Trending...
- Maryland Horse Industry Board (MHIB) Meeting Notice
- Grand opening of the ResC4EU platform to support companies withstanding supply chain disruptions
- Maryland:
SILVER SPRING, Md. - Marylandian -- Silent Sector, a leading cybersecurity firm specializing in protecting mid-market businesses, has discovered a major flaw in the two-factor authentication (2FA) enrollment process that could leave millions of organizations vulnerable to cyberattacks. The vulnerability lies in the use of QR codes for 2FA, a common security practice across industries, and poses an urgent threat to the security of organizations that rely on this method to protect sensitive accounts.
The vulnerability Silent Sector identified is related to the secret key embedded in QR codes used for 2FA enrollment. When users scan a QR code to link their authentication apps, such as Google Authenticator or Microsoft Authenticator, to access their accounts, the secret key that allows this link never expires. This creates a critical security risk: if a QR code was sent via email, saved to a device, or stored in a repository, hackers could potentially access that code, re-enroll in the 2FA process, and bypass account security measures.
"Many organizations trust QR codes as part of their authentication systems, but this discovery shows a significant gap in security," said Lauro Chavez, Partner and Head of Research at Silent Sector. "The issue is that these QR codes, and the secret keys they contain, can be reused indefinitely. That's a massive risk if they fall into the wrong hands."
More on Marylandian
The Scale of the Threat
Two-factor authentication, or 2FA, is widely used by businesses and individuals to add an extra layer of security to account logins. The process typically requires users to enter not just a password but also a one-time passcode (OTP), which is generated by an authentication app on a user's phone. This is typically performed after enrolling in the multi-factor authentication process. This process is frequently enabled by scanning a QR code during the initial setup.
Indeed, for the better part of a decade, QR code-based 2FA has been considered a highly secure method because it was believed that the secret key embedded in the code expired after the initial setup. However, Silent Sector's discovery reveals that this is not the case. The secret key embedded in the QR code remains valid indefinitely, allowing a malicious actor to use it to re-enroll and gain access to accounts even if the original user is unaware.
"This vulnerability has the potential to impact millions of businesses worldwide, especially those in the mid-market, which may not have the resources or expertise to deal with such sophisticated threats," Chavez explained. "The ability to reuse these codes without expiration is particularly concerning, as many organizations may not even realize the risk."
To read the remainder of the interview, please visit:
https://bit.ly/3zEuqTs
The vulnerability Silent Sector identified is related to the secret key embedded in QR codes used for 2FA enrollment. When users scan a QR code to link their authentication apps, such as Google Authenticator or Microsoft Authenticator, to access their accounts, the secret key that allows this link never expires. This creates a critical security risk: if a QR code was sent via email, saved to a device, or stored in a repository, hackers could potentially access that code, re-enroll in the 2FA process, and bypass account security measures.
"Many organizations trust QR codes as part of their authentication systems, but this discovery shows a significant gap in security," said Lauro Chavez, Partner and Head of Research at Silent Sector. "The issue is that these QR codes, and the secret keys they contain, can be reused indefinitely. That's a massive risk if they fall into the wrong hands."
More on Marylandian
- State of Nayarit Named the Official Mexican Tourism Destination of the Vancouver Canucks
- ProtectVirginia Petitions Virginia Dept of Environmental Quality for Cruise Ship Regulations
- Campaign for Kindness: Floris UMC is bringing back respect, humility, and compassion this election season
- Situ Ve Offers a New Perspective on Love Amid the Rising Passport Bro Movement
- Scout & Cellar Becomes First Winery in Texas to Receive B Corp Certification
The Scale of the Threat
Two-factor authentication, or 2FA, is widely used by businesses and individuals to add an extra layer of security to account logins. The process typically requires users to enter not just a password but also a one-time passcode (OTP), which is generated by an authentication app on a user's phone. This is typically performed after enrolling in the multi-factor authentication process. This process is frequently enabled by scanning a QR code during the initial setup.
Indeed, for the better part of a decade, QR code-based 2FA has been considered a highly secure method because it was believed that the secret key embedded in the code expired after the initial setup. However, Silent Sector's discovery reveals that this is not the case. The secret key embedded in the QR code remains valid indefinitely, allowing a malicious actor to use it to re-enroll and gain access to accounts even if the original user is unaware.
"This vulnerability has the potential to impact millions of businesses worldwide, especially those in the mid-market, which may not have the resources or expertise to deal with such sophisticated threats," Chavez explained. "The ability to reuse these codes without expiration is particularly concerning, as many organizations may not even realize the risk."
To read the remainder of the interview, please visit:
https://bit.ly/3zEuqTs
Source: Silent Sector
Filed Under: Technology
0 Comments
Latest on Marylandian
- Maryland Agriculture Secretary Appoints Dr. Jennifer Trout as State Veterinarian
- eCaregivers Launches First-Ever Consumer-Driven Senior Care Platform for Private-Pay Home Care Offering Affordable, Full-Service Agency Experience
- Enhancing CMMC Compliance with ADS' Blade Validate: A Strategic Collaboration with KDM Analytics
- Sidow Sobrino's My Amir in the Running for GRAMMY® Nominations
- SUGAR SKULL! – A Día de Muertos Musical Adventure Comes to the Weinberg Center
- Advancing Health Equity: BWISE to Host Biomedical Innovation Networking Event during the 2024 Biomedical Engineering Society (BMES) Annual Conference
- Reliance Aerotech Inc. Announces Appointment Of Ron Jordan To Chief Strategy Officer
- Stop Fighting, Start Living. Daryl Dittmer's New Book Offers Roadmap to Personal Power
- Akram Opens Doors in Maryland, Strengthening East Coast Presence
- RestoreFast Expands Services to Meet the Growing Demand for Water Damage Restoration
- NEW SURVEY FROM TRUE LEMON® KIDS REVEALS THE IMPORTANCE OF HYDRATION DURING THE SCHOOL YEAR
- Classic Albums Live Bring Pink Floyd's "Wish You Were Here" to the Weinberg Stage
- Maryland: Small Equine and Livestock Operations Now Eligible for Conservation Funding
- Governor Wes Moore Declares September 30 – October 4 Maryland Homegrown School Lunch Week
- Maryland's Best Rolls Out Year Two of "Take A Bite of Maryland"- featuring Apple Buddy!
- Breakthrough Women in Science & Medicine series addresses breast cancer and dense breast tissue with Dr. Rachel Brem
- IGC Pharma Wins 2 Awards in Phase 1 of NIA's AI PREPARE Challenge, Advancing Alzheimer's Early Prediction Research
- Get in the Halloween Spirit at Rare Books LA Union Station
- Superior Thin Film Solar Panel Advancements Open Great Opportunities in the Rapidly Developing Aerospace and Related Sectors: Stock Symbol: ASTI