Two-factor authentication (2FA or Two-Factor Authentication) is considered, along with the use of biometric elements, as one of the strongest methods for protecting user data on the internet. A new attack devised by two researchers from the University of Amsterdam shows that there are weak points in this protection method as well.
The two researchers Radhesh Krishnan Konoth and Victor van der Even reported that they discovered the security flaw in 2014, warned Google and other online services, presented their findings to banks, but nothing changed.
As the researchers explained, because the vulnerability had not yet been publicly disclosed (until today), many were those who said it is not very dangerous. The two researchers do not agree.
As they explain, with the attack they do not exploit a software flaw, but a design problem of Two-Factor Authentication.
The concept is called “anywhere computing,” and refers to the ability to synchronize applications and content across all devices. Thus, using anywhere computing, 2FA can be bypassed if an attacker gains access to the victim's computer.
From there, the design flaws in the 2FA mechanism of various services allow attackers to use services such as iTunes or Google Play Store to push malicious applications onto a user's phone without activating the 2FA authentication system and without any icon appearing on the device's home screen indicating the installation of new software.
Of course, the attacker must get the malware through the Google or Apple Stores, but recently we have seen it happening.
Researchers claim that services using 2FA should be very cautious about synchronizing apps across different devices.
For more information, you can watch the video below. For those who want more details, download the PDF How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication.
