Slashdot Mirror
Academics Claim Google Android 2FA Is Breakable (theregister.co.uk)
totalcaos writes: Attackers who control the [browser on the] PC of a user consuming Google services (Gmail, Google+ etc) can surreptitiously push and activate apps on the user's mobile device, bypassing SMS-based two-factor authentication (2FA) via the phone. How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication is a paper that explains the wider issues of phone-based 2FA. Herbert Boss, professor of systems and security at Vrije Unversiteit Amsterdam, who co-authored the mobile security paper with the two PhD students, disclosed the vulnerability to Google but they "still [refuse] to fix it."
https://it.slashdot.org/story/...
if u dont secure ur box ur gonna get hacked android is no exception esp if u have weak passwords
Fix should be simple: when an app's installed remotely from the browser, queue the installation and put up a notification asking the user to confirm the installation. Installation doesn't proceed until the user responds affirmatively to the prompt (if they respond negatively, the installation's de-queued). The authors are right, though, that the more tightly you integrate the browser-based services with the phone the less you can depend on the separation of the two for security. What's different here is that it's showing that tight integration between Google's services and the phone affects vendors other than Google.
The second link is to a google doc, which is a possible attack vector according to the submission. Should I visit this link with my android phone? Or is someone really not thinking clearly?
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Is that the exploit?
I glanced through some of the Android parts of the paper; it describes these as 'practical attacks' but it also opens with "we assume that a victimâ(TM)s PC has been compromised, allowing an attacker to perform Man-in-the-Browser (MitB) attacks", so it would appear the immediate risk would be at least on the low side. Unless your PC is pwned, but of course if that's the case, you're in trouble already.
For Android, the paper describes a mechanism by which a malicious app can be published to the Google Play store, then silently installed and activated through a Google Chrome plugin trojan (installed as part of the PC pwnage). There are more [interesting] details about how that process works and circumvents some existing Google tricks intended to stop it (e.g., static analysis of apps).
At this point, the app can now intercept SMS tokens that are sent to you as part of 2FA.
I was mostly interested to see if there were vulnerabilities in the Google Authenticator mechanism/implementation; it seems that this is not the case. It basically just takes advantage of the fact that Google offer a way to skip the Google Authenticator by using an SMS instead, although I guess this requires that your Google account is set up with a phone number (which may or may not be a requirement?).
The end of the paper notes that "Google believes that our proposed attack is not feasible in practice". I feel like eventually we'll see a bunch of common trojans that are set up to mess with 2FA. I kind of think that this is a pretty involved process with a lot of room for things to go wrong (for the attackers) so how effective it is remains to be seen. (I also wonder with Android M if the permissions model is different enough so that the SMS reading permission needs to be invoked on a per-app basis? But that might be work-aroundable anyway.)
So... I enabled 2FA on my Apple account. I set my iPad as a trusted device. Then I log into my account from the trusted iPad, I select the trusted iPad as the device to receive the code, I receive the code on my trusted iPad, and input the code in. It's a bit pointless to go through the extra step on the same device, isn't it?
Sounds a bit like "if someone can hack your computer AND trick you into installing a trojan on your phone, he can then use that combination to install yet another app on your phone, that you only have to activate to enable it to do naughty stuff from that point on."
I wonder why he wouldn't just put the whole chicken in that first egg?
Or did I skimp over TFA too fast and miss something?
How do I "consume" e-mail hosting?
It isn't a resource that is depleted after I use it. It's a service. You can't "consume" an e-mail hosting service any more than you can "consume" a movie. You can consume a bagel, a glass of juice, or a hamburger. Fire can consume a building. But there is nothing consumable about using an e-mail service. Stop redefining words for marketing purposes.
These so-called "academics" are a stain on higher learning.
They're wasting their time trying to learn things.
Thinking?!?!?!
That's a waste of time. You could wind up upsetting someone if you dare to do THAT heinous activity!
They really should be spending all their time worrying about not microagressing anyone, because that's what's really important to true academics!
All security or encryption should be treated as breakable, so the real question is not is it breakable, but how much effort needs to be made to break it? This should also be put in the context of who we are really trying to protect data from?
Jumpstart the tartan drive.
Code isn't secure.
Nobody's beaten Google's 2FA. Remote install does not REQUIRE 2FA. If Google should decide it does, they can throw up a prompt for a code when you go to do a remote install and suddenly the "vulnerability" is gone. I agree with the article as much as they might want to do this. Right now Google uses 2FA for login and protecting account security settings only.
It's important to note that an attacker would already have to be logged in as a user. If a user keeps themselves logged into an insecure PC an attacker can use there's only so much Google can do... the article doesn't really mention the attacker has access to much of the user's Google services and data in addition to remote install. It brings to mind the "It rather involved being on the other side of this airtight hatchway" class of "vulnerability" that Raymond Chen bases off a quote from The Hitchhiker's Guide.
In addition there's a couple problems not addressed in the link I can see. First of all, AFAIK, other than on a really old version of Android through a glitch, any newly installed app cannot run any code until the first time the user launches it. Then it is allowed to install background services and whatever. But not before then. So if you manage to silently install an app which the user never sees or runs you've defeated yourself. Secondly, this can only be used to install apps from Google Play, which Google can manage to take down malicious apps as they are reported.
How do I "consume" e-mail hosting?
It isn't a resource that is depleted after I use it. It's a service.
Then what's a better term for "entity to whom a product or service of a producer is delivered"?
For a paid service Your entitlement to the service is a resource, which is consumed after all months of service for which you have paid have elapsed. For a service provided without charge It can't be "customer" if one is using only services provided without charge, such as Gmail (not Google Apps For Work) on a PC, iOS device, or out-of-warranty Android device.this is nothing important, go get an old copy of windows 95 and use a hex editor to modify command.com so that all the key commands like DIR do not work and have changed, then make sure that you made additional changes to maintain the file size and you will can a command.com that passes all security checks. Now extrapolate to use this system to modify ssd firmware and you can hack any computer in the world since the firmware that passes verification now has a virus to send windows update to a hacked server for infection. lol bye bye security