Varonis Threat Labs have discovered a new way to bypass multi-factor authentication (MFA) for Box accounts that use an SMS code for login verification.
Using this technique, an attacker could use stolen credentials to compromise an organisation’s Box account and exfiltrate sensitive data without access to the victim’s phone.
What’s the score?
According to Box, 97,000 companies and 68% of the Fortune 500 rely on the company’s solutions to access information from anywhere and collaborate with anyone.
Like many applications, Box allows users without Single Sign-On (SSO) to use an authenticator app, like Okta Verify or Google Authenticator, or SMS with a one-time passcode as a second step in authentication.
How SMS Verification Works in Box
After entering a username and password in Box’s login form, Box sets a session cookie and redirects the user to either:
- A form to enter a time-based one-time password (TOTP) if the user is enrolled with an authenticator app, or
- A form to enter an SMS code if the user enrolled to receive a passcode via SMS
When the user navigates to the SMS verification form, a code is sent to their phone. They must enter this code to gain access to their Box.com account.
What’s the Issue? Mixing MFA Modes
If the user does not navigate to the SMS verification form, no SMS message will be sent, but a session cookie is still generated. A malicious actor only needs to enter the user’s email and password—stolen from a password leak or phishing attack, for example—to get a valid session cookie. No SMS message code required.
After the cookie is generated, the threat actor can abandon the SMS-based MFA process (which is what the user is enrolled in) and instead initiate the TOTP-based MFA process—thus mixing MFA modes.
The attacker completes the authentication process by posting a factor ID and code from their own Box account and authenticator app to the TOTP verification endpoint using the session cookie they received by providing the victim’s credentials.
Box did not verify whether the victim was enrolled in TOTP verification and did not validate that the authenticator app used belonged to the user that was logging in. This made it possible to access the victim’s Box account without the victim’s phone and without notifying the user via SMS.
Attack Flow
- Attacker enrols in multi-factor authentication using an authenticator app and stores the device’s factor ID.
- Attacker enters a user’s email address and password on account.box.com/login.
- If the password is correct, the attacker’s browser is sent a new authentication cookie and redirects to: /2fa/verification.
- The attacker, however, does not follow the redirect to the SMS verification form. Instead, they pass their own factor ID and code from the authenticator app to TOTP verification endpoint: /mfa/verification.
- The attacker is now logged in to the victim’s account and the victim does not receive an SMS message.
Takeaways
MFA can provide a false sense of security. Just because MFA is enabled doesn’t necessarily mean an attacker must gain physical access to a victim’s device to compromise their account.
This highlights the need for a data-centric approach. CISOs should ask themselves:
- Would I know if MFA was disabled or bypassed for a user across all my SaaS applications?
- How much data can an attacker access if they compromise a normal user account?
- Is any data unnecessarily exposed to too many users (or exposed publicly)?
- If a user accesses data abnormally, will I get an alert?
It is recommended you start by securing data where it lives. When you limit access and monitor the data itself, your likelihood of data exfiltration due to a perimeter bypass drops significantly.
