2FA Bypass Techniques

Also Known As

TL;DR

Explanation

2FA bypass techniques: SIM swap (attacker convinces carrier to transfer victim's number — defeats SMS 2FA entirely), real-time phishing proxy (Evilginx2 transparently proxies the real site, capturing the authenticated session cookie), SS7 protocol attacks (intercept SMS at the network level), backup code theft (codes stored insecurely), account recovery bypass (weak recovery options skip 2FA), and session hijacking (steal the post-2FA session cookie — 2FA only protects the login, not the session). TOTP (authenticator apps) is significantly more resistant than SMS, but not immune to real-time proxy attacks.

Common Misconception

Why It Matters

Common Mistakes

• SMS 2FA for high-security accounts — SIM swap attacks are trivial for motivated attackers.
• Backup codes stored in plain text or cloud storage — the backup is the vulnerability.
• Post-2FA session with no anomaly detection — stolen session cookie bypasses 2FA entirely.
• Account recovery that bypasses 2FA — weakest link is the recovery path.

Avoid When

• Do not treat 2FA as a complete authentication solution — it mitigates credential theft but not session hijacking post-authentication.
• Never allow 2FA to be disabled via an unauthenticated or weakly authenticated account recovery path.

When To Use

• Test your 2FA implementation against known bypass patterns — SIM swap, real-time phishing proxies, and backup code theft.
• Use TOTP (time-based) over SMS 2FA — SS7 and SIM swap attacks make SMS codes interception-prone.

Code Examples

// Session that never re-authenticates — stolen cookie = full access:
$_SESSION['user_id'] = $user->id;
$_SESSION['2fa_verified'] = true;
// Session never expires, no IP/device binding
// Attacker steals cookie via XSS or network interception
// Full account access — 2FA completely bypassed

// Mitigations beyond basic 2FA:
// 1. Prefer TOTP or WebAuthn over SMS:
$challenge = $webauthn->generateChallenge();
// 2. Bind session to device fingerprint:
$_SESSION['device_hash'] = hash('sha256', $userAgent . $acceptHeaders);
// 3. Short session lifetime with re-auth for sensitive operations:
$_SESSION['2fa_time'] = time();
// Re-prompt if > 15 minutes since last 2FA:
if (time() - $_SESSION['2fa_time'] > 900) requireReAuth();
// 4. Anomaly detection: alert on new country/device
$this->anomalyDetector->check($user, $request);

References

• ↗ https://owasp.org/www-project-web-security-testing-guide/

Tags

Related Terms