{"id":269046,"date":"2021-06-08T15:00:32","date_gmt":"2021-06-08T12:00:32","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/using-2fa-great-but-its-not-infallible-cloudsavvy-it\/"},"modified":"2021-06-08T15:00:32","modified_gmt":"2021-06-08T12:00:32","slug":"using-2fa-great-but-its-not-infallible-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/using-2fa-great-but-its-not-infallible-cloudsavvy-it\/","title":{"rendered":"#Using 2FA? Great. But It\u2019s Not Infallible \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6adefc133dc1b\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6adefc133dc1b\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/using-2fa-great-but-its-not-infallible-cloudsavvy-it\/#The_Password_Problem\" >The Password Problem<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/using-2fa-great-but-its-not-infallible-cloudsavvy-it\/#Password_Policies\" >Password Policies<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/using-2fa-great-but-its-not-infallible-cloudsavvy-it\/#Two-Factor_Authentication\" >Two-Factor Authentication<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/using-2fa-great-but-its-not-infallible-cloudsavvy-it\/#Compromising_Two-Factor_Authentication\" >Compromising Two-Factor Authentication<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/using-2fa-great-but-its-not-infallible-cloudsavvy-it\/#Dont_Stop_Using_it\" >Don\u2019t Stop Using it!<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#Using 2FA? Great. But It\u2019s Not Infallible \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<figure style=\"width: 2442px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage wp-image-11846 size-full\" data-pagespeed-lazy-src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/06\/f798f0ea.png?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"phone with two factor\" width=\"2442\" height=\"1262\" src=\"https:\/\/www.shutterstock.com\/image-photo\/2step-authentication-two-steps-verification-sms-1627553293\" data-credittext=\"Shutterstock\/BestForBest\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><figcaption class=\"wp-caption-text\"><span class=\"type:primaryImage imagecredit\"><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.shutterstock.com\/image-photo\/2step-authentication-two-steps-verification-sms-1627553293\">Shutterstock\/BestForBest<\/a><\/span><\/figcaption><\/figure>\n<p>You should use two-factor authentication wherever it is available. It isn\u2019t perfect, but it stops most attackers in their tracks. But don\u2019t be fooled into thinking it\u2019s impregnable. That\u2019s not the case.<\/p>\n<h2 id=\"the-password-problem\"><span class=\"ez-toc-section\" id=\"The_Password_Problem\"><\/span>The Password Problem<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The password has been the primary means of securing computer accounts since the 1950s. Seventy-odd years later we\u2019re all inundated with passwords, mainly for online services. Out of curiosity, I checked my password manager. I have 220 sets of login credentials stored in it.<\/p>\n<p>Unless you\u2019re particularly gifted, it\u2019s impossible to memorize that number of complex and robust passwords. That\u2019s why people re-use passwords and use passwords that are weak but easy to remember. Of course, that\u2019s the kind of behavior that places your accounts in danger of compromise.<\/p>\n<p>Automated\u00a0Brute-force attacks, dictionary attacks, and other look-up attacks\u00a0use lists of words and databases of breached passwords to try to gain unauthorized access to people\u2019s accounts. Whenever there\u2019s a data breach, the data is made available on the dark web for use by cybercriminals. They use the databases of breached passwords as ammunition for their software. It machine-guns the stolen credentials into accounts, trying to match the passwords and gain access.<\/p>\n<p>The\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/haveibeenpwned.com\/\">Have I Been Pwned<\/a>\u00a0website collects the data from as many data breaches as it can. You can freely visit the site to check whether your email address or any of your passwords have been exposed in a breach. To give you an idea of the scale of the issue, there are over <em>11 billion<\/em> sets of credentials in their databases.<\/p>\n<p>With that many passwords, there\u2019s a strong chance that someone else has chosen the same password as you. So even if none of your data has ever been exposed in a breach, somebody else\u2019s data\u2014who h<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ens to have used the same password as you\u2014might well have. And if you have used the same password on many different accounts, that puts them all at risk.<\/p>\n<p><strong>RELATED:<\/strong> <strong><em>How To Check If Staff Emails Are in Data Breaches<\/em><\/strong><\/p>\n<h2 id=\"password-policies\"><span class=\"ez-toc-section\" id=\"Password_Policies\"><\/span>Password Policies<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>All organizations should have a password policy that gives guidance on the creation and use of passwords. For example, the minimum length of a password needs to be defined, and the rules surrounding the composition of a password should be laid out clearly for all staff to understand and follow. Your policy must forbid reusing passwords on other accounts, and basing passwords on pet or family members\u2019 names, anniversaries, and birthdays.<\/p>\n<p>The issue you have is how do you police it? How do you know if staff is obeying these rules? You can set rules for minimum complexity on many systems, so they automatically reject passwords that are too short, that don\u2019t contain numbers and symbols, or are dictionary words.\u00a0That helps. But what if someone uses the password for one of their corporate accounts as their Amazon or <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">Twitter<\/a> password? You have no way of knowing.<\/p>\n<p>Using two-factor authentication improves the security of your corporate accounts, and provides some protection against poor password management too.