Abstract
Deploying Two-Factor Authentication (2FA) is one of the highly-recommended security mechanism against account hijacking attacks. One of the common methods for 2FA is to bring something you know and something you have factors together. For the latter we have options including USB sticks, smart cards, SMS verification, and one-time password values generated by mobile applications (soft OTP). Due to the cost and convenience reasons, deploying 2FA via soft OTPs is more common. However, unlike smart cards which have tamper resistance property, attackers can access smartphones remotely or physically so that they can fetch shared secret seed value - an important security risk for mobile authenticators. For this reason, it is critical to analyze mobile authenticator applications in this context. In this paper, we report our findings after analyzing eleven different Android authenticator applications. We report that we have fetched cleartext shared secret seed value from storage in five applications and from memory in seven applications using standard reverse engineering techniques and open-source tools.
Original language | English |
---|---|
Title of host publication | 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings |
Editors | Seref Sagiroglu, Sedat Akleylek, Ferruh Ozbudak, Yavuz Canbay |
Publisher | Institute of Electrical and Electronics Engineers Inc. |
Pages | 18-30 |
Number of pages | 13 |
ISBN (Electronic) | 9781665418638 |
DOIs | |
Publication status | Published - 3 Dec 2020 |
Externally published | Yes |
Event | 13th International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Virtual, Ankara, Turkey Duration: 3 Dec 2020 → 4 Dec 2020 |
Publication series
Name | 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings |
---|
Conference
Conference | 13th International Conference on Information Security and Cryptology, ISCTURKEY 2020 |
---|---|
Country/Territory | Turkey |
City | Virtual, Ankara |
Period | 3/12/20 → 4/12/20 |
Bibliographical note
Publisher Copyright:© 2020 IEEE.
Keywords
- Android
- Android Key Store
- Authentication
- Cryptographic Controls
- Mobile Authenticator
- Mobile Security
- Obfuscation
- ProGuard
- Reverse Engineering
- Two Factor Authentication