Trending...
- Los Angeles County Now Distributing Vote by Mail Ballots to Registered Voters in Long Beach - 1224
- Afresh Enhances Supply Chain Capabilities with the Launch of Afresh DC Forecasts, Partnering with Albertsons Companies as the First Customer
- Nuvve Unveils Groundbreaking AC V2G Technology at Exelon Event, Leveraging SAE J3068/2
SILVER SPRING, Md. - Californer -- Silent Sector, a leading cybersecurity firm specializing in protecting mid-market businesses, has discovered a major flaw in the two-factor authentication (2FA) enrollment process that could leave millions of organizations vulnerable to cyberattacks. The vulnerability lies in the use of QR codes for 2FA, a common security practice across industries, and poses an urgent threat to the security of organizations that rely on this method to protect sensitive accounts.
The vulnerability Silent Sector identified is related to the secret key embedded in QR codes used for 2FA enrollment. When users scan a QR code to link their authentication apps, such as Google Authenticator or Microsoft Authenticator, to access their accounts, the secret key that allows this link never expires. This creates a critical security risk: if a QR code was sent via email, saved to a device, or stored in a repository, hackers could potentially access that code, re-enroll in the 2FA process, and bypass account security measures.
"Many organizations trust QR codes as part of their authentication systems, but this discovery shows a significant gap in security," said Lauro Chavez, Partner and Head of Research at Silent Sector. "The issue is that these QR codes, and the secret keys they contain, can be reused indefinitely. That's a massive risk if they fall into the wrong hands."
More on The Californer
The Scale of the Threat
Two-factor authentication, or 2FA, is widely used by businesses and individuals to add an extra layer of security to account logins. The process typically requires users to enter not just a password but also a one-time passcode (OTP), which is generated by an authentication app on a user's phone. This is typically performed after enrolling in the multi-factor authentication process. This process is frequently enabled by scanning a QR code during the initial setup.
Indeed, for the better part of a decade, QR code-based 2FA has been considered a highly secure method because it was believed that the secret key embedded in the code expired after the initial setup. However, Silent Sector's discovery reveals that this is not the case. The secret key embedded in the QR code remains valid indefinitely, allowing a malicious actor to use it to re-enroll and gain access to accounts even if the original user is unaware.
"This vulnerability has the potential to impact millions of businesses worldwide, especially those in the mid-market, which may not have the resources or expertise to deal with such sophisticated threats," Chavez explained. "The ability to reuse these codes without expiration is particularly concerning, as many organizations may not even realize the risk."
To read the remainder of the interview, please visit:
https://bit.ly/3zEuqTs
The vulnerability Silent Sector identified is related to the secret key embedded in QR codes used for 2FA enrollment. When users scan a QR code to link their authentication apps, such as Google Authenticator or Microsoft Authenticator, to access their accounts, the secret key that allows this link never expires. This creates a critical security risk: if a QR code was sent via email, saved to a device, or stored in a repository, hackers could potentially access that code, re-enroll in the 2FA process, and bypass account security measures.
"Many organizations trust QR codes as part of their authentication systems, but this discovery shows a significant gap in security," said Lauro Chavez, Partner and Head of Research at Silent Sector. "The issue is that these QR codes, and the secret keys they contain, can be reused indefinitely. That's a massive risk if they fall into the wrong hands."
More on The Californer
- Dark Truth Behind Targeted Violence
- Composer Andrew Prahlow to Perform Award-Winning Outer Wilds Soundtrack on Oct 17th at Brooklyn's Music Hall of Williamsburg
- All aboard! More clean buses and trains coming to California's communities most affected by pollution
- SolarTech Celebrates Grand Opening of Phoenix Facility with Ribbon Cutting Ceremony
- Are California Insurance Tax Hikes Good for Uninsurable Homes?
The Scale of the Threat
Two-factor authentication, or 2FA, is widely used by businesses and individuals to add an extra layer of security to account logins. The process typically requires users to enter not just a password but also a one-time passcode (OTP), which is generated by an authentication app on a user's phone. This is typically performed after enrolling in the multi-factor authentication process. This process is frequently enabled by scanning a QR code during the initial setup.
Indeed, for the better part of a decade, QR code-based 2FA has been considered a highly secure method because it was believed that the secret key embedded in the code expired after the initial setup. However, Silent Sector's discovery reveals that this is not the case. The secret key embedded in the QR code remains valid indefinitely, allowing a malicious actor to use it to re-enroll and gain access to accounts even if the original user is unaware.
"This vulnerability has the potential to impact millions of businesses worldwide, especially those in the mid-market, which may not have the resources or expertise to deal with such sophisticated threats," Chavez explained. "The ability to reuse these codes without expiration is particularly concerning, as many organizations may not even realize the risk."
To read the remainder of the interview, please visit:
https://bit.ly/3zEuqTs
Source: Silent Sector
Filed Under: Technology
0 Comments
Latest on The Californer
- SlashNext Selected as Finalist in 2024 Top InfoSec Innovator Awards
- U.S. Fastener Import & Trading Co. Partners with Mizumoto Machine Mfg. Co., Ltd. for U.S. Expansion
- Blue Ridge Partners Hires Tech Leader Kyle Heller as Managing Director
- Shuddersome: Tales of Poe at Theatre School @ North Coast Rep
- UPDATED-Kadima Day School to Host October 7th Memorial Event in Remembrance and Reflection
- California deploys Urban Search and Rescue Task Force teams ahead of Hurricane Milton
- THINKWARE Announces Amazon Prime Big Deal Days Dash Cam Specials
- New Short-Term Care Insurance Has Some Attractive Features
- City Expands Local Preference Program for Procurements to Enhance Opportunities for Long Beach Businesses
- KENDALL-JACKSON OFFERS TRIP TO NBA ALL-STAR 2025 IN NATIONAL SWEEPSTAKES
- Hypothesis by Richard H. Davis: Carrier Pigeons and Milk Immunity
- VSA Officially Receives SOC 2 Approval
- Kadima Day School to Host October 7th Memorial Event in Remembrance and Reflection
- TVS Tavern TV Network on WatchYour.TV Goes Old School With Vintage Wrestling and Roller Derby
- California takes bold step to revolutionize youth sports with 25×25 Coaches Challenge
- Martial Arts Icon Cynthia Rothrock Premieres Her Latest Film Black Creek
- California: Governor Newsom statement marking one year since Hamas attack on Israel
- Vantiva and Harmonic Partner to Offer Service Providers Easy Transition from DOCSIS to Fiber-based PON Technologies
- CCHR Demands Justice for Victims of Psychiatric Fraud and Patient Sexual Abuse
- First World Chronic Cough Day October 15, 2024