What will happen with authentication and passwords? Translation of the Javelin report "The State of Strong Authentication" with comments

The spoiler from the report header states, "The prevalence of strong authentication has risen due to threats from new risks and regulatory requirements."
The research company "Javelin Strategy & Research" published the report "The State of Strong Authentication 2019" ( the original in PDF format can be downloaded here). This report outlines the percentage of American and European companies that use passwords (and why passwords are now seldom used); why the percentage of two-factor authentication based on cryptographic tokens is growing rapidly; and why one-time codes sent via SMS are unsafe.

Everyone interested in the current, past, and future state of authentication for enterprises and consumer applications is welcome.

From the Translator

Unfortunately, the language in which this report is written is quite "dry" and formal. The quintuple use of the word "authentication" in one short sentence is not a failure (or incompetence) of the translator, but a quirk of the authors. When faced with choosing between a translation closer to the original or a more engaging text, I sometimes opted for the former and sometimes the latter. But bear with me, dear readers, the content of the report is worth it.

Some inconsequential and unnecessary pieces for the narrative were omitted, otherwise, most readers would not manage to get through the entire text. Those wishing to read the report "uncut" can do so in the original language by following the link.

Unfortunately, the authors are not always careful with terminology. For example, they sometimes refer to one-time passwords (One Time Password - OTP) as "passwords" and at other times as "codes." The situation is even worse with authentication methods. It is not always easy for an unprepared reader to guess that "authentication using cryptographic keys" and "strict authentication" are one and the same. I have tried to standardize the terms as much as possible; furthermore, the report contains a section detailing them.

Nonetheless, the report comes highly recommended for reading because it contains unique research findings and accurate conclusions.

) are my evaluative judgments, and I would be happy to debate each of them (as well as the quality of the translation). italic) are my evaluative judgments, and I would be glad to argue about each one (as well as about the quality of the translation).

Overview

In today's world, digital communication channels with clients are more crucial for businesses than ever. Furthermore, internal communications among employees are increasingly oriented towards a digital environment. The security of these interactions depends on the chosen method of user authentication. Malicious actors exploit weak authentication to carry out mass account hacking. In response, regulatory authorities are tightening standards to compel businesses to better protect user accounts and data.

Authentication-related threats extend beyond consumer applications; attackers can also access applications operating within a business. This allows them to impersonate corporate users. By using access points with weak authentication, malicious actors can steal data and engage in other fraudulent activities. Fortunately, there are countermeasures. Strict authentication can significantly reduce the risk of attacks by malicious actors, both on consumer applications and on business systems.

This study examines how enterprises implement authentication to protect user applications and business systems; the factors they consider when choosing an authentication solution; the role that strict authentication plays in their organizations; and the benefits these organizations receive.

Summary

Main Findings

Since 2017, there has been a sharp increase in the percentage of strict authentication usage. With the rise in vulnerabilities affecting traditional authentication solutions, organizations are enhancing their authentication capabilities with strict authentication. The number of organizations using multi-factor authentication leveraging cryptography (MFA) has tripled since 2017 for consumer applications and increased by nearly 50% for enterprise applications. The most rapid growth is observed in mobile authentication due to the growing availability of biometric authentication.

Here we see an illustration of the saying, "until the thunder strikes, the man won't cross himself." When experts warned about the unreliability of passwords, no one rushed to implement two-factor authentication. As soon as hackers started stealing passwords, people began to adopt two-factor authentication.

In fact, private individuals are much more active in implementing 2FA. Firstly, it helps alleviate their fears by relying on the biometric authentication embedded in smartphones, which is in reality quite unreliable. Organizations, on the other hand, have to spend money on acquiring tokens and carry out (actually quite simple) implementation work. Secondly, while only the lazy haven't written about password leaks from services like Facebook and Dropbox, IT directors of these organizations won't share stories about how passwords were stolen (and what happened next) under any circumstances.

Those who do not use strict authentication underestimate their risk to their business and customers. Some organizations currently not using strict authentication tend to view logins and passwords as one of the most effective and simplest user authentication methods. Others do not see the value of the digital assets they possess. It's important to consider that cybercriminals are interested in any consumer and business information. Two-thirds of companies that only use passwords to authenticate their employees do so because they believe passwords are good enough for the type of information they are protecting.

