’s browser session and capture data that is accessed during that session. Once 2FA is complete, the extension starts collecting and then transmitting session data to a command-and-control (C2) server that is controlled by hackers.

5. Social engineering – 

In the report mentioned earlier, the FBI stated that social engineering was one of the methods used by criminals to circumvent 2FA.

Social engineering is the practice of exploiting human behaviors to bypass 2FA and hack into user accounts. By using emotional triggers and other psychological tactics like manipulation, deception or influence, hackers persuade users to comply with their criminal request. This may involve clicking on a link on a fake website, scaring them into giving up their personal information, etc.

In the recent past, criminals have even social engineered cell phone carriers that then allowed them to clone their victims’ phone SIM cards and steal their data.

Other weaknesses in two-factor authentication systems

Cybercriminals also exploit the cybersecurity holes in 2FA in other ways.

1. Intercept text messages – 

A user inadvertently downloads malware on their phone that is then used by a hacker to intercept their SMS messages.

2. Redirect call forwarding – 

Once again, malware plays a starring role in this hacking drama. When installed on a user’s mobile phone, it opens back-door access to the device for the hacker who then hijacks the device and redirects voice calls transmitting 2FA codes to his own phone.

3. Hack hard tokens –

 Tokens are a popular method for 2FA, but sophisticated hackers have found ways to get around their supposed security features. Most of these weaknesses can be traced back to poor human practices such as sharing tokens.

Two-Factor Authentication: 5 Ways to Bypass It and 5 Ways to Mitigate Its Weaknesses

4. Fake push-to-accept requests – 

Push-to-accept requests are a weak method to implement 2FA because most users tend to accept them without realizing what they’re agreeing to. An inattentive user can easily approve an attacker’s push-to-accept request without knowing that he is doing so.

5 Ways To Mitigate the Weaknesses of Two-Factor Authentication Systems

As we have already seen, two-factor authentication is no silver bullet. However, there are a few things that users – both individuals and organizations – can do to mitigate its weaknesses and stay safe in shark-infested waters.

1. Dynamic linking with end-to-end encryption

Dynamic linking – also known as ‘What You See Is What You Sign’ – consists of 2FA done at the time of transaction. The user is presented with the transaction details before completing the signing process. Once signed, the signature is valid only for that specific transaction, making it harder for an attacker to take control of the transaction or device.

2. Continuous monitoring

Continuous monitoring of sessions on digital platforms is a good way to recognize, prevent and defend against a variety of attacks. It enables organizations to keep an eye out for typical indicators of known attacks, and to correlate this information across its user base to further their understanding of risk and establish a continuous risk profile. If and when anomalies are detected, appropriate real-time actions can be taken.

Organizations must also conduct regular audits on their current security infrastructure, security awareness training programs, plans to deal with future breaches, etc. This will enable them to better understand the gaps in their security protocols and take the necessary actions to close them.

3. Education and awareness

Often, criminals are able to exploit the weaknesses inherent in 2FA due to human error caused by carelessness or lack of awareness. That’s why organizations need to train their employees to recognize and identify phishing attempts, and to understand that these attacks can (and do) take place across different channels.

4. Make use of technology

None of these three methods is completely foolproof to foil 2FA bypass attempts. Therefore, organizations should employ technology to block connections to known –

Two-Factor Authentication: 5 Ways to Bypass It and 5 Ways to Mitigate Its Weaknesses

and if possible, unknown – phishing domains. Trusted tools can prevent dodgy pages from ever loading, thus stopping attacks before they even begin. They can also allow the firm to execute appropriate responses to cybercriminals, immediately and continuously.

5. Use multi-factor authentication

Multi factor authentication (MFA) takes 2FA a step further by combining three or more factors to provide even more robust authentication and system security. Despite worries that MFA makes logging into accounts more complicated, it actually simplifies the login process by allowing the use of advanced options like single sign-on. Another advantage of MFA is that it makes compliance with several standards (such as those required or recommended by HIPAA) easier.