Introduction |
|
xxv | |
Who This Book Is For |
|
xxvii | |
What Is Covered in This Book? |
|
xxvii | |
MFA Is Good |
|
xxx | |
How to Contact Wiley or the Author |
|
xxxi | |
|
|
1 | (120) |
|
|
3 | (30) |
|
|
3 | (2) |
|
The Problem with Passwords |
|
|
5 | (1) |
|
|
5 | (13) |
|
|
9 | (1) |
|
|
9 | (2) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
12 | (1) |
|
|
13 | (2) |
|
|
15 | (3) |
|
Passwords Will Be with Us for a While |
|
|
18 | (1) |
|
Password Problems and Attacks |
|
|
18 | (13) |
|
|
19 | (4) |
|
|
23 | (4) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
29 | (1) |
|
Password Hacking Defenses |
|
|
30 | (1) |
|
MFA Riding to the Rescue? |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
33 | (26) |
|
Authentication Life Cycle |
|
|
34 | (22) |
|
|
35 | (11) |
|
|
46 | (8) |
|
|
54 | (1) |
|
|
54 | (2) |
|
|
56 | (1) |
|
|
56 | (1) |
|
Authentication Problems in the Real World |
|
|
57 | (1) |
|
|
58 | (1) |
|
3 Types of Authentication |
|
|
59 | (42) |
|
|
59 | (1) |
|
Knowledge-Based Authentication |
|
|
60 | (9) |
|
|
60 | (2) |
|
|
62 | (2) |
|
|
64 | (5) |
|
|
69 | (2) |
|
Single Sign-Ons and Proxies |
|
|
71 | (1) |
|
|
72 | (9) |
|
|
73 | (3) |
|
Public Key Infrastructure |
|
|
76 | (3) |
|
|
79 | (2) |
|
|
81 | (8) |
|
One-Time Password Devices |
|
|
81 | (2) |
|
Physical Connection Devices |
|
|
83 | (4) |
|
|
87 | (2) |
|
|
89 | (3) |
|
|
89 | (1) |
|
|
89 | (3) |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
93 | (1) |
|
Federated Identities and APIs |
|
|
94 | (2) |
|
|
94 | (2) |
|
|
96 | (1) |
|
|
96 | (1) |
|
|
97 | (2) |
|
|
97 | (1) |
|
|
98 | (1) |
|
|
99 | (2) |
|
|
101 | (20) |
|
What Does Usability Mean? |
|
|
101 | (2) |
|
We Don't Really Want the Best Security |
|
|
103 | (2) |
|
Security Isn't Usually Binary |
|
|
105 | (1) |
|
|
106 | (3) |
|
|
106 | (2) |
|
Moving ATM Keypad Numbers |
|
|
108 | (1) |
|
Not as Worried as You Think About Hacking |
|
|
109 | (1) |
|
|
110 | (5) |
|
|
113 | (1) |
|
|
113 | (1) |
|
Unhackable Quantum Cryptography |
|
|
114 | (1) |
|
|
115 | (1) |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
No MFA Solution Works Everywhere |
|
|
118 | (1) |
|
|
119 | (2) |
|
|
121 | (332) |
|
|
123 | (18) |
|
MFA Dependency Components |
|
|
124 | (10) |
|
|
125 | (2) |
|
|
127 | (1) |
|
|
127 | (1) |
|
|
128 | (1) |
|
|
129 | (1) |
|
|
129 | (1) |
|
Authentication Secrets Store |
|
|
129 | (1) |
|
|
130 | (1) |
|
|
130 | (1) |
|
Transmission/Network Channel |
|
|
131 | (1) |
|
|
131 | (1) |
|
Supporting Infrastructure |
|
|
131 | (1) |
|
|
132 | (1) |
|
|
132 | (1) |
|
Alternate Authentication Methods/Recovery |
|
|
132 | (1) |
|
|
133 | (1) |
|
|
133 | (1) |
|
|
134 | (1) |
|
|
134 | (4) |
|
|
134 | (1) |
|
|
135 | (2) |
|
|
137 | (1) |
|
Two or More Hacking Methods Used |
|
|
137 | (1) |
|
"You Didn't Hack the MFA!" |
|
|
137 | (1) |
|
