Two-factor authentication (2FA) with the use of one-time passwords (OTPs) is now often seen as a cure-all against phishing, social engineering, account theft, and other cyber-maladies. By requesting an OTP at login, the service in question provides an additional protective layer of user verification. The code can be generated in a special app directly on the user’s device, … [Read more...] about When two-factor authentication is useless
TwoFactor
Cyber Actors Bypassing Two-Factor Authentication Implementations
On March 15, 2022, a government flash bulletin was published describing how state-sponsored cyber actors were able to use the PrintNightmare vulnerability (CVE-2021-34527) in addition to bypassing Duo 2FA to compromise an unpatched Windows machine and gain administrative privileges. This scenario did not leverage or reveal a vulnerability in Duo software or infrastructure, but … [Read more...] about Cyber Actors Bypassing Two-Factor Authentication Implementations