Rethinking Multi-Factor Authentication: The Limitations of Traditional Methods and Next-Generation Security Measures

Evolution and Challenges of Traditional MFA

Evolution of MFA Methodology

The security industry has seen the following changes in recommendations:

1. Step 1: Implement MFA via SMS
2. Step 2: "SMS is dangerous, so use an authenticator app"
3. Current: "Authenticator apps also have limitations"

However, this evolution has not solved the fundamental problem.

The Underlying Problem: Lack of Authentication Context

The biggest problem with traditional MFA methods is that the system cannot verify "who" and "from" authentication.

Whether it's a legitimate or fake site, the same verification code is generated and users can't tell it apart.

Serious Vulnerabilities in SMS Authentication

1. Risks of Message Interception Technical Vulnerabilities:

• Signaling System 7 (SS7) protocol flaw
• SIM swapping attacks
• Breaking into cellular networks

2. Third-Party Distributor Risk Supply Chain Issues:

• Major platforms such as Amazon and Google also use third-party SMS distributors
• Some distributors have been pointed out to be related to surveillance activities
• Security breaches via distributors

3. Warnings from Public Authorities CISA (U.S. Cybersecurity and Infrastructure Security Agency) Clear Warning:

"Don't use SMS as a second factor"

This warning indicates that SMS vulnerabilities are not personal speculation but a proven fact.

Limitations of Authenticator Apps

Problems with Traditional Authenticator Apps

Authenticator apps (e.g., Google Authenticator, Microsoft Authenticator, etc.) are better than SMS, but still have the following vulnerabilities:

1. Vulnerability to Phishing Attack Attack Scenarios:

1. Phishing emails to direct users to fake sites
2. Display a normal login screen on a fake site (indistinguishable from the real thing)
3. The user enters the ID, password, and authenticator app code
4. Attacker successfully logs in to legitimate site in real time

2. Time-based Code Problems TOTP (Time-based One-Time Password) Constraints:

• The code itself does not have a destination validation function
• Generated code can be used by anyone
• Relay attacks in Man-in-the-Middle attacks

3. Risks During Device Breaches Device-Level Threats:

• Code theft by malware infection
• Access in case of lost or stolen device
• Risks on rooted and jailbroken devices

Typical Attack Patterns

1. IT Helpdesk Attacks

• Attackers impersonating IT support
• Request MFA bypass or reset
• Breakthrough through social engineering

2. Phishing and Spoofing Attacks

1. Create an elaborate fake site: look like the real thing in pixels
2. Enticing Users: Directing Users to Fake Sites with Phishing Emails and SMS
3. Stealing credentials: Users enter everything including the code of the authenticator app
4. Real-time attacks: Instantly log in to legitimate sites with stolen information

The scary thing about this attack is that even though the user is using MFA "correctly", it helps the attack.

Advances and Limitations of Passkeys

Improvements in Passkey Technology Technological Advantages:

• Cryptographically combined with the website
• Increased resistance to phishing attacks
• Reduced user error

Residual Vulnerabilities

1. Dangers of Cloud Synchronization Risks of Cloud Account Compromise:

• Takeover Apple ID or Google account
• Get access to all saved Passkeys
• Cloud synchronization capability becomes a single point of failure

2. Vulnerability Physical Risks in the Event of a Device Breach****:

• Stolen or lost smartphone
• Enforce authentication due to malware infection
• Abuses of authentication through coercion or intimidation

3. Implementation Incompleteness Practical Constraints:

• Incomplete response for all services
• Need for fallback certification
• Usability and security trade-offs

Corporate Measures and Best Practices

Current Risk Mitigation Measures

1. Enhancing Defense-in-Depth

• Use multiple authentication methods together
• Monitoring for abnormal access patterns
• Enhanced session management

2. Thorough User Education

• Knowledge of the latest phishing attacks
• Establish a reporting system for suspicious requests
• Conduct regular security training

3. Implementation of Technical Measures

• Enhanced email and SMS security
• Implement endpoint protection
• Enhanced network monitoring

Conclusion

Today's widely used MFA via SMS codes and authenticator apps may seem secure, but they actually have many vulnerabilities.

Key Points:

1. SMS authentication is already broken: Targeted by technical and structural flaws
2. Authenticator apps are also limited: vulnerable to phishing attacks
3. Passkey is Progress: Evolving, but Not Perfect
4. Next-generation technology needed: hardware-based biometrics are the driving force

It's important for businesses to properly understand the risks of current MFA methods and consider transitioning to more secure authentication technologies.

While no security solution is perfect, it's possible to create mechanisms that are difficult for attackers to penetrate.

True security begins with understanding the attackers' tactics and ensuring a technological advantage over them.

To make your account more secure, start by understanding how your internal authentication works!