There’s been a lot of chatter lately around two-factor authentication (2FA) and multi-factor authentication (MFA). We’re seeing more and more websites and applications enforcing 2FA—like Google recently announcing 2FA will be turned on by default for all accounts, plus Huntress has already hopped on the enforced MFA bandwagon.
But that led us to wonder: How easy is it for malicious threat actors to circumvent 2FA?
In a recent Tradecraft Tuesday episode, we talked about the various types of 2FA and if there’s a “right way” to set up 2FA (or even better, MFA). You can re-watch the episode here, or keep reading for some key takeaways and to see how easy it can be to sneak past 2FA.
Two-factor authentication is a verification method that requires users to provide at least two forms of identification in order to access something.
Rather than just asking for a username and password, 2FA requires an additional verification factor, which can decrease the likelihood of a successful cyberattack. These factors can include:
When you think of authentication, you probably think of the typical username and password (that's the single factor). But as we all know, those passwords can easily be stolen, shared, reused or compromised in some way.
Instead of relying on a single factor, 2FA adds an additional layer of security by requiring another or multiple forms of authentication—in theory, making it harder for hackers and unauthorized users to gain access to your accounts or devices.
Because two-factor authentication adds that extra layer of security, a lot of people assume that makes it impenetrable. But, like almost anything these days, 2FA can be bypassed.
Let’s dive into just how easy it is to bypass 2FA. For the purposes of this example, we’re only going to pick on SMS-based authentication, which is a method that allows users to verify their identities with a code that is sent to them via text message.
As the avid cell phone and smartphone users that we all are, we know how phone carriers want to provide their customers with the best customer service. Unfortunately, that need to please can easily be exploited.
The image below illustrates how attackers can trick phone carriers through a tactic called SIM swapping. In a nutshell, SIM swapping is when a scammer steals your mobile phone number by assigning it to a new SIM card. By calling up your carrier’s customer service line and giving a few details about you, a hacker can claim that your original phone and SIM card were lost or destroyed and they have a new SIM card they’d like to activate.
Here’s a look at SIM swapping in action:
Let’s put this into the context of SMS-based 2FA. Can you see why SIM swapping could be a huge issue?
If an attacker knows your username and password and was successful in tricking your carrier into a SIM swap, once they enter your credentials now they receive the authentication code via text message and BOOM, they’re in. That so-called second factor is now bypassed—all because people are way more exploitable than technology.
Please note: We’re not trying to strike fear into your heart—actually, the most common targets of SIM swapping are celebrities, politicians or Forture 500 CEOs—but what we are trying to emphasize is that in this case, the security of your SMS authentication relies on the security of a third-party carrier, or lack thereof.
Yes, 100% it is. Layers are so important, and 2FA is another layer in your defense against attackers… but as we’ve seen, it isn’t perfect.
In our example, we showed just how bypassable SMS-based authentication is through SIM swapping or social engineering phone carriers. It’s clear that hackers are growing more sophisticated every day—with small amounts of information, there’s a lot of damage they can do. So if possible, avoid SMS-only authentication when you’re setting up 2FA.
And of course there’s the convenience argument. Some users will complain that 2FA is a pain for them because they need to take another step to log in. That’s understandable, but cybersecurity is always a trade-off. Given the sheer cost of security incidents today, a few extra steps are much less painful than dealing with a cyberattack.
And if there are a few key lessons we can leave you with, it’s these:
If you want some more two-factor tips or want to see a live demo of a real 2FA bypass, watch our Tradecraft Tuesday episode here!
Get insider access to Huntress tradecraft, killer events, and the freshest blog updates.