Nevertheless, passwords are on their way "to the grave." Over the past year, reliance on passwords has significantly decreased, both for consumer and corporate applications (from 44% to 31%, and from 56% to 47%, respectively), as organizations expand their use of traditional MFA and strict authentication.
However, when evaluating the situation as a whole, vulnerable authentication methods still prevail. For user authentication, about a quarter of organizations use SMS OTP (one-time password) along with security questions. As a result, additional protective measures must be implemented to guard against vulnerabilities, which increases costs. Much more reliable authentication methods, such as hardware cryptographic keys, are used much less frequently, in only about 5% of organizations.

The evolving regulatory environment promises to accelerate the adoption of stringent authentication for consumer applications. With the introduction of PSD2, as well as new data protection regulations in the EU and several states in the US, such as California, companies are feeling the heat. Almost 70% of companies agree they are facing strong regulatory pressure to ensure strict authentication for their customers. More than half of businesses believe that in a few years, their authentication methods will no longer be sufficient to comply with regulatory standards.

There is a noticeable difference in the approaches of Russian and American-European lawmakers regarding the protection of personal data of users of programs and services. Russian lawmakers say: dear service owners, do whatever you want and as you please, but if your admin leaks the database, we will punish you. Abroad, they say: you must implement a set of measures that will not allow prevents database leaks. That is why strict two-factor authentication requirements are being widely implemented there.
However, it is far from certain that our legislative machine will not suddenly realize the need to take into account Western experience. At that point, it will turn out that everyone needs to implement 2FA compliant with Russian cryptographic standards, and urgently.

Creating a reliable authentication foundation allows companies to shift the focus from merely meeting regulatory requirements to addressing customer needs. For organizations that still use simple passwords or receive codes via SMS, regulatory compliance will be the most important factor when choosing an authentication method. Companies that already implement strict authentication can focus on choosing methods that enhance customer loyalty.

When selecting an authentication method within a corporation, regulatory requirements are no longer a significant factor. In this case, ease of integration (32%) and cost (26%) are much more important.

In the age of phishing, attackers can leverage corporate email for fraud, deceptively gaining access to data and accounts (with the corresponding access rights), and even convincing employees to make monetary transfers to their accounts. Therefore, corporate email accounts and portals must be especially well protected.

Google has strengthened its security by implementing strict authentication. More than two years ago, Google published a report on the implementation of two-factor authentication based on FIDO U2F security keys, reporting impressive results. According to the company, there were no phishing attacks against over 85,000 employees.

Recommendations

Implement strict authentication for mobile and online applications. Multifactor authentication based on cryptographic keys offers much stronger protection against breaches than traditional MFA methods. Additionally, using cryptographic keys is much more convenient since it eliminates the need to share and utilize extra information — passwords, one-time codes, or biometric data from the user's device to the authentication server. Furthermore, the standardization of authentication protocols makes it easier to implement new authentication methods as they emerge, reducing operational costs and protecting against more complex fraud schemes.

Prepare for the sunset of one-time passwords (OTP). The vulnerabilities inherent in OTP are becoming increasingly evident as cybercriminals utilize social engineering, smartphone cloning, and malware to compromise these authentication methods. While OTP may have certain advantages in terms of universal accessibility for all users, they fall short in terms of security.

It's hard not to notice that receiving codes via SMS or push notifications, as well as generating codes through smartphone applications, is indeed the use of those very one-time passwords (OTP) we are being warned to prepare for the demise of. Technically, it is a sound solution, as few fraudsters refrain from attempting to extract a one-time password from a trusting user. However, I believe that the manufacturers of such systems will cling to dying technology until the very end.

Utilize strict authentication as a marketing tool to enhance customer trust. Strict authentication can not only improve the actual security of your business but also enhance public perceptions of the security of that business—an important factor when there is significant customer demand for reliable authentication methods.

Conduct a thorough inventory and assess the importance of corporate data, and protect it based on its significance. Even low-risk data, such as customer contact information (no, it is indeed stated in the report as 'low-risk'; it is very odd that they underestimate the importance of this information), can provide significant value to fraudsters and cause issues for the company.

Implement strict authentication within the enterprise. Certain systems are particularly attractive targets for criminals. These include both internal and Internet-connected systems, such as accounting software or corporate data stores. Strict authentication prevents unauthorized access by intruders and allows for precise identification of which employees engaged in malicious activity.

What is strong authentication?

Strong authentication uses multiple methods or factors to verify a user's identity:

• Knowledge factor: a shared secret between the user and the entity verifying the user (for example, passwords, answers to security questions, etc.)
• Possession factor: a device that only the user possesses (for example, a mobile device, a cryptographic key, etc.)
• Inherence factor: physical (often biometric) characteristics of the user (for example, fingerprint, iris pattern, voice, behavior, etc.)