How MFA Vulnerabilities Are Found |
|
|
138 | (2) |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
139 | (1) |
|
|
139 | (1) |
|
|
139 | (1) |
|
|
140 | (1) |
|
|
140 | (1) |
|
6 Access Control Token Tricks |
|
|
141 | (22) |
|
|
141 | (1) |
|
Access Control Token General Hacks |
|
|
142 | (4) |
|
Token Reproduction/Guessing |
|
|
142 | (3) |
|
|
145 | (1) |
|
Reproducing Token Hack Examples |
|
|
146 | (3) |
|
Network Session Hijacking Techniques and Examples |
|
|
149 | (8) |
|
|
149 | (1) |
|
|
150 | (7) |
|
Access Control Token Attack Defenses |
|
|
157 | (4) |
|
Generate Random, Unguessable Session IDs |
|
|
157 | (1) |
|
Use Industry-Accepted Cryptography and Key Sizes |
|
|
158 | (1) |
|
Developers Should Follow Secure Coding Practices |
|
|
159 | (1) |
|
Use Secure Transmission Channels |
|
|
159 | (1) |
|
Include Timeout Protections |
|
|
159 | (1) |
|
Tie the Token to Specific Devices or Sites |
|
|
159 | (2) |
|
|
161 | (2) |
|
|
163 | (18) |
|
|
163 | (2) |
|
|
165 | (4) |
|
|
165 | (1) |
|
|
165 | (1) |
|
What Can an Endpoint Attacker Do? |
|
|
166 | (3) |
|
Specific Endpoint Attack Examples |
|
|
169 | (5) |
|
|
169 | (2) |
|
|
171 | (1) |
|
|
172 | (1) |
|
|
173 | (1) |
|
|
174 | (5) |
|
|
174 | (3) |
|
|
177 | (2) |
|
|
179 | (2) |
|
|
181 | (24) |
|
|
181 | (6) |
|
|
184 | (2) |
|
|
186 | (1) |
|
|
187 | (12) |
|
|
187 | (4) |
|
|
191 | (3) |
|
|
194 | (1) |
|
Cell Phone User Account Hijacking |
|
|
195 | (1) |
|
Attacks Against the Underlying Supporting Infrastructure |
|
|
196 | (1) |
|
|
196 | (1) |
|
SIM/SMS Attack Method Summary |
|
|
197 | (1) |
|
NIST Digital Identity Guidelines Warning |
|
|
198 | (1) |
|
Defenses to SMS-Based MFA Attacks |
|
|
199 | (4) |
|
|
199 | (2) |
|
|
201 | (1) |
|
Is RCS Here to Save Mobile Messaging? |
|
|
202 | (1) |
|
Is SMS-Based MFA Still Better than Passwords? |
|
|
202 | (1) |
|
|
203 | (2) |
|
9 One-Time Password Attacks |
|
|
205 | (22) |
|
|
205 | (12) |
|
|
208 | (1) |
|
|
209 | (2) |
|
|
211 | (1) |
|
|
212 | (5) |
|
|
217 | (5) |
|
|
217 | (2) |
|
|
219 | (1) |
|
OTP Theft, Re-Creation, and Reuse |
|
|
219 | (1) |
|
|
220 | (2) |
|
|
222 | (4) |
|
|
222 | (1) |
|
Use Reliable and Trusted and Tested OTP Algorithms |
|
|
223 | (1) |
|
OTP Setup Code Must Expire |
|
|
223 | (1) |
|
OTP Result Code Must Expire |
|
|
223 | (1) |
|
|
224 | (1) |
|
Make Sure Your RNC Is NIST-Certified or Quantum |
|
|
224 | (1) |
|
Increase Security by Requiring Additional Entry Beyond OTP Code |
|
|
224 | (1) |
|
Stop Brute-Forcing Attacks |
|
|
224 | (1) |
|
Secure Seed Value Database |
|
|
225 | (1) |
|
|
225 | (1) |
|
|
226 | (1) |
|
10 Subject Hijack Attacks |
|
|
227 | (18) |
|
|
227 | (1) |
|
|
228 | (14) |
|
Active Directory and Smartcards |
|
|
228 | (3) |
|
Simulated Demo Environment |
|
|
231 | (3) |
|
Subject Hijack Demo Attack |
|
|
234 | (6) |
|
|
240 | (1) |
|
Dynamic Access Control Example |
