On Data Protection Using Multi-Factor Authentication

Aaron Henricks Houssain Kettani

The Beacom College of Computer and Cyber Sciences The Beacom College of Computer and Cyber Sciences
Dakota State University, Dakota State University,
Madison, South Dakota, USA Madison, South Dakota, USA
[email protected] [email protected]

ABSTRACT security attacks, defenders need to stay one step ahead of attackers.
Multi-Factor Authentication (MFA) has been around for three Thus, a single password is no longer the preferred method of
decades and now authentication and security has taken priority in authentication since passwords can be easily guessed or cracked
securing data. Cyber-attacks have become widely popular and with the advanced computer hardware that is now readily
successful because organizations are poorly prepared to handle available to anyone. Accordingly, the advances in Graphical
cyber security operations. These organizations hold critical Processing Units (GPUs), Application-Specific Integrated Circuits
information about employees, customers and patients. Adding (ASICs) and Malware-Controlled Botnets (MCBs), has made it
additional security methods like MFA makes it more difficult for very easy to crack complex passwords [2]. Along with GPUs and
attackers to successfully exfiltrate data and cause additional ASICs, the password policies that are adopted from the National
damage. The methods of MFA can be used in combination to Institute of Standards and Technology (NIST) has contributed to
successfully secure data and provide adequate authentication common users creating basic and easy to remember passwords.
practices. In this paper, we discuss the implementations of MFA, Having users change their password every ninety days has made it
privacy behind using more than one authentication method and hard for the average user to remember complex and long string
also the security concerns related to MFA. We also reveal the passwords, therefore, resorting to passwords like a season and
flaws of MFA systems and discuss how these flaws can result in a year combination [3]. Since passwords alone are no longer
security breach. considered safe, MFA appears to be the next big implementation
for security. This paper will discuss the implementations of MFA,
CCS Concepts privacy behind using more than one authentication method and
• Security and privacy → Software and application also the security concerns related to MFA.
security → Software security engineering • Security and While MFA does provide another layer of hardened security,
privacy→ Security in hardware → Tamper-proof and MFA provides indirect security measures to alert if a security
tamper-resistant designs • Security and privacy → Human incident arises. Using proper log sources and logging tools,
and societal aspects of security and privacy → Privacy security analysts can correlate data to determine compromised
protections accounts. Many times, companies have external password facing
portals that can be accessed by anyone on the Internet. This can
Keywords lead to an attack using a password spray of usernames and
Authentication, Access Token, Cyber Security, Data Breach, Data passwords to try and compromise an account. By writing rules to
Privacy, Encryption, Multi-Factor Authentication (MFA). look at multiple bad password attempts with a successful
authentication, but a failure of a secondary authentication method
1. INTRODUCTION can result in an alert. Using this alert, security analysts can look at
The idea of Multi-Factor Authentication (MFA) was originally logging and start an investigation. Investigations can reveal
patented in 1996 by AT&T but has not been adapted to consumer information such as Internet Protocol (IP) addresses, scanning
use until very recently as companies have been slow to adopt the activity, and additional compromised accounts. Smart response
technology into their platforms [1]. With the increase of cyber plugins used in Security Information and Event Management
(SEIM) can automatically lock out accounts when certain criteria
are met. Proper logging and systems utilizing MFA can see the
hidden benefits of MFA.
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted without fee provided that copies are Adding another layer of security to an organization can be costly.
not made or distributed for profit or commercial advantage and that The MFA can be a cost-effective way to add additional security
copies bear this notice and the full citation on the first page. Copyrights
for components of this work owned by others than ACM must be honored.
measures to an organization. However, an organization needs to
Abstracting with credit is permitted. To copy otherwise, or republish, to consider if their infrastructure is able to handle MFA systems.
post on servers or to redistribute to lists, requires prior specific permission Many times, organizations run legacy systems that need to be
and/or a fee. Request permissions from [email protected]. updated to accept MFA. The latter is not something that can be
ISSM 2019, October 14–16, 2019, Rabat, Morocco. thrown into place and not maintained. Organizations need
© 2019 Association for Computing Machinery. resources to properly implement MFA and fix any flaws in the
ACM ISBN 978-1-4503-7289-3/19/10...$15.00 system. Additionally, an organization may need to decide to run
https://doi.org/10.1145/3394788.3394789 with phone plans or use token generators. Depending on what
infrastructure the organization has in place and the route of MFA
they take, the price of implementation can be costly.
