New Android Malware Can Get Past Two-Factor Authentication

March 11, 2020

Written by wukovits

new android malware can get past two factor authenticationSince 2010, Google has been doing its part to help keep its massive user base safe. They introduced a small but critical service called Google Authenticator, which is used by a number of online accounts as a two-factor authentication layer.

Google launched the service as an alternative to SMS-based one-time pass codes.

While SMS-based codes are better than nothing, they are the lowest common denominator in the world of 2FA, and are problematic for a number of different reasons. The main advantage Authenticator has over its SMS counterpart is that Authenticator’s randomly generated codes are contained within the user’s device itself, and never travel through insecure mobile networks.

Although Authenticator generated codes are widely regarded as being superior to SMS-based codes in terms of overall security, they’re certainly not invulnerable, as hackers have recently proved. Researchers from ThreatFabric recently announced that they’ve spotted a new strain of the Cerberus Trojan in the wild that is capable of stealing 2FA codes generated via the Authenticator application.

If there’s a silver lining in the research team’s findings, it is the fact that the strains they’ve uncovered seem to be test versions of the Trojan That means the new capabilities aren’t yet widely available. Unfortunately, it’s just a matter of time before the new strain is out of testing and starts seeing widespread use.

All that to say, that this is a serious threat. Be sure your employees are aware of the risks and dangers. Too often, people get comfortable after enabling 2FA and develop a false sense of security thinking that they’re essentially invulnerable.

They aren’t. No one is. While this is the first piece of malware we’ve seen that can counter 2FA, it certainly won’t be the last. Stay vigilant. It’s going to be a tough year on the security front.

Used with permission from Article Aggregator

Bayou Tech

We provide solutions for your business. Find out how we can help.

Related Articles

The Ultimate VoIP Q&A Guide

Looking to improve your business communications? Here’s our ultimate VoIP guide. Find out how VoIP phones can improve your business today!

Key Considerations for Effective Cybersecurity Implementation

Consider this: In the realm of cybersecurity, things often get tangled in the web of "you should do it anyway" arguments. Yet, for busy business owners bombarded with daily "must-dos," deciphering the essentials from the fluff can feel like a cyber maze. We aim to...