The need to compromise multiple factors significantly increases the likelihood of failure for attackers, as bypassing or deceiving various factors requires the use of multiple types of hacking tactics, each for the specific factor.

For example, with 2FA ‘password + smartphone’, an attacker could authenticate by observing the user's password and making an exact software copy of their smartphone. This is much more difficult than simply stealing the password.

However, if 2FA uses a password and a cryptographic token, the copying option does not work here – the token cannot be duplicated. The attacker would need to stealthily steal the token from the user. If the user notices the token is missing in time and notifies the admin, the token will be blocked, and the attacker’s efforts will be in vain. This is why specialized secure devices (tokens) should be used for the possession factor, rather than general-purpose devices (smartphones).

Using all three factors would make this authentication method quite expensive to implement and somewhat inconvenient to use. Therefore, it is usually the case that two out of the three factors are used.

More details on the principles of two-factor authentication are described here, in the section 'How Two-Factor Authentication Works'.

It is important to note that at least one of the authentication factors used in strong authentication must use public key cryptography.

Strict authentication provides much stronger protection than single-factor authentication based on traditional passwords and conventional MFA. Passwords can be observed or intercepted using keyloggers, phishing sites, or social engineering attacks (where the deceived victim divulges their password themselves). Moreover, the password owner often remains unaware of the theft. Traditional MFA (including OTP codes, smartphone or SIM card binding) can also be relatively easily compromised, as it is not based on public key cryptography.By the way, there are numerous examples where, through the same social engineering tactics, fraudsters persuaded users to share their one-time password.).

Fortunately, since last year, the use of strict authentication and traditional MFA has been gaining traction in both consumer and corporate applications. The adoption of strict authentication in consumer applications has increased particularly rapidly. In 2017, only 5% of companies employed it, but by 2018, that number had tripled to 16%. This can be attributed to the increased availability of tokens supporting public key cryptography algorithms (Public Key Cryptography - PKC). Additionally, heightened pressure from European regulators following the adoption of new data protection regulations, such as PSD2 and GDPR, has had a significant impact even beyond Europe.including in Russia.).

Let’s take a closer look at these numbers. As we can see, the percentage of individuals using multi-factor authentication has increased by a remarkable 11% over the year. This shift appears to be driven primarily by those who were reliant on passwords, as the figures for those who trust the security of Push notifications, SMS, and biometrics have remained unchanged.

However, the situation with two-factor authentication for corporate use is not as encouraging. Firstly, according to the report, only 5% of employees have transitioned from password authentication to tokens. Secondly, the number of individuals using alternative MFA options in the corporate environment has increased by 4%.

I'll try to play the analyst and give my interpretation. At the center of the digital world for individual users is the smartphone. Therefore, it’s not surprising that most people utilize the features provided by their devices — biometric authentication, SMS, and Push notifications, as well as one-time passwords generated by applications on the smartphone itself. People usually don't think about the security and reliability of the familiar tools they use.

This is why the percentage of users relying on primitive ‘traditional’ authentication factors remains unchanged. However, those who previously used passwords understand the risks involved and choose the most modern and secure option for new authentication factors — cryptographic tokens.

As for the corporate market, it is important to understand which system the authentication is being applied to. If logging into a Windows domain, cryptographic tokens are used. The capabilities for their use in 2FA are already embedded in both Windows and Linux, while alternative solutions take a long time to implement. Here's where the migration from passwords to tokens sits at just 5%.

The implementation of 2FA in corporate information systems greatly depends on the developers' qualifications. It's much easier for developers to use ready-made modules for generating one-time passwords than to understand the workings of cryptographic algorithms. As a result, even highly security-critical applications, like Single Sign-On or Privileged Access Management systems, utilize OTPs as the second factor.

Numerous vulnerabilities in traditional authentication methods

Despite many organizations remaining reliant on outdated single-factor systems, vulnerabilities within traditional multi-factor authentication are becoming increasingly apparent. One-time passwords, usually ranging from six to eight characters and delivered via SMS, remain the most common form of authentication (besides the knowledge factor of the password, of course). And when popular media mentions the terms 'two-factor authentication' or 'two-step verification,' they almost always refer to authentication using one-time SMS passwords.

Here the author makes a slight mistake. Sending one-time passwords via SMS has never constituted two-factor authentication. It is merely the second step of two-step authentication, where the first step involves entering a username and password.

