How Google Authenticator made one company’s network breach much, much worse

A safety firm is asking out a characteristic in Google’s authenticator app that it says made a latest inside network breach much worse.

Retool, which helps prospects safe their software program growth platforms, made the criticism on Wednesday in a publish disclosing a compromise of its buyer assist system. The breach gave the attackers accountable entry to the accounts of 27 prospects, all within the cryptocurrency business. The assault began when a Retool worker clicked a hyperlink in a textual content message purporting to return from a member of the company’s IT staff.

“Dark patterns”

It warned that the worker could be unable to take part within the company’s open enrollment for well being care protection till an account challenge was mounted. The textual content arrived whereas Retool was within the strategy of transferring its login platform to safety firm Okta. (Okta itself disclosed the breach of one of its third-party buyer assist engineers final yr and the compromise of 4 of its prospects’ Okta superuser accounts this month, however Wednesday’s notification made no point out of both occasion.)

Most of the focused Retool workers took no motion, however one logged in to the linked web site and, based mostly on the wording of the poorly written disclosure, presumably supplied each a password and a short lived one-time password, or TOTP, from Google authenticator.

Shortly afterward, the worker obtained a cellphone name from somebody who claimed to be an IT staff member and had familiarity with the “floor plan of the office, coworkers, and internal processes of our company.” During the decision, the worker supplied an “additional multi-factor code.” It was at this level, the disclosure contended, {that a} sync characteristic Google added to its authenticator in April magnified the severity of the breach as a result of it allowed the attackers to compromise not simply the worker’s account however a number of different firm accounts as nicely.

“The additional OTP token shared over the call was critical, because it allowed the attacker to add their own personal device to the employee’s Okta account, which allowed them to produce their own Okta MFA from that point forward,” Retool head of engineering Snir Kodesh wrote. “This enabled them to have an active GSuite session on that device. Google recently released the Google Authenticator synchronization feature that syncs MFA codes to the cloud. As Hacker News noted, this is highly insecure, since if your Google account is compromised, so now are your MFA codes.”

The publish is unclear on quite a lot of issues. For occasion, by “OTP token,” did Kodesh imply a one-time password returned by Google authenticator, the lengthy string of numbers that types the cryptographic seed used to generate OTPs, or one thing else fully? In an electronic mail looking for clarification, Kodesh declined to remark, citing an ongoing investigation by regulation enforcement.