Beating Google Two-Factor Authentication with App Specific Passwords.

http://l8security.com/post/29409648928/exploiting-google-two-factor-authentication

8 13 14 years ago

Piskvorrr5• 14 years ago

Note: this is basically "a practical application of SSLstrip". Once you are capable of pulling that off, full control of the ssl-stripped site is a lesser concern. Interesting (and perhaps juicier as a media soundbite than "OMG SSLstrip exists!"), but not groundbreaking.

neilwillgettoit2• 14 years ago

Yeah, I wasn't trying to focus so much on SSLstrip, but rather that it's possible to get into an account that has Two-Factor enabled, and generate a OTP that will allow for sans Two-Factor logins going down the line.

Piskvorrr5• 14 years ago

Weakest link gets attacked - and with one-factor auth still available, that is the weakest link. IMNSHO, labeling this scheme as "two-factor" is misleading - "two-factor with possible backdoor" would be more appropriate. (Also, I think that "OTP" is more commonly used to mean "one-time pad" - now that would have been more secure :))

rkangel2• 14 years ago

I'd always thought that the application specific passwords would allow for a loophole, although I hadn't come up with a mechanism.

Surely the fix from Google would be pretty simple? Just make sure that any and all access to the 'Two Factor Authentication Settings' page required a two factor token. I thought it already did, but I've just tried it and the OP is right, you just need a password.

Piskvorrr5• 14 years ago

If the attacker is SSLstripping the connection, two-factor auth wouldn't help much - the attacker is already between the user and Google, and could present the (second) two-factor prompt for accessing the settings page e.g. as a "login failed" page.

rkangel2• 14 years ago

Yes, you could MITM the attempt to load the settings page, but it would require Alice to be attempting to load the settings page. This is a MUCH rarer activity than just opening her inbox.

runjake• 14 years ago

This is a big "duh" to me and I see very little value in this post.

As far as Google's control extends, I can't think of anything they could implement without flaws that wouldn't be hostile to most of their end users.

If it weren't this flaw, it'd be a "zomg, I can plug a USB key into Alice's computer and install a keylogger".

This is a trivial, routine style of attack and of course it will work against Google's security scheme which is catered towards the everyday Joe and Alice and designed more to protect against phishing.

A better scheme where if you lost your phone, you lose your data forever, would not pass muster with everyday users.

Piskvorrr5• 14 years ago

Physical access and tampering is conspicuous and suspicious. Rogue-twin WiFi AP is inconspicuous, and few users would suspect anything is amiss.

neilwillgettoit2• 14 years ago

The best response from Google that could happen here is that they implement a notification feature as to when a OTP is generated.

takluyver• 14 years ago

Reading up on SSLstrip, it looks like it relies on intercepting links and redirects sent over plain HTTP to rewrite them to something you control. So could this be defeated by authentication baked into the browser that would only send your credentials over HTTPS to a pre-specified domain? I know Mozilla was working on authentication in the browser.

jesseendahl• 14 years ago

This attack actually wouldn't work against Google if you are using Chrome due to its built-in hard-coded HSTS list.

http://dev.chromium.org/sts

http://www.rodneybeede.com/Protecting_against_MITM_and_sslst...

Beating Google Two-Factor Authentication with App Specific Passwords.

Related Stories