|
|
240 | (1) |
|
|
241 | (1) |
|
Defenses to Component Attacks |
|
|
242 | (2) |
|
Threat Model Dependency Abuse Scenarios |
|
|
242 | (1) |
|
Secure Critical Dependencies |
|
|
242 | (1) |
|
Educate About Dependency Abuses |
|
|
243 | (1) |
|
Prevent One to Many Mappings |
|
|
244 | (1) |
|
Monitor Critical Dependencies |
|
|
244 | (1) |
|
|
244 | (1) |
|
11 Fake Authentication Attacks |
|
|
245 | (14) |
|
Learning About Fake Authentication Through UAC |
|
|
245 | (6) |
|
Example Fake Authentication Attacks |
|
|
251 | (3) |
|
|
251 | (1) |
|
|
252 | (1) |
|
|
252 | (1) |
|
Using an MFA-lncompatible Service or Protocol |
|
|
253 | (1) |
|
Defenses to Fake Authentication Attacks |
|
|
254 | (3) |
|
|
254 | (2) |
|
|
256 | (1) |
|
|
257 | (2) |
|
12 Social Engineering Attacks |
|
|
259 | (16) |
|
|
259 | (2) |
|
Social Engineering Commonalities |
|
|
261 | (5) |
|
Unauthenticated Communication |
|
|
261 | (1) |
|
|
262 | (1) |
|
Usually Involves Weil-Known Brands |
|
|
263 | (1) |
|
Often Based on Notable Current Events and Interests |
|
|
264 | (1) |
|
|
264 | (1) |
|
|
265 | (1) |
|
|
266 | (1) |
|
Example Social Engineering Attacks on MFA |
|
|
266 | (4) |
|
|
267 | (1) |
|
|
267 | (1) |
|
Hacking Building Access Cards |
|
|
268 | (2) |
|
Defenses to Social Engineering Attacks on MFA |
|
|
270 | (3) |
|
Developer Defenses to MFA |
|
|
270 | (1) |
|
User Defenses to Social Engineering Attacks |
|
|
271 | (2) |
|
|
273 | (2) |
|
13 Downgrade/Recovery Attacks |
|
|
275 | (20) |
|
|
275 | (1) |
|
Example Downgrade/Recovery Attacks |
|
|
276 | (11) |
|
Alternate Email Address Recovery |
|
|
276 | (4) |
|
|
280 | (1) |
|
Guessing Personal-Knowledge Questions |
|
|
281 | (6) |
|
Defenses to Downgrade/Recovery Attacks |
|
|
287 | (7) |
|
Developer Defenses to Downgrade/Recovery Attacks |
|
|
287 | (5) |
|
User Defenses to Downgrade/Recovery Attacks |
|
|
292 | (2) |
|
|
294 | (1) |
|
|
295 | (12) |
|
|
295 | (3) |
|
|
296 | (1) |
|
Brute-Force Attack Methods |
|
|
297 | (1) |
|
Example of Brute-Force Attacks |
|
|
298 | (3) |
|
OTP Bypass Brute-Force Test |
|
|
298 | (1) |
|
Instagram MFA Brute-Force |
|
|
299 | (1) |
|
Slack MFA Brute-Force Bypass |
|
|
299 | (1) |
|
|
300 | (1) |
|
Crab Android MFA Brute-Force |
|
|
300 | (1) |
|
Unlimited Biometric Brute-Forcing |
|
|
300 | (1) |
|
Defenses Against Brute-Force Attacks |
|
|
301 | (5) |
|
Developer Defenses Against Brute-Force Attacks |
|
|
301 | (4) |
|
User Defenses Against Brute-Force Attacks |
|
|
305 | (1) |
|
|
306 | (1) |
|
|
307 | (18) |
|
|
307 | (10) |
|
Common Types of Vulnerabilities |
|
|
308 | (8) |
|
|
316 | (1) |
|
Examples of Vulnerability Attacks |
|
|
317 | (4) |
|
|
317 | (1) |
|
Google Authenticator Vulnerability |
|
|
318 | (1) |
|
|
318 | (1) |
|
Multiple RSA Vulnerabilities |
|
|
318 | (1) |
|
|
319 | (1) |
|
|
319 | (1) |
|
|
320 | (1) |
|
