{"product_id":"hacking-multifactor-authentication-9781119650799","title":"Hacking Multifactor Authentication","description":"\u003cb\u003eBook Synopsis\u003c\/b\u003e\u003cbr\u003eProtect your organization from scandalously easy-to-hack MFA security solutions Multi-Factor Authentication (MFA) isspreading like wildfire across digital environments.However, hundreds of millions of dollars have been stolen from MFA-protected online accounts.How?Mostpeoplewho usemultifactor authentication (MFA)have been told thatitis far less hackablethan other types of authentication, or eventhat it isunhackable. You might beshocked to learnthatall MFA solutions areactuallyeasyto hack.That's right: there is noperfectlysafe MFA solution.In fact, most can be hacked at leastfivedifferent ways.Hacking Multifactor Authenticationwillshow youhow MFA works behind the scenes and how poorlylinkedmulti-stepauthentication steps allowsMFA to be hacked and compromised. Thisbook coversovertwodozenwaysthatvarious MFA solutions can be hacked, including the methods (and defenses) common to all MFA solutions.You'll learn about thevarious types of MFA solutions, their strengthens and weaknesses, andhow\u003cbr\u003e\u003cbr\u003e\u003cb\u003eTable of Contents\u003c\/b\u003e\u003cbr\u003e\u003cp\u003e\u003cb\u003eIntroduction xxv\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eWho This Book is For xxvii\u003c\/p\u003e \u003cp\u003eWhat is Covered in This Book? xxvii\u003c\/p\u003e \u003cp\u003eMFA is Good xxx\u003c\/p\u003e \u003cp\u003eHow to Contact Wiley or the Author xxxi\u003c\/p\u003e \u003cp\u003e\u003cb\u003ePart I Introduction 1\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003e\u003cb\u003e1 \u003c\/b\u003e\u003cb\u003eLogon Problems 3\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIt’s Bad Out There 3\u003c\/p\u003e \u003cp\u003eThe Problem with Passwords 5\u003c\/p\u003e \u003cp\u003ePassword Basics 9\u003c\/p\u003e \u003cp\u003eIdentity 9\u003c\/p\u003e \u003cp\u003eThe Password 10\u003c\/p\u003e \u003cp\u003ePassword Registration 11\u003c\/p\u003e \u003cp\u003ePassword Complexity 11\u003c\/p\u003e \u003cp\u003ePassword Storage 12\u003c\/p\u003e \u003cp\u003ePassword Authentication 13\u003c\/p\u003e \u003cp\u003ePassword Policies 15\u003c\/p\u003e \u003cp\u003ePasswords Will Be with Us for a While 18\u003c\/p\u003e \u003cp\u003ePassword Problems and Attacks 18\u003c\/p\u003e \u003cp\u003ePassword Guessing 19\u003c\/p\u003e \u003cp\u003ePassword Hash Cracking 23\u003c\/p\u003e \u003cp\u003ePassword Stealing 27\u003c\/p\u003e \u003cp\u003ePasswords in Plain View 28\u003c\/p\u003e \u003cp\u003eJust Ask for It 29\u003c\/p\u003e \u003cp\u003ePassword Hacking Defenses 30\u003c\/p\u003e \u003cp\u003eMFA Riding to the Rescue? 31\u003c\/p\u003e \u003cp\u003eSummary 32\u003c\/p\u003e \u003cp\u003e\u003cb\u003e2 \u003c\/b\u003e\u003cb\u003eAuthentication Basics 33\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eAuthentication Life Cycle 34\u003c\/p\u003e \u003cp\u003eIdentity 35\u003c\/p\u003e \u003cp\u003eAuthentication 46\u003c\/p\u003e \u003cp\u003eAuthorization 54\u003c\/p\u003e \u003cp\u003eAccounting\/Auditing 54\u003c\/p\u003e \u003cp\u003eStandards 56\u003c\/p\u003e \u003cp\u003eLaws of Identity 56\u003c\/p\u003e \u003cp\u003eAuthentication Problems in the Real World 57\u003c\/p\u003e \u003cp\u003eSummary 58\u003c\/p\u003e \u003cp\u003e\u003cb\u003e3 \u003c\/b\u003e\u003cb\u003eTypes of Authentication 