View The Email to Get Hacked: Attacking SMS-based Two-Factor - PowerPoint PPT Presentation

View The Email to Get Hacked: Attacking SMS-based Two-Factor Authentication Philipp Markert, Florian Farke, and Markus Dürmuth Santa Clara, California, USA | WAY 2019 | August 11, 2019

Two-Factor Authentication 1

1 2 1

Gmail 2FA Confidential Adoption Mode Attacking Are there Google’s alternatives? 2FA

2FA Adoption 3

* analyzed top 100 websites 25 75 left no login 18 57 left duplicates 26 31 offer 2FA no 2FA 3 * Le Pochat et al. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. NDSS ’19

31 websites offer 2FA 25 (81%) 24 (77%) 7 (23%) 4

Gmail Confidential Mode 5

6

7

8

Tonight’s door code: long long Email short long 9

Tonight’s door code: long long Link short long https://confidential-mail.google.com/msg/... 10

2FA Confidential Mode Tonight’s door code: long long Link short long 11

Attacking Google’s 2FA 12

alice@gmail.com pw: wonderland 12

1. Email 13

https://confidential-mail.google.com/msg/… https://confidential-mail.oscar.com/msg/... 1. Email 13

1. Email 13

Confidential Mode 4. 3. Login 6. G-123456 1. Email 2. 5. G-123456 13

Are there alternatives? 14

1. Improve the text of the SMS 2FA Confidential Mode 14

1. Improve the text of the SMS 14

1. Improve the text of the SMS 14

2. Use a Software Token 15

3. Use a Hardware Token 16

31 websites offer 2FA 25 (81%) 7 (23%) 24 (77%) alice@gmail.com pw: wonderland

View The Email to Get Hacked: Attacking SMS-based Two-Factor Authentication Philipp Markert, Florian Farke, and Markus Dürmuth Santa Clara, California, USA | WAY 2019 | August 11, 2019