2FA Bypass Techniques
debt(d9/e7/b5/t7)
Closest to 'silent in production until users hit it' (d9). The detection_hints explicitly state automated=no, and the code patterns (weak OTP, missing session binding) produce no compiler or linter warnings. Bypass vulnerabilities like SIM swap or real-time phishing proxies are invisible in code review and only become apparent when an account is actually compromised in production.
Closest to 'cross-cutting refactor across the codebase' (e7). The quick_fix says to prefer TOTP/WebAuthn over SMS and bind sessions to 2FA verification with re-auth windows. This is not a single-line fix — replacing SMS 2FA with WebAuthn/TOTP, securing backup codes, adding session anomaly detection, and hardening account recovery paths all require changes across authentication flows, session management, account recovery logic, and potentially third-party integrations. This spans multiple components, landing at e7.
Closest to 'persistent productivity tax' (b5). The applies_to scope is web contexts broadly, meaning every authenticated feature must account for correct 2FA binding, session management post-authentication, and recovery path security. This creates an ongoing tax across many work streams (new features requiring auth, session handling, account recovery) without fully defining the system's shape, placing it at b5.
Closest to 'serious trap — contradicts how a similar concept works elsewhere' (t7). The misconception field explicitly captures the trap: developers believe any 2FA provides full security, so they implement SMS 2FA and consider the job done. This directly contradicts the expectation that a second factor eliminates phishing and account takeover risk. The 'obvious' implementation (SMS 2FA) is exactly what motivated attackers exploit via SIM swap and SS7 attacks, making this a serious cognitive trap just short of catastrophic.
Also Known As
TL;DR
Explanation
2FA bypass techniques: SIM swap (attacker convinces carrier to transfer victim's number — defeats SMS 2FA entirely), real-time phishing proxy (Evilginx2 transparently proxies the real site, capturing the authenticated session cookie), SS7 protocol attacks (intercept SMS at the network level), backup code theft (codes stored insecurely), account recovery bypass (weak recovery options skip 2FA), and session hijacking (steal the post-2FA session cookie — 2FA only protects the login, not the session). TOTP (authenticator apps) is significantly more resistant than SMS, but not immune to real-time proxy attacks.
Common Misconception
Why It Matters
Common Mistakes
- SMS 2FA for high-security accounts — SIM swap attacks are trivial for motivated attackers.
- Backup codes stored in plain text or cloud storage — the backup is the vulnerability.
- Post-2FA session with no anomaly detection — stolen session cookie bypasses 2FA entirely.
- Account recovery that bypasses 2FA — weakest link is the recovery path.
Avoid When
- Do not treat 2FA as a complete authentication solution — it mitigates credential theft but not session hijacking post-authentication.
- Never allow 2FA to be disabled via an unauthenticated or weakly authenticated account recovery path.
When To Use
- Test your 2FA implementation against known bypass patterns — SIM swap, real-time phishing proxies, and backup code theft.
- Use TOTP (time-based) over SMS 2FA — SS7 and SIM swap attacks make SMS codes interception-prone.
Code Examples
// Session that never re-authenticates — stolen cookie = full access:
$_SESSION['user_id'] = $user->id;
$_SESSION['2fa_verified'] = true;
// Session never expires, no IP/device binding
// Attacker steals cookie via XSS or network interception
// Full account access — 2FA completely bypassed// Mitigations beyond basic 2FA:
// 1. Prefer TOTP or WebAuthn over SMS:
$challenge = $webauthn->generateChallenge();
// 2. Bind session to device fingerprint:
$_SESSION['device_hash'] = hash('sha256', $userAgent . $acceptHeaders);
// 3. Short session lifetime with re-auth for sensitive operations:
$_SESSION['2fa_time'] = time();
// Re-prompt if > 15 minutes since last 2FA:
if (time() - $_SESSION['2fa_time'] > 900) requireReAuth();
// 4. Anomaly detection: alert on new country/device
$this->anomalyDetector->check($user, $request);