How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn

I love how Google's response is akin to "well, if the password is compromised...anything is possible" logic and tagged as won't fix. Facebook and Linkedin of all people immediately triaged and started fixing the issue.

Unacceptable response from a company promoting its services as identity and communication platforms.

Maybe Google's incredibly irresponsible response hints at their general strategy regarding authentication on the internet: they are already pushing for the replacement passwords. I'm quoting: "[Google plans] to release an ultra-secure and easy to use identity verification platform that eliminates the need for long, user-generated passwords. Dubbed U2F (Universal 2nd Factor), the consumer-facing side of this initiative will be a USB dongle called the YubiKey Neo. Built to Google’s specifications by security specialist Yubico, the YubiKey Neo is a small, durable and driverless device that requires no battery. Plugged into your computer’s USB port it will add a second, highly secure layer of verification when you point Google’s Chrome browser to your Gmail or Google Docs account. You’ll initiate the login by typing your username and a simple PIN. The browser will then communicate directly with the YubiKey Neo, using encrypted data, to authorize account access. With U2F verification, if someone wanted to login surreptitiously to your account, he or she would need to know your username and PIN while simultaneously having physical possession of that specific YubiKey Neo."

Furthermore, they had Regina Dugan, former DARPA director and now their VP of Engineering, Advanced Technology and Projects, on stage at All Things Digital in 2013 talking about electric tattoos and edible passwords which would turn your whole body into an authentication token with a 18bit ESG light signal. (Link to talk: https://www.youtube.com/watch?v=fzB1EcocAF8).

So maybe they just don't care because they won't use 2-factor-authentication for much longer anyway.

Google's response _The attack presupposes a compromised password, and the actual vulnerability appears to lie in the fact that the Telcos provide inadequate protection of their voicemail system. Please report this to the telcos directly._

... is reprehensible. It's a problem with the design as a whole, Google's customers are going to experience the flaw, and just passing the buck doesn't make the problem go away. I'm really disappointed in Google.

Seems to generally demonstrate that sending a token to a voicemail is secured at best by voicemail PIN; he's demonstrated effectively that it certainly doesn't require possession of the phone. That turns two factor authentication -something you know, something you have - into 'wish-it-was-two-factor-authentication' - something you know, and something else you know.

Sounds like the right approach is indeed to not give away 2fa codes when the recipient hasn't demonstrated that they have the user's phone in their hand

Sorry, couldn't resist. Shameful self-promotion, but this is why companies shouldn't implement their own two-factor authentication. Getting everything right is hard and chances are that you aren't reading or informed of the latest attacks.

At Authy we are obsessed with Two-Factor Authentication and spend a huge amount of time looking at whats happening in the ecosystem, which new attacks do we need to be aware of etc. It might look easy to build a quick two-factor authentication system, but history will repeat itself, and like passwords we'll see lots of bad and insecure implementations because its harder than what people think.

Would recording a DTMF tone as your voicemail greeting get around the "press any key to get your code" prompt?

A different issue - but around phone companies and security.

When your contract is running low, they call you and ask you to tell you them your security information as part of resigning you under new terms.

To emphasise: they cold call you and claim to be from the firm (which you don't know - it might be a phishing attack), and then ask you for your security details. They socialise their customers towards being vulnerable to phishing attacks.

I had this ages ago with an Australian provider (Telstra), and recently in the UK (O2).

Having followed up, I know it to be O2 policy that they are happy to do this. They... defended it on commercial grounds around practicality.

I'm sure that I'm not the only one to have though this is crazy. I raised an incident but as you'd expect it went nowhere. Has anyone else tried to pick it up with firms that do it?

Imagine a simple piece of legislation that banned calling and asking for security information. Would there be edge-cases that would make this a bad law?

Here's an idea: get rid of voicemail completely. The only person, the ONLY person I know who has used mine is my father, and his message is always "Sorry I missed you, call me when you can." Which I know already, thanks.

I hate 2fa based on SMS or voice auth. Requiring proving control of a number is decent as an anti spam or flooding technique, but is horrible for authentication of anything high value enough to justify 2fa.

I also strongly prefer 2fa systems which allow me to enroll my own hardware token or use a software token (eg AWS IAM) vs systems which supply the seed so I can't (CloudFlare is depressingly the only service I use which still suffers from this, despite being otherwise pretty awesome.)

Interesting article, I've always thought that phones are one of the weaker links in the 2FA chain (but a lot cheaper than dedicated tokens).

The general use of SMS/voice mail has another potential weak point which is where people start using VOIP services a lot. If an attacker has compromised someone's client computer with the usual set of trojans and they use something like Skype to receive SMS and voice calls, 2FA which relies on tokens via SMS or voice could be easily compromised as the attacker will already have access to them..

Probably should note, for all Australian readers:

    All vulnerable endpoints for Optus Voicemail have been fixed. Including the endpoint I used to bypass their initial fix.

