Security Analysis of Mobile Authenticator Applications

Can Ozkan; Kemal Bicakci

doi:10.1109/ISCTURKEY51113.2020.9308020

Security Analysis of Mobile Authenticator Applications

Can Ozkan
, Kemal Bicakci

Department of Computer Engineering
TOBB University of Economics and Technology
Securify Information Tech. and Security Training Consulting Inc

Araştırma çıktısı: Kitap/Rapor/Konferans Bildirisinde Bölüm › Konferans katkısı › Hakemli

13 Atıf (Scopus)

Özet

Deploying Two-Factor Authentication (2FA) is one of the highly-recommended security mechanism against account hijacking attacks. One of the common methods for 2FA is to bring something you know and something you have factors together. For the latter we have options including USB sticks, smart cards, SMS verification, and one-time password values generated by mobile applications (soft OTP). Due to the cost and convenience reasons, deploying 2FA via soft OTPs is more common. However, unlike smart cards which have tamper resistance property, attackers can access smartphones remotely or physically so that they can fetch shared secret seed value - an important security risk for mobile authenticators. For this reason, it is critical to analyze mobile authenticator applications in this context. In this paper, we report our findings after analyzing eleven different Android authenticator applications. We report that we have fetched cleartext shared secret seed value from storage in five applications and from memory in seven applications using standard reverse engineering techniques and open-source tools.

Orijinal dil	İngilizce
Ana bilgisayar yayını başlığı	2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings
Editörler	Seref Sagiroglu, Sedat Akleylek, Ferruh Ozbudak, Yavuz Canbay
Yayınlayan	Institute of Electrical and Electronics Engineers Inc.
Sayfalar	18-30
Sayfa sayısı	13
ISBN (Elektronik)	9781665418638
DOI'lar	https://doi.org/10.1109/ISCTURKEY51113.2020.9308020
Yayın durumu	Yayınlandı - 3 Ara 2020
Harici olarak yayınlandı	Evet
Etkinlik	13th International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Virtual, Ankara, Türkiye Süre: 3 Ara 2020 → 4 Ara 2020

Yayın serisi

Adı	2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings

???event.eventtypes.event.conference???

???event.eventtypes.event.conference???	13th International Conference on Information Security and Cryptology, ISCTURKEY 2020
Ülke/Bölge	Türkiye
Şehir	Virtual, Ankara
Periyot	3/12/20 → 4/12/20

Bibliyografik not

Publisher Copyright:
© 2020 IEEE.

Belgeye Erişim

10.1109/ISCTURKEY51113.2020.9308020

Diğer Dosyalar ve Linkler

Link to publication in Scopus

Alıntı Yap

Ozkan, C., & Bicakci, K. (2020). Security Analysis of Mobile Authenticator Applications. In S. Sagiroglu, S. Akleylek, F. Ozbudak, & Y. Canbay (Eds.), 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings (pp. 18-30). Makale 9308020 (2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ISCTURKEY51113.2020.9308020

Ozkan, Can ; Bicakci, Kemal. / Security Analysis of Mobile Authenticator Applications. 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings. editör / Seref Sagiroglu ; Sedat Akleylek ; Ferruh Ozbudak ; Yavuz Canbay. Institute of Electrical and Electronics Engineers Inc., 2020. pp. 18-30 (2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings).

@inproceedings{a8f02634318a4e3e912e505ec2e429ca,

title = "Security Analysis of Mobile Authenticator Applications",

abstract = "Deploying Two-Factor Authentication (2FA) is one of the highly-recommended security mechanism against account hijacking attacks. One of the common methods for 2FA is to bring something you know and something you have factors together. For the latter we have options including USB sticks, smart cards, SMS verification, and one-time password values generated by mobile applications (soft OTP). Due to the cost and convenience reasons, deploying 2FA via soft OTPs is more common. However, unlike smart cards which have tamper resistance property, attackers can access smartphones remotely or physically so that they can fetch shared secret seed value - an important security risk for mobile authenticators. For this reason, it is critical to analyze mobile authenticator applications in this context. In this paper, we report our findings after analyzing eleven different Android authenticator applications. We report that we have fetched cleartext shared secret seed value from storage in five applications and from memory in seven applications using standard reverse engineering techniques and open-source tools.",

keywords = "Android, Android Key Store, Authentication, Cryptographic Controls, Mobile Authenticator, Mobile Security, Obfuscation, ProGuard, Reverse Engineering, Two Factor Authentication",

author = "Can Ozkan and Kemal Bicakci",

note = "Publisher Copyright: {\textcopyright} 2020 IEEE.; 13th International Conference on Information Security and Cryptology, ISCTURKEY 2020 ; Conference date: 03-12-2020 Through 04-12-2020",