Defenses to Vulnerability Attacks |
|
|
321 | (2) |
|
Developer Defenses Against Vulnerability Attacks |
|
|
321 | (1) |
|
User Defenses Against Vulnerability Attacks |
|
|
322 | (1) |
|
|
323 | (2) |
|
16 Attacks Against Biometrics |
|
|
325 | (32) |
|
|
325 | (1) |
|
|
326 | (13) |
|
Common Biometric Authentication Factors |
|
|
327 | (10) |
|
|
337 | (2) |
|
Problems with Biometric Authentication |
|
|
339 | (6) |
|
|
340 | (4) |
|
|
344 | (1) |
|
|
345 | (1) |
|
Example Biometric Attacks |
|
|
345 | (7) |
|
|
345 | (3) |
|
|
348 | (1) |
|
Eye Biometric Spoof Attacks |
|
|
348 | (1) |
|
Facial Recognition Attacks |
|
|
349 | (3) |
|
Defenses Against Biometric Attacks |
|
|
352 | (3) |
|
Developer Defenses Against Biometric Attacks |
|
|
352 | (2) |
|
User/Admin Defenses Against Biometric Attacks |
|
|
354 | (1) |
|
|
355 | (2) |
|
|
357 | (20) |
|
|
357 | (5) |
|
Types of Physical Attacks |
|
|
357 | (5) |
|
|
362 | (8) |
|
Smartcard Side-Channel Attack |
|
|
362 | (2) |
|
Electron Microscope Attack |
|
|
364 | (1) |
|
|
365 | (2) |
|
Snooping On RFID-Enabled Credit Cards |
|
|
367 | (3) |
|
|
370 | (1) |
|
Defenses Against Physical Attacks |
|
|
370 | (5) |
|
Developer Defenses Against Physical Attacks |
|
|
371 | (1) |
|
User Defenses Against Physical Attacks |
|
|
372 | (3) |
|
|
375 | (2) |
|
|
377 | (22) |
|
|
377 | (11) |
|
|
378 | (4) |
|
|
382 | (1) |
|
|
382 | (6) |
|
Example Namespace Hijacking Attacks |
|
|
388 | (5) |
|
|
388 | (1) |
|
|
388 | (1) |
|
|
389 | (1) |
|
|
390 | (1) |
|
|
390 | (2) |
|
|
392 | (1) |
|
|
392 | (1) |
|
Defenses Against Namespace Hijacking Attacks |
|
|
393 | (4) |
|
|
394 | (1) |
|
|
395 | (2) |
|
|
397 | (2) |
|
|
399 | (26) |
|
|
399 | (15) |
|
Common Authentication Standards and Protocols Involving APIs |
|
|
402 | (9) |
|
Other Common API Standards and Components |
|
|
411 | (3) |
|
|
414 | (6) |
|
|
414 | (1) |
|
Bypassing PayPal 2FA Using an API |
|
|
415 | (1) |
|
|
416 | (1) |
|
Authy API Format Injection |
|
|
417 | (1) |
|
Duo API As-Designed MFA Bypass |
|
|
417 | (2) |
|
|
419 | (1) |
|
Sign In with Apple MFA Bypass |
|
|
419 | (1) |
|
Token TOTP BLOB Future Attack |
|
|
420 | (1) |
|
Defenses Against API Abuses |
|
|
420 | (3) |
|
Developer Defenses Against API Abuses |
|
|
420 | (2) |
|
User Defenses Against API Abuses |
|
|
422 | (1) |
|
|
423 | (2) |
|
20 Miscellaneous MFA Hacks |
|
|
425 | (6) |
|
Amazon Mystery Device MFA Bypass |
|
|
425 | (1) |
|
Obtaining Old Phone Numbers |
|
|
426 | (1) |
|
|
427 | (1) |
|
Password Reset MFA Bypass |
|
|
427 | (1) |
|
|
427 | (1) |
|
Keyboard Acoustic Eavesdropping |
|
|
428 | (1) |
|
|
428 | (1) |
|
|
429 | (1) |
|
|
429 | (1) |
|
Hackers Turn MFA to Defeat You |
|
|
430 | (1) |
|
|
430 | (1) |
|
21 Test: Can You Spot the Vulnerabilities? |
|
|
431 | (22) |
|
Threat Modeling MFA Solutions |
|
|
431 | (5) |
|
Document and Diagram the Components |