In 2016, the National Institute of Standards and Technology (NIST) updated its authentication guidelines to exclude the use of one-time passwords sent via SMS. However, these rules were significantly relaxed after protests from the industry.

So, let's follow the story. The American regulator rightly acknowledges that outdated technology cannot ensure user security and introduces new standards. These standards are intended to protect users of online and mobile applications (including banking apps). The industry is calculating how much money will be required to purchase truly reliable cryptographic tokens, to modify applications, and to deploy public key infrastructure, and is 'rearing up.' On one hand, users were assured of the reliability of one-time passwords; on the other hand, there were attacks on NIST. As a result, the standard was softened, and the number of hacks and password thefts (and money from banking apps) sharply increased. However, the industry didn't have to spend excessively.

Since then, the weaknesses inherent in SMS OTPs have become more apparent. Fraudsters use various methods to compromise SMS messages:

• SIM card duplication. Malefactors create a copy of the SIM (either through employees of the mobile operator or independently, using special software and hardware). As a result, the attacker receives an SMS with a one-time password. In one particularly well-known case, hackers even managed to compromise the AT&T account of cryptocurrency investor Michael Terpin and steal nearly $24 million in cryptocurrencies. Consequently, Terpin stated that AT&T was to blame due to weak verification measures that led to the SIM card duplication.
  

  Amazing logic. So, is it really only AT&T to blame? No, the mobile operator is certainly at fault for issuing a duplicate SIM card at the store. But what about the cryptocurrency exchange's authentication system? Why didn’t they use reliable cryptographic tokens? Was the budget for implementation too tight? And what about Michael? Why didn’t he insist on changing the authentication mechanism or only use exchanges that implement two-factor authentication based on cryptographic tokens?

  The implementation of truly reliable authentication methods is delayed precisely because users show astonishing carelessness before a breach and afterwards blame anyone and anything for their troubles except for outdated and "leaky" authentication technologies.

• Malware. One of the earliest functions of mobile malware was to intercept and forward text messages to attackers. In addition, man-in-the-browser and man-in-the-middle attacks can intercept one-time passwords when they are entered on infected laptops or desktop devices.
  

  When the Sberbank app on your smartphone flashes a green icon in the status bar, it is also searching for "malware" on your phone. The goal of this action is to turn the untrusted execution environment of a typical smartphone into something that is, at least somewhat, trusted.
  By the way, a smartphone, as an absolutely untrusted device on which anything can execute, is another reason to use only hardware tokens for authentication. that are secure and free from viruses and trojans.Social engineering.

• When attackers know that their victim has one-time passwords enabled via SMS, they can directly contact the victim, pretending to be a trusted organization, such as their bank or credit union, to deceive the victim into providing the just-received code. Когда мошенникам известно, что у жертвы включены одноразовые пароли по SMS, они могут напрямую связаться с жертвой, выдавая себя за доверенную организацию, такую как её банк или кредитный союз, чтобы обмануть жертву и заставить её предоставить только что полученный код.
  

  I have personally encountered this type of fraud repeatedly, for instance, when trying to sell something on a popular online marketplace. I thoroughly enjoyed messing with a scammer who tried to dupe me. Unfortunately, I often read in the news about another victim of scammers who 'didn't think,' shared the confirmation code, and lost a significant amount of money. This is all because the bank simply doesn't want to deal with implementing cryptographic tokens in its applications. After all, if something goes wrong, then the clients are 'to blame' themselves.

While alternative methods for delivering one-time passwords can mitigate some vulnerabilities in this authentication method, other vulnerabilities still persist. Standalone code generation applications provide the best protection against interception, as even malicious software can hardly interact directly with the code generator (seriously? The report's author forgot about remote management?), but OTPs can still be intercepted when entered in the browser (for example, using a keylogger), through a compromised mobile application; and can also be obtained directly from the user via social engineering.
Using multiple risk assessment tools, such as device recognition (identifying attempts to perform operations with devices not belonging to the legitimate user), geolocation (a user just located in Moscow is trying to perform an operation from Novosibirsk) and behavioral analytics, is crucial for eliminating vulnerabilities, but no single solution is a panacea. Each situation and data type must be carefully assessed to determine which authentication technology should be used.

No single authentication solution is a panacea.

Figure 2. Authentication Options Table

In the second part of the publication, we will look at the most interesting part — the numbers and facts that underpin the conclusions and recommendations made in the first part. Authentication in user applications and corporate systems will be examined separately.

See you there!

Source: habr.com