Hackers Beat Two-Factor Authentication, Breaking Into Gmail Accounts And More

Dhir Acharya - Dec 22, 2018

Using phishing attacks, hackers can break two-factor authentication and steal your mail accounts.

It seems like no matter what kind of protection companies implement, hackers find their way to sneak in. Or to speak it in another way, companies have continually failed to protect their users from hackers. Among the latest attempts to prevent hackers from stealing user accounts, 2FA, aka two-factor authentication, has been implemented. This method requires users to register their phone numbers so that when they log in their accounts, after providing the passwords, users will receive an authentication code on their phone which they have to type in.

The 2FA used double checks to make sure you are the actual owner of the account that can access his or her phone all the time. People consider this as one of the most reliable ways to protect account since even when hackers have got your password, they still can’t get in your account without your phone.

However, what if hackers come up with a way to even beat that two-factor authentication method? We’re not asking this question just in case, we ask because it did happen. And hackers surpassed 2FA by phishing attacks.

As stated by NSA, it’s not strange that hackers can beat 2FA, what’s new here is how they do it. Accordingly, hackers firstly obtain your username and password with phishing, then they make the request for two-factor authentication on behalf of you and ask you to provide the authentication code to break into your account.

The report from NSA also said that has made this process automatic, creating a fake login page used for email services like ProtonMail, Yahoo Mail, Gmail, etc. This means hackers can hack into your mail accounts without even touching the computer or lifting their hands at all. Apparently, two-factor authentication does not look so protective when it comes to high-level hackers.

According to the report, this hacking method has affected over a thousand Yahoo and Google accounts. In some attacks, user are even asked to enter their mobile numbers for confirmation before requesting 2FA key. Also, the phishing tool creates separate passwords that allow third-party applications to access to the account.

Hackers have also used services like ShuttleCloud to create clones of Yahoo accounts with different Gmail IDs.

NSA advised users to use hardware-based security keys to avoid phishing attacks.