Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DontDuo: Bypass 2FA with DTMF Tones

dontduo.com

Post reply on HN
Print view View original

21–30 of 60 posts

Re: DontDuo: Bypass 2FA with DTMF Tones

#21

Post by URSpider94 »

evancox100 wrote: post #17
amanzi wrote: post #7

Earlier quoted context omitted.

I assume this is referring to Duo Security, owned by Cisco: https://duo.com/

I was just as lost as OP. Can someone also explain how it uses DTMF tones? Is it using tones to deliver or receive 2FA codes? Scanned the above url but didn't see the info.

You register with this service, get a new phone number from them that they auto-answer, then provide this number to the security service. When the security service calls this number, it will play back DTMF codes to simulate whatever buttons you need to press to enter your code key.

Re: DontDuo: Bypass 2FA with DTMF Tones

#23

Post by nickphx »

bubblethink wrote: post #20
the_pwner224 wrote: post #16

Earlier quoted context omitted.

Duo implements a proprietary setup layer over HOTP (counter based instead of time based, useful for hardware key generators that don't have a clock). I needed it for my University and internship, and was able to set it up on an Android emulator (or rooted device), copy the secret key and counter off of the app's config file, and then use it on my laptop. On the computer I have ~/.totp/ which contains files like `gith…

I have been doing the same on AOSP with the andOTP app. Can't get why large companies/universities have boners for proprietary crap like duo. A company comes along and says, "Here's some textbook standard stuff, and here we add our lock-in on top of it. Would you like the lock-in ?" And everyone says, "Yes please." For those suffering, this helps: https://github.com/puddly/android-otp-extractor Edit: Responding to yo…

The universities often receive "grants" from the vendors to foster initial development along with incentives provided based on adoption and usage.. https://www.azcentral.com/story/news/local/arizona-education...

Re: DontDuo: Bypass 2FA with DTMF Tones

#24

Post by DKnoll »

I got the trial. Gave me a 201 area code number. Called it and it waited some seconds after answering, played a DTMF tone and hung up. No, I didn't test it with Duo (lol). Every time this number receives a phone call it increments a login counter on the dashboard.

Re: DontDuo: Bypass 2FA with DTMF Tones

#25

Post by nwmcsween »

bubblethink wrote: post #20
the_pwner224 wrote: post #16

Earlier quoted context omitted.

Duo implements a proprietary setup layer over HOTP (counter based instead of time based, useful for hardware key generators that don't have a clock). I needed it for my University and internship, and was able to set it up on an Android emulator (or rooted device), copy the secret key and counter off of the app's config file, and then use it on my laptop. On the computer I have ~/.totp/ which contains files like `gith…

I have been doing the same on AOSP with the andOTP app. Can't get why large companies/universities have boners for proprietary crap like duo. A company comes along and says, "Here's some textbook standard stuff, and here we add our lock-in on top of it. Would you like the lock-in ?" And everyone says, "Yes please." For those suffering, this helps: https://github.com/puddly/android-otp-extractor Edit: Responding to yo…

It's not just universities, it's basically any Windows centric place that seems to gravitate towards packaged solutions rather than understanding or implementing the tech piecemeal.

Re: DontDuo: Bypass 2FA with DTMF Tones

#26

Post by bubblethink »

nwmcsween wrote: post #25
bubblethink wrote: post #20

Earlier quoted context omitted.

I have been doing the same on AOSP with the andOTP app. Can't get why large companies/universities have boners for proprietary crap like duo. A company comes along and says, "Here's some textbook standard stuff, and here we add our lock-in on top of it. Would you like the lock-in ?" And everyone says, "Yes please." For those suffering, this helps: https://github.com/puddly/android-otp-extractor Edit: Responding to yo…

It's not just universities, it's basically any Windows centric place that seems to gravitate towards packaged solutions rather than understanding or implementing the tech piecemeal.

I feel that at least public universities have some responsibility to not peddle garbage like this. I don't know if there are laws about this, but requiring students/staff to use play services and blobs to access university infrastructure (all paid for by taxes and fees) shouldn't be a thing.

Re: DontDuo: Bypass 2FA with DTMF Tones

#28

Post by the_pwner224 »

bubblethink wrote: post #26
nwmcsween wrote: post #25

Earlier quoted context omitted.

It's not just universities, it's basically any Windows centric place that seems to gravitate towards packaged solutions rather than understanding or implementing the tech piecemeal.

I feel that at least public universities have some responsibility to not peddle garbage like this. I don't know if there are laws about this, but requiring students/staff to use play services and blobs to access university infrastructure (all paid for by taxes and fees) shouldn't be a thing.

http://www.gnu.org/education/edu-schools.html

Re: DontDuo: Bypass 2FA with DTMF Tones

#29

Post by floatingatoll »

DKnoll wrote: post #24

I got the trial. Gave me a 201 area code number. Called it and it waited some seconds after answering, played a DTMF tone and hung up. No, I didn't test it with Duo (lol). Every time this number receives a phone call it increments a login counter on the dashboard.

You may want to contact Twilio abuse and ask them if they operate that number, and if so, point them to the terms of service that issued it and note that they appear to be a flight-by-night credential harvester.

Re: DontDuo: Bypass 2FA with DTMF Tones

#30

Post by Thorrez »

w8rbt wrote: post #3
warhorse10_9 wrote: post #2

This is a horrible idea. I just can't. Why does this service even exist. I seriously hope duo figures out the numbers this site is using and blacklists them.

I think the point is that relying on phone calls and DTMF tones for two factor authentication is trivial to bypass. Anyone can record DTMF tones in a voicemail message and forward calls to that number.

What do you mean trivial to bypass? If I have an account secured with a password and with Duo, then I give you my password, can you get into my account? How?
Post reply on HN