Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DontDuo: Bypass 2FA with DTMF Tones

dontduo.com

Post reply on HN
Print view View original

41–50 of 60 posts

Re: DontDuo: Bypass 2FA with DTMF Tones

#41

Post by zzrrt »

bscphil wrote: post #35
floatingatoll wrote: post #31

To explain what's going on here for the unaware — 1) Duo is a commercial service that offers multi-factor authentication through a variety of means, one of which is the Phone Call. 2) This site lets you register them as your Duo phone number, when demanded to do so by someone who's trying to protect your high-value access from being hijacked (such as your employer). 3) This site provides you a phone number that auto-…

It would help if Duo wasn't a closed off trash fire that no one should be forced to use. I'm not condoning bypassing it if it's something your employer has required, but there's really no excuse for not supporting an open method like TOTP and/or security keys.

If it were free, I'd be pretty tempted to use it, and hope somebody would notice my protest. Duo is thrust upon me by my university. I don't want to install Duo's proprietary app for receiving pushes or generating codes (I effectively can't anyway because my phone is de-Googled), and getting cell reception to receive their call can be difficult in some buildings. The other day it took three calls until the system detected my DTMF press, maybe because I was sitting next to a loud fan.

I dabbled at reversing their Android app, but I saw some references to key rotation and got disheartened -- I don't want to spend man-weeks on this. I was hoping to see some URL I could hit and just get a TOTP secret.

To my uni's credit, they offer support for hardware tokens, and maybe someday I'll get sick enough of the phone calls to start carrying one of those around.

Edit: Thanks to commenters in sibling threads with possible solutions to extracting the secret.

Re: DontDuo: Bypass 2FA with DTMF Tones

#42

Post by abdullahkhalids »

taneq wrote: post #34
floatingatoll wrote: post #31

To explain what's going on here for the unaware — 1) Duo is a commercial service that offers multi-factor authentication through a variety of means, one of which is the Phone Call. 2) This site lets you register them as your Duo phone number, when demanded to do so by someone who's trying to protect your high-value access from being hijacked (such as your employer). 3) This site provides you a phone number that auto-…

Who on earth thought this was a good idea, at any level?

You have an entire industry-ideology that says, "build things that people want and turn those wants into needs full stop". No mention of ethics at all [1]. Is it really surprising to see startups with blatant disregard for security and ethics?

[1] http://paulgraham.com/start.html

Re: DontDuo: Bypass 2FA with DTMF Tones

#43

Post by goode »

Duo was one of the last things keeping me from switching to Google-free AOSP, and I toyed with a similar idea while trying to reverse-engineer a free software replacement. Instead, I ended up writing a small tool that allows you to use any old HOTP authenticator with Duo. I use FreeOTP+ on my phone, but you could just as easily stick that HOTP secret in a script or onto a Yubikey. You might find it useful if you're working your way up to 100% Stallman status: https://github.com/evan-goode/duolibre.

By the way, I gotta say this project is pretty hilarious, and you're a true baller for trying to sell this to people.

Re: DontDuo: Bypass 2FA with DTMF Tones

#44

Post by the_pwner224 »

bscphil wrote: post #36
the_pwner224 wrote: post #16

Earlier quoted context omitted.

Duo implements a proprietary setup layer over HOTP (counter based instead of time based, useful for hardware key generators that don't have a clock). I needed it for my University and internship, and was able to set it up on an Android emulator (or rooted device), copy the secret key and counter off of the app's config file, and then use it on my laptop. On the computer I have ~/.totp/ which contains files like `gith…

Thanks, this is really cool. > The newer app versions refuse to run without Google Play Services, but you can still make a throwaway andorid emulator with GPS. Can't you run GPS on a rooted phone, or am I mistaken? (If not, what about with magisk?) I suppose if it will run on a phone with an unlocked bootloader, you could always keep it unrooted until you need to copy the hotp, then root it. Amazing that they've mana…

You can run GPS on a rooted phone.

Duo does provide a very valuable service to organizations that pay for it - it's just frustrating for a user to be stuck with them.

Re: DontDuo: Bypass 2FA with DTMF Tones

#45

Post by the_pwner224 »

chx wrote: post #32
the_pwner224 wrote: post #16

Earlier quoted context omitted.

Duo implements a proprietary setup layer over HOTP (counter based instead of time based, useful for hardware key generators that don't have a clock). I needed it for my University and internship, and was able to set it up on an Android emulator (or rooted device), copy the secret key and counter off of the app's config file, and then use it on my laptop. On the computer I have ~/.totp/ which contains files like `gith…

OK that's clever but you are still bypassing 2FA and I am baffled why would you want to do that -- just switch off 2FA if it's annoying? If your employer doesn't let you and you bypass like this (I presume you are entering your password on the laptop too) then you are begging to be fired.