<\/p>\n<p><strong>RELATED:<\/strong> <strong><em>The Problem With Passwords is People<\/em><\/strong><\/p>\n<h2 id=\"two-factor-authentication\"><span class=\"ez-toc-section\" id=\"Two-Factor_Authentication\"><\/span>Two-Factor Authentication<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Two-factor authentication adds another layer of protection to password-protected accounts. Along with your ID and password, you need to have access to a registered, physical object. These are either hardware dongles or smartphones running an approved authenticator app.<\/p>\n<p>A one-time code is generated by the authenticator app on the smartphone. You must enter that code along with your password when you sign into the account. Dongles may plug into a USB port or they may use Bluetooth. They either display a code or they generate and transmit a key based on a secret internal value.<\/p>\n<p>Two-factor authentication combines things you know (your credentials) with a thing you own (your smartphone or dongle). So even if someone guesses or brute-forces your password, they still cannot log into the account.<\/p>\n<p><strong>RELATED:<\/strong> <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.howtogeek.com\/361244\/sms-two-factor-auth-isn%E2%80%99t-perfect-but-you-should-still-use-it\/\"><strong><em>SMS Two-Factor Auth Isn&#8217;t Perfect, But You Should Still Use It<\/em><\/strong><\/a><\/p>\n<h2 id=\"compromising-two-factor-authentication\"><span class=\"ez-toc-section\" id=\"Compromising_Two-Factor_Authentication\"><\/span>Compromising Two-Factor Authentication<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>There are several ways for an attacker to overcome two-factor authentication and gain access to a protected account. Some of these techniques require elite technical capabilities and significant resources. For example, attacks that exploit vulnerabilities in the Signalling System No.\u00a07 protocol (SS7) are usually conducted by well-equipped and highly-skilled hacking groups, or state-sponsored attackers. SS7 is used to establish and disconnect telephony-based communications, including SMS text messages.<\/p>\n<p>To attract the attention of this caliber of threat actors, the targets have to be very high-value. \u201cHigh-value\u201d means different things to different attackers. The pay-off might not be a straightforward financial one, the attack may be politically motivated, for example, or a part of an industrial espionage campaign.<\/p>\n<p>In a \u201cport out scam\u201d the cybercriminals contact your cellular carrier and pretend to be you. Sufficiently well-practiced threat actors can convince the representative that they are the owners of your account. They can then have your smartphone number transferred to another smartphone they have access to. Any SMS-based communications are sent to their smartphone, not yours. That means any SMS-based two-factor authentication codes are delivered to the cybercriminals.<\/p>\n<p>Using social engineering techniques to sway the employees of cellular carriers isn\u2019t simple. An easier method altogether is to use an online business text messaging service. These are used by organizations to send SMS reminders, account alerts, and marketing campaigns. They\u2019re very cheap too. For about $15 you can find a service that will forward all SMS traffic from one smartphone number to another, for a month.<\/p>\n<p>Of course, you\u2019re supposed to own both smartphones or have the permission of the owner, but that isn\u2019t a problem for cybercriminals. When asked if that\u2019s the case, all they need do is say \u201cyes.\u201d There\u2019s no more verification than that. Zero skills required on the part of the attackers, and yet your smartphone is compromised.<\/p>\n<p>These types of attacks are all focused on SMS-based two-factor authentication. There are attacks that just as easily circumvent app-based two-factor authentication too.\u00a0The threat actors may mount an email phishing campaign or use typosquatting to drive people to a convincing but fraudulent login page.<\/p>\n<p>When a victim tries to log in they are prompted for their ID and password, and for their two-factor authentication code. As soon as they type in their authentication code those credentials are automatically forwarded to the login page of the genuine website and used to access the victim\u2019s account.<\/p>\n<h2 id=\"eggs\"><span class=\"ez-toc-section\" id=\"Dont_Stop_Using_it\"><\/span>Don\u2019t Stop Using it!<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Two-Factor authentication can be overcome by a range of techniques ranging from the technically demanding to the comparatively simple. Despite this, two-factor authentication is still a recommended security measure and should be adopted where ever it is offered. Even in the presence of these attacks, two-factor authentication is an order of magnitude more secure than a simple ID and password scheme.<\/p>\n<p>Cybercriminals are unlikely to try to bypass your two-factor authenticate unless you\u2019re a high-value, high-profile, or otherwise strategic target. So keep using two-factor authentication, it\u2019s far safer than not using it.\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/11821\/using-2fa-great-but-its-not-infallible\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#Using 2FA? Great. But It\u2019s Not Infallible \u2013 CloudSavvy IT&#8221; Shutterstock\/BestForBest You should use two-factor authentication wherever it is available. It isn\u2019t perfect, but it stops most attackers in their tracks. But don\u2019t be fooled into thinking it\u2019s impregnable. That\u2019s not the case. The Password Problem The password has been the primary means of securing&#8230;<\/p>\n","protected":false},"author":1,"featured_media":269047,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/06\/f798f0ea.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-269046","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/269046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=269046"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/269046\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/269047"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=269046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=269046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=269046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}