59\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003ePersonal Recognition 59\u003c\/p\u003e \u003cp\u003eKnowledge-Based Authentication 60\u003c\/p\u003e \u003cp\u003ePasswords 60\u003c\/p\u003e \u003cp\u003ePINS 62\u003c\/p\u003e \u003cp\u003eSolving Puzzles 64\u003c\/p\u003e \u003cp\u003ePassword Managers 69\u003c\/p\u003e \u003cp\u003eSingle Sign-Ons and Proxies 71\u003c\/p\u003e \u003cp\u003eCryptography 72\u003c\/p\u003e \u003cp\u003eEncryption 73\u003c\/p\u003e \u003cp\u003ePublic Key Infrastructure 76\u003c\/p\u003e \u003cp\u003eHashing 79\u003c\/p\u003e \u003cp\u003eHardware Tokens 81\u003c\/p\u003e \u003cp\u003eOne-Time Password Devices 81\u003c\/p\u003e \u003cp\u003ePhysical Connection Devices 83\u003c\/p\u003e \u003cp\u003eWireless 87\u003c\/p\u003e \u003cp\u003ePhone-Based 89\u003c\/p\u003e \u003cp\u003eVoice Authentication 89\u003c\/p\u003e \u003cp\u003ePhone Apps 89\u003c\/p\u003e \u003cp\u003eSMS 92\u003c\/p\u003e \u003cp\u003eBiometrics 92\u003c\/p\u003e \u003cp\u003eFIDO 93\u003c\/p\u003e \u003cp\u003eFederated Identities and APIs 94\u003c\/p\u003e \u003cp\u003eOAuth 94\u003c\/p\u003e \u003cp\u003eAPIs 96\u003c\/p\u003e \u003cp\u003eContextual\/Adaptive 96\u003c\/p\u003e \u003cp\u003eLess Popular Methods 97\u003c\/p\u003e \u003cp\u003eVoiceover Radio 97\u003c\/p\u003e \u003cp\u003ePaper-Based 98\u003c\/p\u003e \u003cp\u003eSummary 99\u003c\/p\u003e \u003cp\u003e\u003cb\u003e4 \u003c\/b\u003e\u003cb\u003eUsability vs Security 101\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eWhat Does Usability Mean? 101\u003c\/p\u003e \u003cp\u003eWe Don’t Really Want the Best Security 103\u003c\/p\u003e \u003cp\u003eSecurity Isn’t Usually Binary 105\u003c\/p\u003e \u003cp\u003eToo Secure 106\u003c\/p\u003e \u003cp\u003eSeven-Factor MFA 106\u003c\/p\u003e \u003cp\u003eMoving ATM Keypad Numbers 108\u003c\/p\u003e \u003cp\u003eNot as Worried as You Think About Hacking 109\u003c\/p\u003e \u003cp\u003eUnhackable Fallacy 110\u003c\/p\u003e \u003cp\u003eUnbreakable Oracle 113\u003c\/p\u003e \u003cp\u003eDJB 113\u003c\/p\u003e \u003cp\u003eUnhackable Quantum Cryptography 114\u003c\/p\u003e \u003cp\u003eWe are Reactive Sheep 115\u003c\/p\u003e \u003cp\u003eSecurity Theater r 116\u003c\/p\u003e \u003cp\u003eSecurity by Obscurity 117\u003c\/p\u003e \u003cp\u003eMFA Will Cause Slowdowns 117\u003c\/p\u003e \u003cp\u003eMFA Will Cause Downtime 118\u003c\/p\u003e \u003cp\u003eNo MFA Solution Works Everywhere 118\u003c\/p\u003e \u003cp\u003eSummary 119\u003c\/p\u003e \u003cp\u003e\u003cb\u003ePart II Hacking MFA 121\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003e\u003cb\u003e5 \u003c\/b\u003e\u003cb\u003eHacking MFA in General 123\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eMFA Dependency Components 124\u003c\/p\u003e \u003cp\u003eEnrollment 125\u003c\/p\u003e \u003cp\u003eUser 127\u003c\/p\u003e \u003cp\u003eDevices\/Hardware 127\u003c\/p\u003e \u003cp\u003eSoftware 128\u003c\/p\u003e \u003cp\u003eAPI 129\u003c\/p\u003e \u003cp\u003eAuthentication Factors 129\u003c\/p\u003e \u003cp\u003eAuthentication Secrets Store 129\u003c\/p\u003e \u003cp\u003eCryptography 130\u003c\/p\u003e \u003cp\u003eTechnology 130\u003c\/p\u003e \u003cp\u003eTransmission\/Network Channel 131\u003c\/p\u003e \u003cp\u003eNamespace 131\u003c\/p\u003e \u003cp\u003eSupporting Infrastructure 131\u003c\/p\u003e \u003cp\u003eRelying Party 132\u003c\/p\u003e \u003cp\u003eFederation\/Proxies 132\u003c\/p\u003e \u003cp\u003eAlternate Authentication Methods\/Recovery 