The “knowledge factor” (using passwords for authentication) will never be enough for security. We need the second layer of defense — a “possession factor” or sometimes called the “Two-Factor Authentication”, hence the term, “2FA”. Nowadays many organization plans to adopt password-free login to authenticate their systems, thereby completely replacing the password-based authentication with key-based authentication, which they believed is more secure. However, the truth is far from reality. Although 2FA creates a formidable barrier against potential security breaches, however it doesn’t guarantee much security at all, especially when it comes to the inefficacious and often futile private key protection. In that sense, we can say that the effectiveness of the 2FA depends on how well they can protect “something only user has”. In fact, there are many ways to steal someone’s private keys without performing social engineering attacks.
This talk is dedicated to discuss and demonstrate the newly discovered techniques to bypass the two-factor authentication by stealing and cracking OTP, private keys, and client certificates. By that means, an attacker must compromise the voice or text message accounts, software token, infecting memory agents, cracking passphrase, stealing hardware token, etc. With the help from the “2FAssassin” we could turn these looted keys for more fun and profits.
The demonstration will include the scenario where the private keys are compromised and then show how an attacker could leverage the situation to gain more access into the corporate networks and for making profits. These are not limited to systems that used single sign-on (with 2FA enabled), public key authentication (e.g., password-less authentication, authorized_keys abuse), free software token (e.g., Google Authenticator), website owner (e.g., phishing sites created using stolen private key), and even software vendor (e.g., stolen private key can be used to sign the malicious malware).
The tool will automate the exploitations against the common vulnerabilities that lead to the private key leakage. It can be used to compromise individual system, or the entire network using looted private keys. It also capable to analyze and identify potential private keys, key information extraction in order to profile the target servers, cracking and removing the passphrase, injecting arbitrary key-based backdoors, building multi-chained covert tunnels by leveraging on the loopholes found in vulnerable public key authentication.
Nevertheless, the talk will end with recommendations to protect the private keys from theft, as well as what to do during the worst case scenario.
