[ad_1]
Cybersecurity researchers have disclosed particulars of a now-patched bug in Field’s multi-factor authentication (MFA) mechanism that may very well be abused to fully sidestep SMS-based login verification.
“Utilizing this system, an attacker might use stolen credentials to compromise a corporation’s Field account and exfiltrate delicate knowledge with out entry to the sufferer’s telephone,” Varonis researchers mentioned in a report shared with The Hacker Information.
The cybersecurity firm mentioned it reported the difficulty to the cloud service supplier on November 2, 2021, put up which fixes had been issued by Field.
MFA is an authentication technique that depends on a mix of things similar to a password (one thing solely the person is aware of) and a brief one-time password aka TOTP (one thing solely the person has) to supply customers a second layer of protection towards credential stuffing and different account takeover assaults.
This two-step authentication can both contain sending the code as an SMS or alternatively, accessed by way of an authenticator app or a {hardware} safety key. Thus, when a Field person who’s enrolled for SMS verification logs in with a legitimate username and password, the service units a session cookie and redirects the person to a web page the place the TOTP will be entered to achieve entry to the account.
The bypass recognized by Varonis is a consequence of what the researchers known as a mixup of MFA modes. It happens when an attacker indicators in with the sufferer’s credentials and abandons the SMS-based authentication in favor of a unique course of that makes use of, say, the authenticator app to efficiently full the login just by furnishing the TOTP related to their very own Field account.
“Field misses that the sufferer hasn’t enrolled [in] an authenticator app, and as an alternative blindly accepts a legitimate authentication passcode from a completely totally different account with out first checking that it belonged to the person that was logging in,” the researchers mentioned. “This made it potential to entry the sufferer’s Field account with out accessing their telephone or notifying the person by way of SMS.”
Put otherwise, Field not solely didn’t test whether or not the sufferer was enrolled in an authenticator app-based verification (or every other technique barring SMS), it additionally didn’t validate that the code entered is from an authenticator app that is truly linked to the sufferer who’s making an attempt to log in.
The findings come just a little over a month after Varonis disclosed the same method that might allow malicious actors to get round authenticator-based verification by “unenroll[ing] a person from MFA after offering a username and password however earlier than offering the second issue.”
“The /mfa/unenrollment endpoint didn’t require the person to be absolutely authenticated with a view to take away a TOTP gadget from a person’s account,” the researchers famous in early December 2021.
“MFA is simply pretty much as good because the developer writing the code [and] can present a false sense of safety,” the researchers concluded. “Simply because MFA is enabled would not essentially imply an attacker should achieve bodily entry to a sufferer’s gadget to compromise their account.”
[ad_2]