year = "2020",

month = dec,

day = "3",

doi = "10.1109/ISCTURKEY51113.2020.9308020",

language = "English",

series = "2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "18--30",

editor = "Seref Sagiroglu and Sedat Akleylek and Ferruh Ozbudak and Yavuz Canbay",

booktitle = "2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings",

address = "United States",

}

Ozkan, C & Bicakci, K 2020, Security Analysis of Mobile Authenticator Applications. in S Sagiroglu, S Akleylek, F Ozbudak & Y Canbay (eds), 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings., 9308020, 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings, Institute of Electrical and Electronics Engineers Inc., pp. 18-30, 13th International Conference on Information Security and Cryptology, ISCTURKEY 2020, Virtual, Ankara, Türkiye, 3/12/20. https://doi.org/10.1109/ISCTURKEY51113.2020.9308020

Security Analysis of Mobile Authenticator Applications. / Ozkan, Can; Bicakci, Kemal.
2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings. ed. / Seref Sagiroglu; Sedat Akleylek; Ferruh Ozbudak; Yavuz Canbay. Institute of Electrical and Electronics Engineers Inc., 2020. p. 18-30 9308020 (2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings).

Araştırma çıktısı: Kitap/Rapor/Konferans Bildirisinde Bölüm › Konferans katkısı › Hakemli

TY - GEN

T1 - Security Analysis of Mobile Authenticator Applications

AU - Ozkan, Can

AU - Bicakci, Kemal

PY - 2020/12/3

Y1 - 2020/12/3

N2 - Deploying Two-Factor Authentication (2FA) is one of the highly-recommended security mechanism against account hijacking attacks. One of the common methods for 2FA is to bring something you know and something you have factors together. For the latter we have options including USB sticks, smart cards, SMS verification, and one-time password values generated by mobile applications (soft OTP). Due to the cost and convenience reasons, deploying 2FA via soft OTPs is more common. However, unlike smart cards which have tamper resistance property, attackers can access smartphones remotely or physically so that they can fetch shared secret seed value - an important security risk for mobile authenticators. For this reason, it is critical to analyze mobile authenticator applications in this context. In this paper, we report our findings after analyzing eleven different Android authenticator applications. We report that we have fetched cleartext shared secret seed value from storage in five applications and from memory in seven applications using standard reverse engineering techniques and open-source tools.

AB - Deploying Two-Factor Authentication (2FA) is one of the highly-recommended security mechanism against account hijacking attacks. One of the common methods for 2FA is to bring something you know and something you have factors together. For the latter we have options including USB sticks, smart cards, SMS verification, and one-time password values generated by mobile applications (soft OTP). Due to the cost and convenience reasons, deploying 2FA via soft OTPs is more common. However, unlike smart cards which have tamper resistance property, attackers can access smartphones remotely or physically so that they can fetch shared secret seed value - an important security risk for mobile authenticators. For this reason, it is critical to analyze mobile authenticator applications in this context. In this paper, we report our findings after analyzing eleven different Android authenticator applications. We report that we have fetched cleartext shared secret seed value from storage in five applications and from memory in seven applications using standard reverse engineering techniques and open-source tools.

KW - Android

KW - Android Key Store

KW - Authentication

KW - Cryptographic Controls

KW - Mobile Authenticator

KW - Mobile Security

KW - Obfuscation

KW - ProGuard

KW - Reverse Engineering

KW - Two Factor Authentication

UR - https://www.scopus.com/pages/publications/85101066889

U2 - 10.1109/ISCTURKEY51113.2020.9308020

DO - 10.1109/ISCTURKEY51113.2020.9308020

M3 - Conference contribution

AN - SCOPUS:85101066889

T3 - 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings

SP - 18

EP - 30

BT - 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings

A2 - Sagiroglu, Seref

A2 - Akleylek, Sedat

A2 - Ozbudak, Ferruh

A2 - Canbay, Yavuz

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 13th International Conference on Information Security and Cryptology, ISCTURKEY 2020

Y2 - 3 December 2020 through 4 December 2020

ER -

Ozkan C, Bicakci K. Security Analysis of Mobile Authenticator Applications. In Sagiroglu S, Akleylek S, Ozbudak F, Canbay Y, editörler, 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings. Institute of Electrical and Electronics Engineers Inc. 2020. p. 18-30. 9308020. (2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings). doi: 10.1109/ISCTURKEY51113.2020.9308020

Security Analysis of Mobile Authenticator Applications

Özet

Yayın serisi

???event.eventtypes.event.conference???

Bibliyografik not

Belgeye Erişim

Diğer Dosyalar ve Linkler

Parmak izi

Alıntı Yap