Your phone has an app with your work email on it, and probably ones with internal chat and other things too. Your phone has no 2fa - anyone who knows your passcode/pattern (and you need one even if you use a fingerprint) has access to all your work stuff.

Clearly, being able to access company resources without having two devices isn't the problem that 2FA is being used to solve. I just want to have the same ease of access on my computer that I have on my phone.

Re: DontDuo: Bypass 2FA with DTMF Tones

#46

Post by dogma1138 »

bscphil wrote: post #35
floatingatoll wrote: post #31

To explain what's going on here for the unaware — 1) Duo is a commercial service that offers multi-factor authentication through a variety of means, one of which is the Phone Call. 2) This site lets you register them as your Duo phone number, when demanded to do so by someone who's trying to protect your high-value access from being hijacked (such as your employer). 3) This site provides you a phone number that auto-…

It would help if Duo wasn't a closed off trash fire that no one should be forced to use. I'm not condoning bypassing it if it's something your employer has required, but there's really no excuse for not supporting an open method like TOTP and/or security keys.

Duo supports TOTP and U2F, it also supports now touchID on new Macs which makes it fairly easy to use.

I can get that the phone part is annoying but DuoPosh/TOTP and now the TouchID are probably the smoothest FMA solution for the enterprise I ever used.

Re: DontDuo: Bypass 2FA with DTMF Tones

#47

Post by dogma1138 »

zzrrt wrote: post #41
bscphil wrote: post #35

Earlier quoted context omitted.

It would help if Duo wasn't a closed off trash fire that no one should be forced to use. I'm not condoning bypassing it if it's something your employer has required, but there's really no excuse for not supporting an open method like TOTP and/or security keys.

If it were free, I'd be pretty tempted to use it, and hope somebody would notice my protest. Duo is thrust upon me by my university. I don't want to install Duo's proprietary app for receiving pushes or generating codes (I effectively can't anyway because my phone is de-Googled), and getting cell reception to receive their call can be difficult in some buildings. The other day it took three calls until the system det…

It’s free for upto 10 users I actually use it on some of my machines, with the call back features disabled.

There should be a URL that gives you a QR code for the TOTP/DuoPush enrollment.

Re: DontDuo: Bypass 2FA with DTMF Tones

#48

Post by bscphil »

the_pwner224 wrote: post #44
bscphil wrote: post #36

Earlier quoted context omitted.

Thanks, this is really cool. > The newer app versions refuse to run without Google Play Services, but you can still make a throwaway andorid emulator with GPS. Can't you run GPS on a rooted phone, or am I mistaken? (If not, what about with magisk?) I suppose if it will run on a phone with an unlocked bootloader, you could always keep it unrooted until you need to copy the hotp, then root it. Amazing that they've mana…

You can run GPS on a rooted phone. Duo does provide a very valuable service to organizations that pay for it - it's just frustrating for a user to be stuck with them.

I found a better method, actually. Someone reverse engineered the app. Actually very simple. https://github.com/simonseo/nyuad-spammer/tree/master/spamme...

Re: DontDuo: Bypass 2FA with DTMF Tones

#49

Post by bscphil »

dogma1138 wrote: post #46
bscphil wrote: post #35

Earlier quoted context omitted.

It would help if Duo wasn't a closed off trash fire that no one should be forced to use. I'm not condoning bypassing it if it's something your employer has required, but there's really no excuse for not supporting an open method like TOTP and/or security keys.

Duo supports TOTP and U2F, it also supports now touchID on new Macs which makes it fairly easy to use. I can get that the phone part is annoying but DuoPosh/TOTP and now the TouchID are probably the smoothest FMA solution for the enterprise I ever used.

It doesn't support these at my institution. Maybe they haven't rolled out this version? (Technically you can get U2F to work, but they have a bright red warning that says it's unsupported when you do that.)

Re: DontDuo: Bypass 2FA with DTMF Tones

#50

Post by w8rbt »

bscphil wrote: post #49
dogma1138 wrote: post #46

Earlier quoted context omitted.

Duo supports TOTP and U2F, it also supports now touchID on new Macs which makes it fairly easy to use. I can get that the phone part is annoying but DuoPosh/TOTP and now the TouchID are probably the smoothest FMA solution for the enterprise I ever used.

It doesn't support these at my institution. Maybe they haven't rolled out this version? (Technically you can get U2F to work, but they have a bright red warning that says it's unsupported when you do that.)

IT admins at your org can enable or disable 2FA methods allowed via the Duo administration console. Many US edus disable TOTP.
Post reply on HN