Very comprehensive and will written post. Also, good job on the due diligence of alerting all concerned parties and posting detailed responses.

Google's reply is too complacent. Despite this being Telco's fault, Authy & Duosecurity are better at mitigating it.

2FA based on mobile phones is a very weak method of security. It goes worse, when using smartphones. When you use your smartphone to access internet services (worse: make banking) secured by 2FA, your 2FA is reduced to 1FA, Trojaner prone security.

There are also already cases known, where attackers just made phone companies send a "replacement" sim card and the attackers intercept those. Thus the second factor was very simple out. Some phone companies are more aware now, but all is very much prone to social engineering.

So: 2FA is only a good idea, when using some dedicated device, else it just makes the barrier a little higher, sometimes not so much, as you think.

Wow, this Open Sans font is just plain unreadable on Windows (7) machines. It might be the fault of Windows' subpar font rendering, but here, the font is just too thin and blurry to be read.

Damn, how I miss the days of simple HTML pages with no styling at all. Not beautiful, but readable, usable, fast, and ... yes, somehow beautiful in a pragmatic and very nerdy sense.

Hang on. The first step of this exploit is that "The attacker logs into the victims account on a 2FA enabled web application". How does the attacker do this if the account has 2FA enabled in the first place? And if the attacker can already log into the victim's site, why are the other steps even necessary?

At least if you have a recovery email address configured, you can only initiate the process that sends codes to phones via a link sent to the recovery email address.

So being able to intercept codes sent to a phone is not enough: you also need to have control over the recovery email address.

For the Optus (and their MVNO) it's fairly trivial to just nuke the voicemail completely with a call to a specific code. Seriously, who even uses it anyway? Bear in mind that in Australia we are charged a clear dollar a minute to retrieve voicemail messages.

Microsoft and other services don't use 2FA for all services. I'm sure this can also be exploited to log into vulnerable service without 2FA and then being logged, change the password.

My favorite is services that use secret challenge responses to reset passwords. Some of those "secret" questions are colors, car makes, etc., which narrows down the choices to just a few.

It's unfortunate that many idiots carry the title of "software engineer" when they completely hack basic analytical thinking and basic math skills to prevent such exploits!

Yes, the Google's response (if it is real) to this problem is embarrassing. "It is not our problem that we practically post your credentials to open access at some occasions" [as this post shows using voicemail is akin to doing this in case of significant number of providers]. That's so disregarding to customers.

Hmm around here in EU pretty much noone uses voicemail (and is disabled by default on most mobile accounts).

Is that such a huge issue in US?

I never use TFA if it's SMS based. I don't understand why every company isn't using the standard TOTP TFA with a secret key, that way I can manage who has access to my TFA codes very easily. I just scan a barcode on my phone once and I'm able to generate TFA codes for myself, what's better than that?

Can those services that require interaction be tricked by hacking the voicemail and recording a message with touch tones in them? Fortunately, most that require # also use it in voicemail greeting recording to end the recording, but the example, there are some that require any key, which probably is vulnerable.

Third comment on this post, but anyway. Why are 2FA providers still using SMS and not USSD (http://en.wikipedia.org/wiki/Unstructured_Supplementary_Serv...)?

To use an automotive analogy this is a bit like using social engineering techniques (e.g. pretending to be from the electricity company) to enter someone's house and then, once in, getting paperwork pertaining to their car. Theoretically you could then ordering a new set of keys from a locksmith, doorstepping the locksmith (when he arrives with the replacement key). You could then steal the car. Realising this stunt could work with any of the manufacturers that the locksmith can get keys for, you could then complain about how useless their cars were, that their locks were essentially broken. Of course, the attack would be entirely theoretical as the car 'stolen' would be one's own (because you were testing this attack vector so you could blog about it).

He should have got a job with News International. Essentially their 'phone hacking' relied on standard, factory set voicemail codes and their 'work' only came to disgust the general public when they deleted voicemail messages off a murdered teenager's phone, in so doing giving the parents false hope that she was still alive (as they were able to leave new messages as the voicemail inbox was no longer full).

Had the 'journalists' at News International known about this little trick for 2FA then, would they have really been able to glean anything useful? Yes, however, it would have been a one-time trick.

As soon as some junior royal (or footballer or politician) realised that they could no longer login to Facebook/whatever (because the password had been reset), they would have to reset it for themselves, plus they would have emails in their main inbox stating that their password had been changed. During this time the Facebook/whatever account could be thoroughly gone through, however, on-going access would be unlikely. So, in practical situations, e.g. getting scoops for 'newspapers', there is still limited use to this technique.

Am I missing something or the fact that once gmail password is compromised, the attacker could easily change the phone no. or set it to use Google Authenticator? Further steps regarding voicemail etc. will be moot after that.

If your telco has broken voicemail, I suggest using Google Voice and doing the dance to forward your no-answer/busy calls there.

Why is it a phone call and not a text message