Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "Google 2-Factor Authentication Vulnerability"
From NetSec
(Created page with "= Google 2-Factor Authentication Vulnerability = This issue has been reported to Google, and thankfully, they said they would try to fix it. This exploit is limited in that it ...") |
|||
| Line 1: | Line 1: | ||
| − | |||
| − | |||
This issue has been reported to Google, and thankfully, they said they would try to fix it. | This issue has been reported to Google, and thankfully, they said they would try to fix it. | ||
This exploit is limited in that it is improbable to execute. | This exploit is limited in that it is improbable to execute. | ||
| − | + | = What you need = | |
*An Android mobile device | *An Android mobile device | ||
| Line 11: | Line 9: | ||
*A victims account password. | *A victims account password. | ||
| − | + | = Victim Requirements = | |
{{Info|The likelihood of this attack succeeding will increase exponentially by using [[Social Engineering]] tactics.}} | {{Info|The likelihood of this attack succeeding will increase exponentially by using [[Social Engineering]] tactics.}} | ||
*Have 2 factor authentication activated. | *Have 2 factor authentication activated. | ||
| Line 17: | Line 15: | ||
*Have their Google Voice account set to receive texts from google to receive 2 factor backup codes. | *Have their Google Voice account set to receive texts from google to receive 2 factor backup codes. | ||
| − | + | = Instructions = | |
| − | + | ||
#Use the stolen application password to sign into the victims Google Voice account. | #Use the stolen application password to sign into the victims Google Voice account. | ||
#Attempt to sign into their account via Webmail, it will prompt for a 2 factor code. | #Attempt to sign into their account via Webmail, it will prompt for a 2 factor code. | ||
| Line 29: | Line 26: | ||
= Credits = | = Credits = | ||
| − | |||
Credit for this release goes to [http://twitter.com/#!/stuxnetsource Laurelai] | Credit for this release goes to [http://twitter.com/#!/stuxnetsource Laurelai] | ||
{{Warning|This is released as an educational howto. We are not responsible for damages via the use of this information.}} | {{Warning|This is released as an educational howto. We are not responsible for damages via the use of this information.}} | ||
Revision as of 15:24, 28 October 2011
This issue has been reported to Google, and thankfully, they said they would try to fix it.
This exploit is limited in that it is improbable to execute.
What you need
- An Android mobile device
- A victims application password for 2 factor authentication.
- A victims account password.
Victim Requirements
|
The likelihood of this attack succeeding will increase exponentially by using Social Engineering tactics. |
- Have 2 factor authentication activated.
- Have an application password for a program like Thunderbird that the attacker steals.
- Have their Google Voice account set to receive texts from google to receive 2 factor backup codes.
Instructions
- Use the stolen application password to sign into the victims Google Voice account.
- Attempt to sign into their account via Webmail, it will prompt for a 2 factor code.
- Click the option you use when you dont have a code.
- Select the option to send a code to your text number.
- Use texted number to login to the account.
- Remove victims mobile device and add yours as the Google authenticator device.
You have now taken over an account that uses two factor authentication.
Credits
Credit for this release goes to Laurelai
|
This is released as an educational howto. We are not responsible for damages via the use of this information. |
