VMware 2FA flaw can divulge that vital second credential to malicious actors VMware has warned users a flaw in its VMware Verify two-factor authentication product could allow a malicious actor with a first-factor authentication credential to obtain a second factor from its VMware Verify product. CVE-2021-22057 is the rascal behind this issue and is rated 6.6/10. VMware Verify is part of the wider …
We keep being told that two-factor authentication is a required "upgrade" but while it makes life slightly harder for malicious attackers it does make the parties we work with far too confident that an attacker is the real person when they complete the authentication. Effectively two-factor authentication is a feature that has a few advantages but does not guarantee anything. So it often makes the attacks far more expensive for the two-factor authentication users.
2FA is a broad category. As such, many claims can be made of merits and demerits. Using SMS for 2FA is only slightly better than just password authentication. Using a U2F hardware token is leaps and bounds better. Implementation of any 2FA is critical to it's success or failure as well.
False sense of security is always an issue when security things are overhyped.
Timing... An example of 2FA by SMS appeared this morning on my new-tab page's random news blurt:
SIM swapping is not the only attack against SMS. You also have number hijacking and SS7 attacks.
If only password authentication was being used, then no SIM swap would have been needed. But if an implementation of password reset by SMS is in effect, then it no longer is a second factor. Single factor authentication by SMS is worse than password authentication. This is a perfect implementation flaw example.
In the story you linked, it does not have enough detail of the various services' I&A schemes. I cannot determine if the SMS was a true 2FA or used as a password reset mechanism.
In the US NIST had depricated SMS as 2FA over a decade ago. But for some odd reason they added it back quietly in their recommendations for 2FA.
I stand by my statement. As a true properly implemented 2FA, SMS is only slightly better than single factor password.
I resist SMS 2FA as much as possible. I have a hardware token, but few service providers support 2FA or only SMS 2FA, or some do support TOTP, only about half a dozen I use support hardware token 2FA out of nearly a thousand accounts I have.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
