Flaws in 2-Factor Authentication Methods Could Leave You Vulnerable
July 11th, 2017 by admin
If your business is using 2-factor authentication or 2FA, methods to secure your important accounts, you may need to investigate better ways to implement the practice. Security experts widely recommend using 2FA, a system which utilizes a second security level of authorization in addition to a password to keep hackers out of accounts even when they have the password. However, not all delivery methods for transmitting that second code, token, or credential are equal.
According to Mashable, hackers have found a way to exploit the SMS text message-based delivery code method popular with services like Twitter.
The SMS Flaw
SMS messaging proved itself as a viable solution for getting a device capable of receiving 2FA authentication codes into the hands of the average person because most people already own a compatible device. Using text messaging is very practical because SMS-compatible cellular phones are so widely used that it's almost expected that a user already has a compatible device; it doesn't even need to be a smartphone to utilize this method.
However, a 2017 bank account draining heist is shining a light on how hackers can exploit SMS-based code delivery by re-routing or intercepting text messages. Instead of manipulating the account or security platform, the hackers hit the vulnerable text messaging system instead. According to Ars Technica, hackers were able to exploit the widely used Signaling System No. 7 telephony system to redirect 2FA token messages from banks to bypass security. This method can work on any platform using SS7.
Should My Business Stop 2-Factor through SMS?
Your business should not abandon 2FA just because hackers found one way to break through it. Using 2-Factor is still more secure than not using it: it still creates an additional step for the hacker to get through. However, it does mean that your business should consider switching over to alternative code delivery methods whenever applicable.
- Look for applications like the Google Authenticator app for enabling account access, which uses secure HTTP communication to send the validation code instead of SMS.
- While they include an additional expense, 2FA security key fobs offer far more secure options over SMS.
- Services typically send an email alert whenever a new device is used to access the account: pay attention to these because they can alert you immediately if your account has been hijacked. You can change the password at this time to minimize any damage.
If your business is looking to plug its potential security leaks, the IT consulting experts at ATS can help. Finding the right tools for your business's unique needs is an important part of any security strategy. Find out more and contact us today!