Lastly, as biometric technology becomes the biggest preferred authentication possible. With a combination of something you
method of future MFA systems, the threat of cyber security know and something you are can make a difficult combination to
attacks will begin increasing towards biometric data. The latter is compromise. Physical attributes are unique to one person and
unique to a person but what happens once that biometric data is everyone has unique DNA sequence or fingerprints. The point of
leaked? The equivalent of biometric being stolen is having a MFA is to prove that the user is actually who they say they are.
password stolen. You can change a password but how can Biometrics provides a hard to replicate form of authentication.
someone change their fingerprint? Reversing DNA is a far-out Mix and matching a password and a form of authentication or two
technology but advances in science, the ability to recreate physical forms of duo authentication such as biometrics and a token makes
body components from DNA or biometric information will it even more secure [6]. There are millions of combinations of
continue to grow. The idea of MFA has been around for quite passwords, pins, and methods of authentication that can be used to
some time but the implementation of MFA into services people secure data and users.
use every day is still fairly new.
In proof of concept testing, MFA has shown to be very difficult to
The rest of this paper is organized as follows. Section 2 discusses defeat even with inside knowledge. As more organizations turn to
the challenges, methods, and benefits of implementing MFA into enable and adding additional authentication methods, comes into
an organization. Section 3 goes in depth about security flaws the concern of adding additional resources to the company [6].
within MFA and future targets cybercriminals will exploit to Depending on the type of authentication, smartphones or smart
defeat biometric authentication. Section 4 presents concluding devices may be purchased or maintained to provide adequate
remarks. support. Projects cannot be implemented and left to function all
the time. There may be overhead to the addition of MFA but key
2. MFA IMPLEMENTATIONS card readers that provide tokens is still a secure way to
There are several forms of Multi-Factor Authentication (MFA) authentication users. Along with the maintenance of the
that are being adapted to consumer and commercial grade authentication system, systems need to be up to date or changed to
products. For example, Short Message Service (SMS) text allow multi-authentication to work. Legacy systems may not
messaging has provided an additional step when logging in. This provide the capability to host such resources. There are no one-
is done by linking an account with a phone number, then a size fits all when dealing with authentication systems as each
confirmation code will be sent to authenticate the user [4]. organization has its own needs and depending on those needs may
Another example is biometrics, which has been around for a while require different authentication methods [7]. There can be a large
and has been recently adapted into smartphone technologies. overhead when integrating a secure system. Many companies put
Biometrics is a secure way to authenticate the user for whom they tasks, production, and convenience before security needs. This is
say they are. A physical unique identifier such as an iris or partially why the rollout of secondary authentication has proven to
fingerprint can be used as another form of authentication. There be relatively slow. Companies need to realize the harmful
are ways around biometric technology, but biometrics has been consequences of not pushing security as the first priority. It may
proven over time to work very well [5]. The most common form be understandable why security is not a top concern since it is a
of MFA is using an application on a cellular device. More support system while production is the money-making method.
companies are linking Two-Factor Authentication (2FA) methods What will it take for companies and organizations to realize that
to their platforms utilizing companies that specialize in security security should be the number one priority? Sadly, history shows
such as Google Authenticator, LastPass, and DUO Security. that security is an afterthought. A security incident will have to
These apps give the user a six-digit combination that changes occur where the company takes a large financial loss before the
every thirty seconds and is synchronized with the company’s system security is enhanced.
