Mind your SMSes: Mitigating social engineering in second factor authentication

Abstract

SMS-based second factor authentication is a cornerstone for many service providers, ranging from email service providers and social networks to financial institutions and online marketplaces. Attackers have not been slow to capitalize on the vulnerabilities of this mechanism by using social engineering techniques to coerce users to forward authentication codes. We demonstrate one social engineering attack for which we experimentally obtained a 50% success rate against Google's SMS-based authentication. At the heart of the problem is the messaging associated with the authentication code, and how this must not have been developed with security against social engineering in mind. Pursuing a top-down methodology, we generate alternative messages and experimentally test these against an array of social engineering attempts. Our most robust messaging approach reduces the success of the most effective social engineering attack to 8%, or a sixth of its success against Google's standard second factor verification code messages.

Contemplating social engineering studies and attack scenarios: A review study

“…This factor of social proof is misused by the social engineers to attain the desired goal Commitment 8,10,14,23 If people agree, to an intention or aim, they are most likely to complete that commitment as people think by not fulfilling this will affect on the self-image Reciprocation 10,14,23,24 Generally, people return a favor. This type of human factor is manipulated when some inside social engineer needs some crucial information Human need and greed 5,10,28 People are vulnerable to what they need and greed. Social engineers carefully access their dreams, needs, and greed and use that information to achieve the target Friendship 8,24 People tend to perform particular action or favor if his/her friend or relative requests that.…”

“…While the victim is distracted, the social engineer can gather information what they want. For example, spilling a glass of water and make victim move out of a room Curiosity 4,5,15 Human by nature is curious. Social engineers misuse this human ability of curiosity in many ways, some of them are by sending phished emails or infected files with a curious title.…”

“…Deceptive principle 7,28 Generally, people are not what they show. Social engineers use this factor quite frequently and have the ability to deceive the victim easily and make them believe what they say Fear 5 Fear of the unknown is one of the important factors which social engineers use. For example, Social Engineer impersonates as boss and asks to perform specific actions.…”

“…In case of time pressure, as there is less time to consult and a person is expected to respond quickly, this factor is used by the social engineers. By putting victim under time pressure and make him not think rationale Diffusion of responsibility 5 A person in less likely to take responsibility for work in which others are present by assuming others responsible for work Lying 22 Person under certain pressure, situation, or fear may speak lie Laziness 15 A person is thought to be lazy if he can perform a particular task but do not perform as an effort is involved in it Natural inclination to help 23 By nature people help others who are in need of assistance T A B L E 4 Various theories and concepts used in literature to relate social engineering activities…”

Evaluation of Out-of-Band Channels for IoT Security

“…Users must have access to a registered smartphone in addition to the typical user ID and password information for logging into an online service that uses OTPs. SMS is used by many banks, online stores, and social networks [36] for sending OTPs. However, in some cases, the way these methods are implemented does not protect against phishing and man-in-the-middle (MITM) attacks.…”