132\u003c\/p\u003e \u003cp\u003eMigrations 133\u003c\/p\u003e \u003cp\u003eDeprovision 133\u003c\/p\u003e \u003cp\u003eMFA Component Conclusion 134\u003c\/p\u003e \u003cp\u003eMain Hacking Methods 134\u003c\/p\u003e \u003cp\u003eTechnical Attacks 134\u003c\/p\u003e \u003cp\u003eHuman Element 135\u003c\/p\u003e \u003cp\u003ePhysical 137\u003c\/p\u003e \u003cp\u003eTwo or More Hacking Methods Used 137\u003c\/p\u003e \u003cp\u003e“You Didn’t Hack the MFA!” 137\u003c\/p\u003e \u003cp\u003eHow MFA Vulnerabilities are Found 138\u003c\/p\u003e \u003cp\u003eThreat Modeling 138\u003c\/p\u003e \u003cp\u003eCode Review 138\u003c\/p\u003e \u003cp\u003eFuzz Testing 138\u003c\/p\u003e \u003cp\u003ePenetration Testing 139\u003c\/p\u003e \u003cp\u003eVulnerability Scanning 139\u003c\/p\u003e \u003cp\u003eHuman Testing 139\u003c\/p\u003e \u003cp\u003eAccidents 140\u003c\/p\u003e \u003cp\u003eSummary 140\u003c\/p\u003e \u003cp\u003e\u003cb\u003e6 \u003c\/b\u003e\u003cb\u003eAccess Control Token Tricks 141\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eAccess Token Basics 141\u003c\/p\u003e \u003cp\u003eAccess Control Token General Hacks142\u003c\/p\u003e \u003cp\u003eToken Reproduction\/Guessing 142\u003c\/p\u003e \u003cp\u003eToken Theft 145\u003c\/p\u003e \u003cp\u003eReproducing Token Hack Examples 146\u003c\/p\u003e \u003cp\u003eNetwork Session Hijacking Techniques and Examples 149\u003c\/p\u003e \u003cp\u003eFiresheep 149\u003c\/p\u003e \u003cp\u003eMitM Attacks 150\u003c\/p\u003e \u003cp\u003eAccess Control Token Attack Defenses 157\u003c\/p\u003e \u003cp\u003eGenerate Random, Unguessable Session IDs 157\u003c\/p\u003e \u003cp\u003eUse Industry-Accepted Cryptography and Key Sizes 158\u003c\/p\u003e \u003cp\u003eDevelopers Should Follow Secure Coding Practices 159\u003c\/p\u003e \u003cp\u003eUse Secure Transmission Channels 159\u003c\/p\u003e \u003cp\u003eInclude Timeout Protections 159\u003c\/p\u003e \u003cp\u003eTie the Token to Specifi c Devices or Sites 159\u003c\/p\u003e \u003cp\u003eSummary 161\u003c\/p\u003e \u003cp\u003e\u003cb\u003e7 \u003c\/b\u003e\u003cb\u003eEndpoint Attacks 163\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eEndpoint Attack Risks 163\u003c\/p\u003e \u003cp\u003eGeneral Endpoint Attacks 165\u003c\/p\u003e \u003cp\u003eProgramming Attacks 165\u003c\/p\u003e \u003cp\u003ePhysical Access Attacks 165\u003c\/p\u003e \u003cp\u003eWhat Can an Endpoint Attacker Do? 166\u003c\/p\u003e \u003cp\u003eSpecifi c Endpoint Attack Examples 169\u003c\/p\u003e \u003cp\u003eBancos Trojans 169\u003c\/p\u003e \u003cp\u003eTransaction Attacks 171\u003c\/p\u003e \u003cp\u003eMobile Attacks 172\u003c\/p\u003e \u003cp\u003eCompromised MFA Keys 173\u003c\/p\u003e \u003cp\u003eEndpoint Attack Defenses 174\u003c\/p\u003e \u003cp\u003eMFA Developer Defenses 174\u003c\/p\u003e \u003cp\u003eEnd-User Defenses 177\u003c\/p\u003e \u003cp\u003eSummary 179\u003c\/p\u003e \u003cp\u003e\u003cb\u003e8 \u003c\/b\u003e\u003cb\u003eSMS Attacks 181\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction to SMS 181\u003c\/p\u003e \u003cp\u003eSS7 184\u003c\/p\u003e \u003cp\u003eBiggest SMS Weaknesses 186\u003c\/p\u003e \u003cp\u003eExample SMS Attacks 187\u003c\/p\u003e \u003cp\u003eSIM Swap Attacks 187\u003c\/p\u003e \u003cp\u003eSMS Impersonation 191\u003c\/p\u003e \u003cp\u003eSMS Buffer Overflow 194\u003c\/p\u003e \u003cp\u003eCell Phone User Account Hijacking 195\u003c\/p\u003e \u003cp\u003eAttacks Against the Underlying Supporting Infrastructure 196\u003c\/p\u003e \u003cp\u003eOther SMS-Based Attacks 196\u003c\/p\u003e \u003cp\u003eSIM\/SMS Attack Method Summary 197\u003c\/p\u003e \u003cp\u003eNIST Digital Identity Guidelines Warning 198\u003c\/p\u003e \u003cp\u003eDefenses to SMS-Based MFA Attacks 199\u003c\/p\u003e \u003cp\u003eDeveloper Defenses 199\u003c\/p\u003e \u003cp\u003eUser Defenses 201\u003c\/p\u003e \u003cp\u003eIs RCS Here to Save Mobile Messaging? 