Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Simple But Not Secure: An Empirical Security Analysis of Two-factor Authentication Systems

Zhi Wang, Xin Yang, Du Chen, Han Gao, Meiqi Tian, Yan Jia, Wanpeng Li

TL;DR

The analysis and evaluation found three zero-day vulnerabilities on three service providers that could allow an attacker to access a victim's account without possessing the victim's second authentication factor, thereby bypassing 2FA protections entirely.

Abstract

To protect users from data breaches and phishing attacks, service providers typically implement two-factor authentication (2FA) to add an extra layer of security against suspicious login attempts. However, since 2FA can sometimes hinder user experience by introducing additional steps, many websites aim to reduce inconvenience by minimizing the frequency of 2FA prompts. One approach to achieve this is by storing the user's ``Remember the Device'' preference in a cookie. As a result, users are only prompted for 2FA when this cookie expires or if they log in from a new device. To understand and improve the security of 2FA systems in real-world settings, we propose SE2FA, a vulnerability evaluation framework designed to detect vulnerabilities in 2FA systems. This framework enables us to analyze the security of 407 2FA systems across popular websites from the Tranco Top 10,000 list. Our analysis and evaluation found three zero-day vulnerabilities on three service providers that could allow an attacker to access a victim's account without possessing the victim's second authentication factor, thereby bypassing 2FA protections entirely. A further investigation found that these vulnerabilities stem from design choices aimed at simplifying 2FA for users but that unintentionally reduce its security effectiveness. We have disclosed these findings to the affected websites and assisted them in mitigating the risks. Based on the insights from this research, we provide practical recommendations for countermeasures to strengthen 2FA security and address these newly identified threats.

Simple But Not Secure: An Empirical Security Analysis of Two-factor Authentication Systems

TL;DR

The analysis and evaluation found three zero-day vulnerabilities on three service providers that could allow an attacker to access a victim's account without possessing the victim's second authentication factor, thereby bypassing 2FA protections entirely.

Abstract

To protect users from data breaches and phishing attacks, service providers typically implement two-factor authentication (2FA) to add an extra layer of security against suspicious login attempts. However, since 2FA can sometimes hinder user experience by introducing additional steps, many websites aim to reduce inconvenience by minimizing the frequency of 2FA prompts. One approach to achieve this is by storing the user's ``Remember the Device'' preference in a cookie. As a result, users are only prompted for 2FA when this cookie expires or if they log in from a new device. To understand and improve the security of 2FA systems in real-world settings, we propose SE2FA, a vulnerability evaluation framework designed to detect vulnerabilities in 2FA systems. This framework enables us to analyze the security of 407 2FA systems across popular websites from the Tranco Top 10,000 list. Our analysis and evaluation found three zero-day vulnerabilities on three service providers that could allow an attacker to access a victim's account without possessing the victim's second authentication factor, thereby bypassing 2FA protections entirely. A further investigation found that these vulnerabilities stem from design choices aimed at simplifying 2FA for users but that unintentionally reduce its security effectiveness. We have disclosed these findings to the affected websites and assisted them in mitigating the risks. Based on the insights from this research, we provide practical recommendations for countermeasures to strengthen 2FA security and address these newly identified threats.

Paper Structure

This paper contains 37 sections, 3 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Problem and Approach Overview
  3. Two Factor Authentication
  4. Observation and Attacks
  5. Risk Control Measures for 2FA System
  6. Observation
  7. Attacks
  8. Challenges and Our Approach
  9. Design
  10. Dataset Collection and 2FA Coverage Analysis
  11. 2FA Cookie Extraction
  12. Security Evaluation
  13. Evaluation
  14. Experiment Setup
  15. Testing Procedure
  16. ...and 22 more sections

Figures (3)

  • Figure 1: System Architecture of SE2FA. SE2FA initially gathers 2FA information from websites using meta-search engines, analyzing whether each site supports a "Remember the Device" feature. It then extracts the website’s 2FA cookies via 2FA extension and manual review. Finally, SE2FA evaluates the security of the website's 2FA implementation within a simulated attack environment.
  • Figure 2: 2FA Adoption on Top 10,000 Websites.
  • Figure 3: Websites Supporting the "Remember the Device" Feature and Those Using Cookie-Only Implementations.