|
|
432 | (1) |
|
Brainstorm Potential Attacks |
|
|
432 | (2) |
|
Estimate Risk and Potential Losses |
|
|
434 | (2) |
|
Create and Test Mitigations |
|
|
436 | (1) |
|
|
436 | (1) |
|
Introducing the Bloomberg MFA Device |
|
|
436 | (3) |
|
Bloomberg, L.P. and the Bloomberg Terminal |
|
|
437 | (1) |
|
New User B-Unit Registration and Use |
|
|
438 | (1) |
|
Threat-Modeling the Bloomberg MFA Device |
|
|
439 | (11) |
|
Threat-Modeling the B-Unit in a General Example |
|
|
440 | (1) |
|
Specific Possible Attacks |
|
|
441 | (9) |
|
Multi-Factor Authentication Security Assessment Tool |
|
|
450 | (1) |
|
|
451 | (2) |
|
|
453 | (68) |
|
22 Designing a Secure Solution |
|
|
455 | (18) |
|
|
455 | (2) |
|
Exercise: Secure Remote Online Electronic Voting |
|
|
457 | (14) |
|
|
457 | (1) |
|
|
458 | (2) |
|
|
460 | (1) |
|
Physical Design and Defenses |
|
|
461 | (1) |
|
|
462 | (1) |
|
Provisioning/Registration |
|
|
463 | (1) |
|
Authentication and Operations |
|
|
464 | (2) |
|
Verifiable/Auditable Vote |
|
|
466 | (1) |
|
|
467 | (1) |
|
Backend Blockchain Ledger |
|
|
467 | (3) |
|
Migration and Deprovisioning |
|
|
470 | (1) |
|
|
470 | (1) |
|
|
470 | (1) |
|
Security Awareness Training |
|
|
470 | (1) |
|
|
471 | (1) |
|
|
471 | (2) |
|
23 Selecting the Right MFA Solution |
|
|
473 | (20) |
|
|
473 | (3) |
|
The Process for Selecting the Right MFA Solution |
|
|
476 | (15) |
|
|
477 | (1) |
|
|
478 | (1) |
|
|
479 | (1) |
|
Determine What Needs to Be Protected |
|
|
479 | (1) |
|
Choose Required and Desired Features |
|
|
480 | (8) |
|
Research/Select Vendor Solutions |
|
|
488 | (2) |
|
|
490 | (1) |
|
|
491 | (1) |
|
|
491 | (1) |
|
|
491 | (2) |
|
24 The Future of Authentication |
|
|
493 | (16) |
|
Cyber Crime Is Here to Stay |
|
|
493 | (1) |
|
|
494 | (4) |
|
Increasing Sophisticated Automation |
|
|
495 | (1) |
|
Increased Nation-State Attacks |
|
|
496 | (1) |
|
|
497 | (1) |
|
Automated Attacks Against MFA |
|
|
497 | (1) |
|
|
498 | (3) |
|
|
498 | (1) |
|
|
498 | (1) |
|
Preregistration of Sites and Devices |
|
|
499 | (1) |
|
|
500 | (1) |
|
|
501 | (1) |
|
Changing/Morphing Standards |
|
|
501 | (1) |
|
|
501 | (5) |
|
|
502 | (1) |
|
Continuous, Adaptive, Risk-Based |
|
|
503 | (3) |
|
Quantum-Resistant Cryptography |
|
|
506 | (1) |
|
Interesting Newer Authentication Ideas |
|
|
506 | (1) |
|
|
507 | (2) |
|
|
509 | (12) |
|
|
509 | (7) |
|
|
509 | (1) |
|
|
510 | (1) |
|
|
510 | (1) |
|
Security Isn't Everything |
|
|
511 | (1) |
|
Every MFA Solution Has Trade-Offs |
|
|
511 | (1) |
|
Authentication Does Not Exist in a Vacuum |
|
|
512 | (3) |
|
There Is No Single Best MFA Solution for Everyone |
|
|
515 | (1) |
|
There Are Better MFA Solutions |
|
|
515 | (1) |
|
|
516 | (5) |
|
Developer Defense Summary |
|
|
516 | (2) |
|
|
518 | (3) |
Appendix: List of MFA Vendors |
|
521 | (6) |
Index |
|
527 | |