202\u003c\/p\u003e \u003cp\u003eIs SMS-Based MFA Still Better than Passwords? 202\u003c\/p\u003e \u003cp\u003eSummary 203\u003c\/p\u003e \u003cp\u003e\u003cb\u003e9 \u003c\/b\u003e\u003cb\u003eOne-Time Password Attacks 205\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction to OTP 205\u003c\/p\u003e \u003cp\u003eSeed Value-Based OTPs 208\u003c\/p\u003e \u003cp\u003eHMAC-Based OTP 209\u003c\/p\u003e \u003cp\u003eEvent-Based OTP 211\u003c\/p\u003e \u003cp\u003eTOTP 212\u003c\/p\u003e \u003cp\u003eExample OTP Attacks 217\u003c\/p\u003e \u003cp\u003ePhishing OTP Codes 217\u003c\/p\u003e \u003cp\u003ePoor OTP Creation 219\u003c\/p\u003e \u003cp\u003eOTP Theft, Re-Creation, and Reuse 219\u003c\/p\u003e \u003cp\u003eStolen Seed Database 220\u003c\/p\u003e \u003cp\u003eDefenses to OTP Attacks 222\u003c\/p\u003e \u003cp\u003eDeveloper Defenses 222\u003c\/p\u003e \u003cp\u003eUse Reliable and Trusted and Tested OTP Algorithms 223\u003c\/p\u003e \u003cp\u003eOTP Setup Code Must Expire 223\u003c\/p\u003e \u003cp\u003eOTP Result Code Must Expire 223\u003c\/p\u003e \u003cp\u003ePrevent OTP Replay 224\u003c\/p\u003e \u003cp\u003eMake Sure Your RNG is NIST-Certified or Quantum 224\u003c\/p\u003e \u003cp\u003eIncrease Security by Requiring Additional Entry Beyond OTP Code 224\u003c\/p\u003e \u003cp\u003eStop Brute-Forcing Attacks224\u003c\/p\u003e \u003cp\u003eSecure Seed Value Database 225\u003c\/p\u003e \u003cp\u003eUser Defenses 225\u003c\/p\u003e \u003cp\u003eSummary 226\u003c\/p\u003e \u003cp\u003e\u003cb\u003e10 \u003c\/b\u003e\u003cb\u003eSubject Hijack Attacks 227\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 227\u003c\/p\u003e \u003cp\u003eExample Attacks 228\u003c\/p\u003e \u003cp\u003eActive Directory and Smartcards 228\u003c\/p\u003e \u003cp\u003eSimulated Demo Environment 231\u003c\/p\u003e \u003cp\u003eSubject Hijack Demo Attack 234\u003c\/p\u003e \u003cp\u003eThe Broader Issue 240\u003c\/p\u003e \u003cp\u003eDynamic Access Control Example 240\u003c\/p\u003e \u003cp\u003eADFS MFA Bypass 241\u003c\/p\u003e \u003cp\u003eDefenses to Component Attacks 242\u003c\/p\u003e \u003cp\u003eThreat Model Dependency Abuse Scenarios 242\u003c\/p\u003e \u003cp\u003eSecure Critical Dependencies 242\u003c\/p\u003e \u003cp\u003eEducate About Dependency Abuses 243\u003c\/p\u003e \u003cp\u003ePrevent One to Many Mappings 244\u003c\/p\u003e \u003cp\u003eMonitor Critical Dependencies 244\u003c\/p\u003e \u003cp\u003eSummary 244\u003c\/p\u003e \u003cp\u003e\u003cb\u003e11 \u003c\/b\u003e\u003cb\u003eFake Authentication Attacks 245\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eLearning About Fake Authentication Through UAC 245\u003c\/p\u003e \u003cp\u003eExample Fake Authentication Attacks 251\u003c\/p\u003e \u003cp\u003eLook-Alike Websites 251\u003c\/p\u003e \u003cp\u003eFake Office 365 Logons 252\u003c\/p\u003e \u003cp\u003eUsing an MFA-Incompatible Service or Protocol 253\u003c\/p\u003e \u003cp\u003eDefenses to Fake Authentication Attacks 254\u003c\/p\u003e \u003cp\u003eDeveloper Defenses 254\u003c\/p\u003e \u003cp\u003eUser Defenses 256\u003c\/p\u003e \u003cp\u003eSummary 257\u003c\/p\u003e \u003cp\u003e\u003cb\u003e12 \u003c\/b\u003e\u003cb\u003eSocial Engineering Attacks 259\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 259\u003c\/p\u003e \u003cp\u003eSocial Engineering Commonalities 261\u003c\/p\u003e \u003cp\u003eUnauthenticated Communication 261\u003c\/p\u003e \u003cp\u003eNonphysical 262\u003c\/p\u003e \u003cp\u003eUsually Involves Well-Known Brands 263\u003c\/p\u003e \u003cp\u003eOften Based on Notable Current Events and Interests 264\u003c\/p\u003e \u003cp\u003eUses Stressors 264\u003c\/p\u003e \u003cp\u003eAdvanced: Pretexting 265\u003c\/p\u003e \u003cp\u003eThird-Party Reliances 266\u003c\/p\u003e \u003cp\u003eExample Social Engineering Attacks on MFA 266\u003c\/p\u003e \u003cp\u003eFake Bank Alert 267\u003c\/p\u003e \u003cp\u003eCrying Babies 267\u003c\/p\u003e \u003cp\u003eHacking Building Access Cards 268\u003c\/p\u003e \u003cp\u003eDefenses to Social Engineering Attacks on MFA 270\u003c\/p\u003e \u003cp\u003eDeveloper Defenses to MFA 270\u003c\/p\u003e \u003cp\u003eUser Defenses to Social Engineering Attacks 271\u003c\/p\u003e \u003cp\u003eSummary 273\u003c\/p\u003e \u003cp\u003e\u003cb\u003e13 \u003c\/b\u003e\u003cb\u003eDowngrade\/Recovery Attacks 275\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 275\u003c\/p\u003e \u003cp\u003eExample Downgrade\/Recovery Attacks 276\u003c\/p\u003e \u003cp\u003eAlternate Email Address Recovery 276\u003c\/p\u003e \u003cp\u003eAbusing Master Codes 280\u003c\/p\u003e \u003cp\u003eGuessing Personal-Knowledge Questions 281\u003c\/p\u003e \u003cp\u003eDefenses to Downgrade\/Recovery Attacks 287\u003c\/p\u003e \u003cp\u003eDeveloper Defenses to Downgrade\/Recovery Attacks 287\u003c\/p\u003e \u003cp\u003eUser Defenses to Downgrade\/Recovery Attacks 292\u003c\/p\u003e \u003cp\u003eSummary 294\u003c\/p\u003e \u003cp\u003e\u003cb\u003e14 \u003c\/b\u003e\u003cb\u003eBrute-Force Attacks 295\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 295\u003c\/p\u003e \u003cp\u003eBirthday Attack Method 296\u003c\/p\u003e \u003cp\u003eBrute-Force Attack Methods 297\u003c\/p\u003e \u003cp\u003eExample of Brute-Force Attacks 298\u003c\/p\u003e \u003cp\u003eOTP Bypass Brute-Force Test 298\u003c\/p\u003e \u003cp\u003eInstagram MFA Brute-Force 299\u003c\/p\u003e \u003cp\u003eSlack MFA Brute-Force Bypass 299\u003c\/p\u003e \u003cp\u003eUAA MFA Brute-Force Bug 300\u003c\/p\u003e \u003cp\u003eGrab Android MFA Brute-Force 300\u003c\/p\u003e \u003cp\u003eUnlimited Biometric Brute-Forcing 300\u003c\/p\u003e \u003cp\u003eDefenses Against Brute-Force Attacks 301\u003c\/p\u003e \u003cp\u003eDeveloper Defenses Against Brute-Force Attacks 301\u003c\/p\u003e \u003cp\u003eUser Defenses Against Brute-Force Attacks 305\u003c\/p\u003e \u003cp\u003eSummary 306\u003c\/p\u003e \u003cp\u003e\u003cb\u003e15 \u003c\/b\u003e\u003cb\u003eBuggy Software 307\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 307\u003c\/p\u003e \u003cp\u003eCommon Types of Vulnerabilities 308\u003c\/p\u003e \u003cp\u003eVulnerability Outcomes 316\u003c\/p\u003e \u003cp\u003eExamples of Vulnerability Attacks 317\u003c\/p\u003e \u003cp\u003eUber MFA Vulnerability 317\u003c\/p\u003e \u003cp\u003eGoogle Authenticator Vulnerability 318\u003c\/p\u003e \u003cp\u003eYubiKey Vulnerability 318\u003c\/p\u003e \u003cp\u003eMultiple RSA Vulnerabilities 318\u003c\/p\u003e \u003cp\u003eSafeNet Vulnerability 319\u003c\/p\u003e \u003cp\u003eLogin