Google Authenticator synchronization raises MFA concerns

Misplaced blame?

When Google Authenticator's synchronization feature was first introduced, some expressed concern that it posed additional security risks, such as a lack of end-to-end encryption for synchronization traffic. Another concern raised by German app development firm Mysk was that if a threat actor compromised a Google account, all the MFA secrets associated with the account would be exposed. For these reasons, several cryptocurrency companies, such as Delta Exchange, advised customers to disable the synchronization feature.

Cryptocurrency firms later saw those concerns realized with the Retool breach. However, other infosec experts agreed many other steps are required for an attacker to take advantage of the synchronization feature and gain significant access to a victim's organization. Jeff Nathan, security researcher and director of detection engineering at Netography, said Retool's blame was misplaced, as Google was just mirroring what so many other companies like Duo Security are doing.

"For Retool or anyone who uses OTP that show up on your phone, that's phishable. Unfortunately, the pattern of letting you add your own device is how people might make a small phishing thing much worse," Nathan said. "If Retool was using WebAuthn, it never would have happened in the first place."

Similarly, Jack Poller, an analyst at TechTarget's Enterprise Security Group, said catastrophic events don't occur from one big issue alone. He compared the social engineering tactics used in the Retool attack to the MGM Resorts International and Caesars Entertainment attacks recently. Okta revealed that several customers, including the Las Vegas resorts, were compromised in a social engineering attack against the identity and access management vendor last month.

"It's because of a sequence of small issues that combine to lead to a greater failure, and the Retool attack follows this pattern," Poller said in an email to TechTarget Editorial. "There were many points during the sequence of events that small decisions could have been made differently that would have turned this major breach into a relatively minor event."

ZeroFox CTO Mike Price said using SMS codes is risky due to the increased number of social engineering attacks that lead to code compromises. The network security vendor recently observed an increase around cloaking techniques where attackers can essentially display malicious phishing pages to their targeted demographic.

While Price does recommend that ZeroFox customers use an MFA app like Google Authenticator because it can't be socially engineered directly, it does pose other risks. For example, if a user's phone is compromised, then the MFA app would be as well. Additionally, devices that are not fully updated increase the chances that attackers will gain access.

He also said Google Authenticator's lack of end-to-end encryption poses additional risks.

"It also appears that the phone will sync your Google Authentication codes up the servers, and there are points afterwards where they could be unencrypted. It's a little difficult to say exactly when and where and for how long. Therefore, they could be compromised in the future through some probably complex series of events," Price said. "The practical risk is low, but it exists, whereas before it did not."

At the least, he said, organizations need to now implement an MFA option and having an app like Google Authenticator directly on the phone is more convenient. "Having it saved to the cloud makes it slightly harder to sleep at night – like, 'Is my account secure? I'm a little more nervous now where I wasn't before,'" Price said.

Passwordless push

In Retool's blog post last month, Kodesh claimed there wasn't a "clear way" to disable the synchronization feature. According to Google's blog post in April, users simply had to update the app and follow prompts to turn on the feature. But it did not address how to disable it.

However, the blog post did promote passwordless security. "We've been also been working with our industry partners and the FIDO Alliance to bring even more convenient and secure authentication offerings to users in the form of passkeys," Google wrote in the blog post.

Nathan interpreted that as Google preferring that users don't enable the synchronization feature and move away from usernames and passwords altogether. "This is a whole lot of writing to say 'We really wish people wouldn't use this. But if you're going to use it, everyone is asking us to do it this way, and we've added this feature,'" he said.

In a statement to TechTarget Editorial last month about Retool's claims, Google again promoted passkeys, which are phishing resistant.

"Phishing and social engineering risks with legacy authentication technologies like ones based on OTP are why the industry is heavily investing in these FIDO-based technologies," Google wrote in an email to TechTarget Editorial. "While we continue to work toward these changes, we want to ensure Google Authenticator users know they have a choice whether to sync their OTPs to their Google Account or to keep them stored only locally. In the meantime, we'll continue to work on balancing security with usability as we consider future improvements to Google Authenticator."

Passkey support among major vendors has increased lately. This month, Okta was the latest to launch passkey support during its Oktane 2023 user conference in San Francisco.

Passkey adoption, however, will take time. Companies like Okta are implementing additional security measures to prevent the compromise of credentials and, most importantly, MFA codes. Price offered additional steps security teams can take to defend against evolving social engineering campaigns. The Number 1 method is for enterprises to be secure by design, he said.

"In a scenario where somebody calls IT help desks and asks for critical information, the person would need to be trained to expect this. And there should be technical countermeasures that prevent single points of failure. For example, two trained people need to review and access, at the same time, sensitive information," he said.