Two-Factor Authentication (2FA)

While authenticator apps are a very good way to add a layer of protection to your accounts, they are not 100% hackers or scammer-proof.

The good news is that by knowing how the methods they use to bypass 2FA you can avoid their hacks or scam attempts.

Method 1: Bypassing 2FA with Social Engineering

If a hacker has gained access to your system and deemed you to be a valuable target, some social engineering methods can be used to get access to a valid 2FA code.

For example, the hacker may try to send a compelling SMS message asking you to provide a 2FA code. Be aware that scammers are quite imaginative and try to use urgency or fear to compel you to provide the code.

You must know that some hackers and scammers have even tried to bypass 2FA by delivering a package to the victim’s location and asking for the 2FA code as a delivery verification code. The victim thinks that the code is needed to receive the package when in reality the code is used to break into one of the victim’s accounts.

It works as follows:

– One of the attackers will deliver the package and ask the victim for a 2FA code for identity verification (or some other similar excuse). For example: ‘Mr.X, in a few second you will get an SMS message with a code. Please provide the code so we can verify your identity.’

– Once the victim provides the code, the attacker will pretend to check the code when in reality he or she will be texting the code to an accomplice.

– The accomplice will be sitting at a computer, with the victim’s account (e.g., bank account) already unlocked (because they already had your username and password) and use the 2FA SMS code that the victim just provided as a final step to unlock the account.

– The attackers may even try to send a second 2FA SMS code to be able to change the 2FA authentication method (e,g., from SMS to Authenticar App) so they can make several transactions while keeping the victim both unaware and locked away. 

Method 2: Bypassing 2FA with Open Authorization (Auth)

OAuth is a framework that provides applications with limited access to a user’s data without giving away the password. 

Any website that allows you to delegate access via OAuth can also be used by an attacker as part of an OAuth phishing campaign (consent phishing). With consent phishing, the attacker pretends to be a legitimate Oath app and messages the victim asking them to grant access.

For example, imagine a third-party video editing app that offers a feature to connect with your YouTube account to upload edited videos. 

This app uses OAuth for authorization. However, the app’s OAuth implementation has security flaws or misconfigurations.

An attacker identifies these vulnerabilities and creates a malicious version of the video editing app, which looks like the legitimate one. Then, the attacker will entice users to download the malicious app and authorize their YouTube accounts.

Once users authorize the malicious app, it leverages the OAuth vulnerabilities to gain access to users’ YouTube accounts. The attacker can now upload or delete videos, change settings, or even impersonate the user without requiring the user’s 2FA codes.

Method 3: Bypassing 2FA with Brute Force

Bypassing 2FA with Brute Force” is a method where attackers attempt to gain access to an account protected by Two-Factor Authentication (2FA) by systematically trying all possible combinations of authentication codes until the correct one is found. 

This method involves using automated tools or scripts to guess the codes.

When 2FA is implemented correctly, the 2FA authentication server prevents this type of attack by only allowing a small number of incorrect OTP codes per user.

Method 4: Bypassing 2FA with Backup Codes

Bypassing Two-Factor Authentication (2FA) with Backup Codes refers to a method used by attackers to gain access to an account or system protected by 2FA by exploiting the backup codes provided by the 2FA system.

Safeguard backup codes in a secure and offline location. Do not store them on the same device as your primary 2FA method.

Method 5: Bypassing 2FA with Session Cookie or Man-In-The-Middle

Session cookies are small pieces of data stored on your device when you log in to a website or application. They are used to maintain your authenticated session, allowing you to access your account without repeatedly entering your username and password.

A Man-In-The-Middle (MITM) attack occurs when an attacker intercepts communication between two parties, such as you and a website. The attacker secretly intercepts, relays, or alters the data exchanged between the two parties without their knowledge.

– An attacker may initiate a Man-In-The-Middle attack when a user logs in to a secure website protected by 2FA.

– When you enter your username and password, the legitimate website generates a session cookie after successfully authenticating you.

– In a Man-In-The-Middle scenario, the attacker intercepts this session cookie. They may use various techniques, like eavesdropping on an unsecured Wi-Fi network or through phishing attacks, to obtain the cookie.

– The attacker can then use this intercepted session cookie to access your account without needing your 2FA code or other authentication methods. The website recognizes the session cookie as legitimate and grants access.

How to prevent become a victim of MITM attacks:

– Always use websites that employ HTTPS to encrypt data in transit, making it more difficult for attackers to intercept session cookies.

– Avoid using public or unsecured Wi-Fi networks for accessing sensitive accounts. Stick to trusted and secure networks whenever possible.

– Always log out of your accounts when you’re done. Logging out will invalidate the session cookie and require you to enter your credentials and 2FA code again when you return.

–  Be cautious about clicking on links and verify that the website’s URL is correct, especially if you’re asked to log in unexpectedly.