WTF, 2FA!? Y U NO PROTECT ME?

@tech_christine WTF, 2FA!? Y U NO PROTECT ME? Two factor
authentication the worst, the best, and everything in-between

@tech_christine

@tech_christine Back to the beginning

@tech_christine What was the hacker up to? Calling your mobile
provider

@tech_christine Still on the phone with your mobile provider... Using
social engineering

@tech_christine And now they have all the access... Sim swap/sim
hijacking

@tech_christine

“ @tech_christine We learned that SMS-based authentication is not nearly
as secure as we would hope, and the main attack was via SMS intercept Christopher Slowe Reddit chief technology ofﬁcer and founding engineer August 2018

@tech_christine What is authentication? The process of verifying that someone
or something is the actual entity that they claim to be. - OWASP.org (these people know what they are talking about when it comes to security)

@tech_christine ... but what are the different factors of auth?
1 factor is knowledge (i.e. your password) 2 is the other method choice - Possession (token/soft token) - Identity (biometrics)

@tech_christine 2FA == 2SV == MFA 2FA = Two factor
authentication 2SV = Two Step verification MFA = Multi-factor authentication What about all those other acronyms...

@tech_christine Why didn't 2FA help? •SMS was used •2FA wasn't
even enabled

@tech_christine •Most common method •Most compromised •Not recommended by NIST
since 2016 SMS

@tech_christine Let's figure out all the ways SMS can be
hacked... 1. Sim-swap (aka what just happened to us) 2. Port-out scam 3. Brute force on the application itself

@tech_christine Time-based One Time Password aka App based aka soft
token •Authy •Google Authenticator •1Password TOTP

@tech_christine •Associated with the certain authorized devices •Not visible on
a locked phone screen Push Based Authentication

@tech_christine Token based Physical keys that can auth •USB drive
•near-ﬁeld communication •Many use U2F (Universal 2nd Factor)

What would you change now?

@tech_christine So what could you have changed? •Setting up with
a VOIP number •Secure with alternate authentication method •Pin/password protect phone provider Keep on being @awesome

@tech_christine ...wait I lost my phone/app access/token Use a recovery
code Allows you access to application

@tech_christine More on recovery codes •Stored as hashes •One time
use •Shown only once

@tech_christine 2FA Implementation Best Practices • Rate limiting prevents brute
force attacks • Use a truncated exponential back-off algorithm

@tech_christine What is an exponential back-off algorithm?

@tech_christine Example in Ruby login_request if retries <= max_retries retries
+= 1 sleep (retries + rand(100)/1000) retry else raise "You've hit your max retries!" end

@tech_christine Get user buy-in Enforce authentication on all pages Users
with the most amount of privilege, 2FA is a requirement not optional

@tech_christine Now you are the info sec professional

@tech_christine Thank you Kernelcon and all the staff Tyson Reeder
for the final graphic(@tysondreeder) For references and further reading checkout https://christine-seeman.com/talks/

WTF, 2FA!? Y U NO PROTECT ME?

WTF, 2FA!? Y U NO PROTECT ME?

Christine

More Decks by Christine

Other Decks in Technology

Featured

Transcript

@tech_christine WTF, 2FA!? Y U NO PROTECT ME? Two factor

@tech_christine

@tech_christine Back to the beginning

@tech_christine What was the hacker up to? Calling your mobile

@tech_christine Still on the phone with your mobile provider... Using

@tech_christine And now they have all the access... Sim swap/sim

@tech_christine

“ @tech_christine We learned that SMS-based authentication is not nearly

@tech_christine What is authentication? The process of verifying that someone

@tech_christine ... but what are the different factors of auth?

@tech_christine 2FA == 2SV == MFA 2FA = Two factor

@tech_christine Why didn't 2FA help? •SMS was used •2FA wasn't

@tech_christine •Most common method •Most compromised •Not recommended by NIST

@tech_christine Let's figure out all the ways SMS can be

@tech_christine Time-based One Time Password aka App based aka soft

@tech_christine •Associated with the certain authorized devices •Not visible on

@tech_christine Token based Physical keys that can auth •USB drive

What would you change now?

@tech_christine So what could you have changed? •Setting up with

@tech_christine ...wait I lost my phone/app access/token Use a recovery

@tech_christine More on recovery codes •Stored as hashes •One time

@tech_christine 2FA Implementation Best Practices • Rate limiting prevents brute

@tech_christine What is an exponential back-off algorithm?

@tech_christine Example in Ruby login_request if retries <= max_retries retries

@tech_christine Get user buy-in Enforce authentication on all pages Users

@tech_christine Now you are the info sec professional

@tech_christine Thank you Kernelcon and all the staff Tyson Reeder