Hacking mobile login tokens tricky but doable, says reverse-engineer
L33tdawg: The slides and whitepaper from Bernhard's #HITBGSEC talk is available here: http://gsec.hitb.org/sg2016/sessions/attacking-software-tokens/
Mobile apps that generate on-screen tokens for two-factor authentication can be examined and cloned by malware, a security researcher warns.
Fraudsters and crooks can take these clones and generate the codes necessary to login into bank accounts and other online services as their victims.
Banks are increasingly relying on these soft tokens to authenticate users, but the smartphone-based technology introduces new risk compared to traditional hardware tokens. The effort required for creating a cloning tool depends on the quality of reverse engineering defenses, according to security researcher Bernhard Mueller, director of Vantage Point Security. Hacking widely used versions of mobile two-factor authentication (2FA) technology is far from easy, but nonetheless possible for a skilled and resourceful attacker.
