Google 2-Factor Authentication Vulnerability

This issue has been reported to Google, and thankfully, they said they would attempt to fix it. Update: This exploit is still active!

Laurelai says
This exploit is limited in that it is improbable to execute.

This is released for educational purposes only to demonstrate a design flaw. We are in no way responsible or to be held liable for damages via the use of this information.

What you need

• An Android mobile device
• A victims application password for 2 factor authentication.
• A victims account password.

Victim Requirements

The likelihood of this attack succeeding will increase exponentially by using Social Engineering tactics.

• Have 2 factor authentication activated.
• Have an application password for a program like Thunderbird that the attacker steals.
• Have their Google Voice account set to receive texts from google to receive 2 factor backup codes.

Instructions

1. Use the stolen application password to sign into the victims Google Voice account.
2. Attempt to sign into their account via Webmail, it will prompt for a 2 factor code.
3. Click the option you use when you dont have a code.
4. Select the option to send a code to your text number.
5. Use texted number to login to the account.
6. Remove victims mobile device and add yours as the Google authenticator device.

You have now taken over an account that uses two factor authentication.

Credits

Credit for this release goes to Laurelai

Google 2-Factor Authentication Vulnerability is part of a series on Design Flaws Visit the Design Flaws Portal for complete coverage. Tweet