gov 319\u003c\/p\u003e \u003cp\u003eROCA Vulnerability 320\u003c\/p\u003e \u003cp\u003eDefenses to Vulnerability Attacks 321\u003c\/p\u003e \u003cp\u003eDeveloper Defenses Against Vulnerability Attacks 321\u003c\/p\u003e \u003cp\u003eUser Defenses Against Vulnerability Attacks 322\u003c\/p\u003e \u003cp\u003eSummary 323\u003c\/p\u003e \u003cp\u003e\u003cb\u003e16 \u003c\/b\u003e\u003cb\u003eAttacks Against Biometrics 325\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 325\u003c\/p\u003e \u003cp\u003eBiometrics 326\u003c\/p\u003e \u003cp\u003eCommon Biometric Authentication Factors 327\u003c\/p\u003e \u003cp\u003eHow Biometrics Work 337\u003c\/p\u003e \u003cp\u003eProblems with Biometric Authentication 339\u003c\/p\u003e \u003cp\u003eHigh False Error Rates 340\u003c\/p\u003e \u003cp\u003ePrivacy Issues 344\u003c\/p\u003e \u003cp\u003eDisease Transmission 345\u003c\/p\u003e \u003cp\u003eExample Biometric Attacks 345\u003c\/p\u003e \u003cp\u003eFingerprint Attacks345\u003c\/p\u003e \u003cp\u003eHand Vein Attack 348\u003c\/p\u003e \u003cp\u003eEye Biometric Spoof Attacks 348\u003c\/p\u003e \u003cp\u003eFacial Recognition Attacks 349\u003c\/p\u003e \u003cp\u003eDefenses Against Biometric Attacks 352\u003c\/p\u003e \u003cp\u003eDeveloper Defenses Against Biometric Attacks 352\u003c\/p\u003e \u003cp\u003eUser\/Admin Defenses Against Biometric Attacks 354\u003c\/p\u003e \u003cp\u003eSummary 355\u003c\/p\u003e \u003cp\u003e\u003cb\u003e17 \u003c\/b\u003e\u003cb\u003ePhysical Attacks 357\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 357\u003c\/p\u003e \u003cp\u003eTypes of Physical Attacks 357\u003c\/p\u003e \u003cp\u003eExample Physical Attacks 362\u003c\/p\u003e \u003cp\u003eSmartcard Side-Channel Attack 362\u003c\/p\u003e \u003cp\u003eElectron Microscope Attack 364\u003c\/p\u003e \u003cp\u003eCold-Boot Attacks 365\u003c\/p\u003e \u003cp\u003eSnooping On RFID-Enabled Credit Cards 367\u003c\/p\u003e \u003cp\u003eEMV Credit Card Tricks 370\u003c\/p\u003e \u003cp\u003eDefenses Against Physical Attacks 370\u003c\/p\u003e \u003cp\u003eDeveloper Defenses Against Physical Attacks 371\u003c\/p\u003e \u003cp\u003eUser Defenses Against Physical Attacks 372\u003c\/p\u003e \u003cp\u003eSummary 375\u003c\/p\u003e \u003cp\u003e\u003cb\u003e18 \u003c\/b\u003e\u003cb\u003eDNS Hijacking 377\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 377\u003c\/p\u003e \u003cp\u003eDNS 378\u003c\/p\u003e \u003cp\u003eDNS Record Types 382\u003c\/p\u003e \u003cp\u003eCommon DNS Hacks 382\u003c\/p\u003e \u003cp\u003eExample Namespace Hijacking Attacks 388\u003c\/p\u003e \u003cp\u003eDNS Hijacking Attacks 388\u003c\/p\u003e \u003cp\u003eMX Record Hijacks 388\u003c\/p\u003e \u003cp\u003eDangling CDN Hijack 389\u003c\/p\u003e \u003cp\u003eRegistrar Takeover 390\u003c\/p\u003e \u003cp\u003eDNS Character Set Tricks 390\u003c\/p\u003e \u003cp\u003eASN 1 Tricks 392\u003c\/p\u003e \u003cp\u003eBGP Hijacks 392\u003c\/p\u003e \u003cp\u003eDefenses Against Namespace Hijacking Attacks 393\u003c\/p\u003e \u003cp\u003eDeveloper Defenses 394\u003c\/p\u003e \u003cp\u003eUser Defenses 395\u003c\/p\u003e \u003cp\u003eSummary 397\u003c\/p\u003e \u003cp\u003e\u003cb\u003e19 \u003c\/b\u003e\u003cb\u003eAPI Abuses 399\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 399\u003c\/p\u003e \u003cp\u003eCommon Authentication Standards and Protocols Involving APIs 402\u003c\/p\u003e \u003cp\u003eOther Common API Standards and Components 411\u003c\/p\u003e \u003cp\u003eExamples of API Abuse 414\u003c\/p\u003e \u003cp\u003eCompromised API Keys 414\u003c\/p\u003e \u003cp\u003eBypassing PayPal 2FA Using an API 415\u003c\/p\u003e \u003cp\u003eAuthO MFA Bypass 416\u003c\/p\u003e \u003cp\u003eAuthy API Format Injection 417\u003c\/p\u003e \u003cp\u003eDuo API As-Designed MFA Bypass 417\u003c\/p\u003e \u003cp\u003eMicrosoft OAuth Attack 419\u003c\/p\u003e \u003cp\u003eSign In with Apple MFA Bypass 419\u003c\/p\u003e \u003cp\u003eToken TOTP BLOB Future Attack 420\u003c\/p\u003e \u003cp\u003eDefenses Against API Abuses 420\u003c\/p\u003e \u003cp\u003eDeveloper Defenses Against API Abuses 420\u003c\/p\u003e \u003cp\u003eUser Defenses Against API Abuses 422\u003c\/p\u003e \u003cp\u003eSummary 423\u003c\/p\u003e \u003cp\u003e\u003cb\u003e20 \u003c\/b\u003e\u003cb\u003eMiscellaneous MFA Hacks 425\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eAmazon Mystery Device MFA Bypass 425\u003c\/p\u003e \u003cp\u003eObtaining Old Phone Numbers 426\u003c\/p\u003e \u003cp\u003eAuto-Logon MFA Bypass 427\u003c\/p\u003e \u003cp\u003ePassword Reset MFA Bypass 427\u003c\/p\u003e \u003cp\u003eHidden Cameras 427\u003c\/p\u003e \u003cp\u003eKeyboard Acoustic Eavesdropping 428\u003c\/p\u003e \u003cp\u003ePassword Hints 428\u003c\/p\u003e \u003cp\u003eHP MFA DoS 429\u003c\/p\u003e \u003cp\u003eTrojan TOTP 429\u003c\/p\u003e \u003cp\u003eHackers Turn MFA to Defeat You 430\u003c\/p\u003e \u003cp\u003eSummary 430\u003c\/p\u003e \u003cp\u003e\u003cb\u003e21 \u003c\/b\u003e\u003cb\u003eTest: Can You Spot the Vulnerabilities? 431\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eThreat Modeling MFA Solutions 431\u003c\/p\u003e \u003cp\u003eDocument and Diagram the Components 432\u003c\/p\u003e \u003cp\u003eBrainstorm Potential Attacks 432\u003c\/p\u003e \u003cp\u003eEstimate Risk and Potential Losses 434\u003c\/p\u003e \u003cp\u003eCreate and Test Mitigations 436\u003c\/p\u003e \u003cp\u003eDo Security Reviews 436\u003c\/p\u003e \u003cp\u003eIntroducing the Bloomberg MFA Device 436\u003c\/p\u003e \u003cp\u003eBloomberg, L P and the Bloomberg Terminal 437\u003c\/p\u003e \u003cp\u003eNew User B-Unit Registration and Use 438\u003c\/p\u003e \u003cp\u003eThreat-Modeling the Bloomberg MFA Device 439\u003c\/p\u003e \u003cp\u003eThreat-Modeling the B-Unit in a General Example 440\u003c\/p\u003e \u003cp\u003eSpecific Possible Attacks 441\u003c\/p\u003e \u003cp\u003eMulti-Factor Authentication Security Assessment Tool 450\u003c\/p\u003e \u003cp\u003eSummary 451\u003c\/p\u003e \u003cp\u003e\u003cb\u003ePart III Looking Forward 453\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003e\u003cb\u003e22 \u003c\/b\u003e\u003cb\u003eDesigning a Secure Solution 455\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 455\u003c\/p\u003e \u003cp\u003eExercise: Secure Remote Online Electronic Voting 457\u003c\/p\u003e \u003cp\u003eUse Case Scenario 457\u003c\/p\u003e \u003cp\u003eThreat Modeling 458\u003c\/p\u003e \u003cp\u003eSDL Design 460\u003c\/p\u003e \u003cp\u003ePhysical Design and Defenses 461\u003c\/p\u003e \u003cp\u003eCryptography 462\u003c\/p\u003e \u003cp\u003eProvisioning\/Registration 463\u003c\/p\u003e \u003cp\u003eAuthentication and Operations 464\u003c\/p\u003e \u003cp\u003eVerifiable\/Auditable Vote 466\u003c\/p\u003e \u003cp\u003eCommunications 467\u003c\/p\u003e \u003cp\u003eBackend Blockchain Ledger 467\u003c\/p\u003e \u003cp\u003eMigration and Deprovisioning 470\u003c\/p\u003e \u003cp\u003eAPI 470\u003c\/p\u003e \u003cp\u003eOperational Training 470\u003c\/p\u003e \u003cp\u003eSecurity Awareness Training 470\u003c\/p\u003e \u003cp\u003eMiscellaneous 471\u003c\/p\u003e \u003cp\u003eSummary 471\u003c\/p\u003e \u003cp\u003e\u003cb\u003e23 \u003c\/b\u003e\u003cb\u003eSelecting the Right MFA Solution 473\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eIntroduction 473\u003c\/p\u003e \u003cp\u003eThe Process for Selecting the Right MFA Solution 476\u003c\/p\u003e \u003cp\u003eCreate a Project Team 477\u003c\/p\u003e \u003cp\u003eCreate a Project Plan 478\u003c\/p\u003e \u003cp\u003eEducate 479\u003c\/p\u003e \u003cp\u003eDetermine What Needs to Be Protected 479\u003c\/p\u003e \u003cp\u003eChoose Required and Desired Features 480\u003c\/p\u003e \u003cp\u003eResearch\/Select Vendor Solutions 488\u003c\/p\u003e \u003cp\u003eConduct a Pilot Project 490\u003c\/p\u003e \u003cp\u003eSelect a Winner 491\u003c\/p\u003e \u003cp\u003eDeploy to Production 491\u003c\/p\u003e \u003cp\u003eSummary 491\u003c\/p\u003e \u003cp\u003e\u003cb\u003e24 \u003c\/b\u003e\u003cb\u003eThe Future of Authentication 493\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eCyber Crime is Here to Stay 493\u003c\/p\u003e \u003cp\u003eFuture Attacks 494\u003c\/p\u003e \u003cp\u003eIncreasing Sophisticated Automation 495\u003c\/p\u003e \u003cp\u003eIncreased Nation-State Attacks 496\u003c\/p\u003e \u003cp\u003eCloud-Based Threats 497\u003c\/p\u003e \u003cp\u003eAutomated Attacks Against MFA 497\u003c\/p\u003e \u003cp\u003eWhat is Likely Staying 498\u003c\/p\u003e \u003cp\u003ePasswords 498\u003c\/p\u003e \u003cp\u003eProactive Alerts 498\u003c\/p\u003e \u003cp\u003ePreregistration of Sites and Devices 499\u003c\/p\u003e \u003cp\u003ePhones as MFA Devices 500\u003c\/p\u003e \u003cp\u003eWireless 501\u003c\/p\u003e \u003cp\u003eChanging\/Morphing Standards 501\u003c\/p\u003e \u003cp\u003eThe Future 501\u003c\/p\u003e \u003cp\u003eZero Trust 502\u003c\/p\u003e \u003cp\u003eContinuous, Adaptive, Risk-Based 503\u003c\/p\u003e \u003cp\u003eQuantum-Resistant Cryptography 506\u003c\/p\u003e \u003cp\u003eInteresting Newer Authentication Ideas 506\u003c\/p\u003e \u003cp\u003eSummary 507\u003c\/p\u003e \u003cp\u003e\u003cb\u003e25 \u003c\/b\u003e\u003cb\u003eTakeaway Lessons 509\u003c\/b\u003e\u003c\/p\u003e \u003cp\u003eBroader Lessons 509\u003c\/p\u003e \u003cp\u003eMFA Works 509\u003c\/p\u003e \u003cp\u003eMFA is Not Unhackable 510\u003c\/p\u003e \u003cp\u003eEducation is Key 510\u003c\/p\u003e \u003cp\u003eSecurity Isn’t Everything 511\u003c\/p\u003e \u003cp\u003eEvery MFA Solution Has Trade-Offs 511\u003c\/p\u003e \u003cp\u003eAuthentication Does Not Exist in a Vacuum 512\u003c\/p\u003e \u003cp\u003eThere is No Single Best MFA Solution for Everyone 515\u003c\/p\u003e \u003cp\u003eThere are Better MFA Solutions 515\u003c\/p\u003e \u003cp\u003eMFA Defensive Recap 516\u003c\/p\u003e \u003cp\u003eDeveloper Defense Summary 516\u003c\/p\u003e \u003cp\u003eUser Defense Summary 518\u003c\/p\u003e \u003cp\u003eAppendix: List of MFA Vendors 521\u003c\/p\u003e \u003cp\u003eIndex 527\u003c\/p\u003e","brand":"John Wiley \u0026 Sons Inc","offers":[{"title":"Default Title","offer_id":49407109497175,"sku":"9781119650799","price":24.79,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0817\/1739\/5799\/files\/9781119650799.jpg?v=1730498209","url":"https:\/\/bookcurl.com\/products\/hacking-multifactor-authentication-9781119650799","provider":"Book Curl","version":"1.0","type":"link"}