servers. Instead of a six-digit number, a prompt on a smartphone
will let the user accept or reject the authentication attempt. Before Using MFA can give an early indication of a compromise. It can
mobile applications, key cards were used to generate codes for also lead to determining compromised accounts by advanced
authentication. These codes commonly referred to as tokens and logging. Analyzing logs where users authenticate properly but fail
have paved the base to transform MFA into a more adapted the secondary authentication method or have the authentication
concept. The world has become a technologically advanced method time out can trigger a rule and give a security analyst an
society where people are now taking security as a priority. More alarm that this traffic was happening within the network. Logs
individuals are knowledgeable about technology and have forwarded to a SEIM tool such as Splunk or LogRhythm can give
technological devices such as smartphones to integrate additional an analyst a secondary look of what happened when
forms of authentication practices. authentication was failed. This also gives an IP address that can be
pivoted on to see what else that attacker was doing. There may be
Authentication methods can be broken down into three categories additional information about reconnaissance or additional
such as something known, something owned and something you resources being targeted. External facing infrastructure is the
are. Something known can be a secondary password or phrase [6]. primary target for attackers. Logging can give a good indication
Not as secure as additional security methods but can still be of a compromised user but without the secondary form of
categorized as an MFA method. This method can be subject to authentication, the account is rendered useless unless a token can
social engineering attempts or open-source intelligence to be hijacked, or a vulnerability used to bypass the authentication
determine what the second form of authentication could be. When method. Any critical infrastructure or systems should have an
referring to something owned this may be a keycard you have to MFA method enabled. It creates a thickened layer of security that
swipe after an additional password, or the token used from a third- can be very difficult to bypass. This eliminates a point of entry
party application such as DUO Security. This practice has become where another attack vector has to be used. It makes it much
widely adopted by organizations since it is considered to be the harder for an attacker to pivot around an organization if they do
safest and most secure method of MFA. Lastly, something you are not have domain credentials. Data privacy is a big concern to
is referenced to as biometrics which looks to take unique consumers, organizations and just about everybody. The
identifiers and physical characteristics to make identifiable protection of data is crucial in hiding private information. A
system can be patched a thousand times but there will always be a more adapted into devices and forms of authentication, this stands
vulnerability within it. Organizations are taking initiatives to to become an issue [5]. An example of a DNA database that could
patch vulnerabilities and reduce the risk of a data breach by lead to an incident and having this threat become a reality would
adding MFA methods and providing support to limit the be Ancestry (Ancestry.com), where users send DNA to the
possibility of a data breach or incident beings with proper company where it is tested and analyzed to determine links
password management and authentication methods. between other people and nationalities. This data is stored in a
database but also used to help tune algorithms and improve their
3. MFA SECURITY FLAW systems. A leak of information like this can lead to the
There is no such thing as a perfectly secure system. Facts need to compromise of biometric-enabled systems.
be brought forward to prove the security analyst’s hypothesis of
what occurred in an incident. This goes the same when assuming Not only does the compromise of biometric data hurt forms of
that infrastructure can be absolutely secure. An analyst cannot authentication but the data that is stored could be used in other
assume anything and to think otherwise provides an additional ways. As more companies and organizations use biometrics as a
risk to an organization. Security analysts can provide additional form of authentication, biometric data will become a target of
resources to reduce the risk of a security incident but that does not cybercriminals. Passwords have been the initial access vector
make it always secure. The mindset of a security analyst is that when stealing information. New forms of authentication will
anything can happen at any time. A new vulnerability found replace old forms but with new forms of authentication comes
yesterday could be used in an attack and there are no available different threats with it. The danger of biometric is real today but
patches to fix the issue. Adding additional resources can limit the without a way to replicate or use biometric data in a way that is
possibility but even with these additional resources, vulnerabilities useful to an attacker, there is no credible threat. Advances in
can live within them. A security flaw does not have to live in biological technology to recreate and use this data along with the
MFA. Social engineering has become a favorite of attackers push of biometric data will eventually be a real threat. Beside
because of the success behind it. Users are the best resource for a stealing biometric data to use to progress cyber security attacks,
company but also the easiest way for an attacker to access biometrics could be used in ransom [9]. With biometric data lies
information owned by an organization. There are ways around DNA. The research done on DNA could have an interesting
MFA and this section explores such security flaws. medical aspect to it. Analyzation of DNA could reveal
confidential records that otherwise should be kept private.
Security flaws exist in a lot of consumer grade software. While Attackers can leverage this data for ransom money. The future of
most of the security flaws are uncovered in the testing phase, biometric technology has a lot of potential to become the most
security flaws are always being uncovered in software that has secure way to authenticate but has a chance to become the next
been released for many years. Security flaws can lead to leaking big security breach.
of data and private information. It does not take the exploit of an
MFA flaw to compromise itself. Other systems can be exploited Another common form of secondary authentication is SMS text
to gain secondary authentication success. Biometrics is a great messaging. By linking a phone number to a service, the service
example of that. Biometrics is unique to a person and that person sends out a confirmation code to enter to perform a secondary
may use their fingerprint or some other physical characteristic to authentication. It is a good form of authentication in theory and
authenticate. This information is stored somewhere else. An practice. A Subscriber Identification Module (SIM) Card is very
attacker could target a database of stored biometric data. The difficult to spoof. An attacker could send a message spoofing a
compromise of physical traits used in biometrics is a big concern number but receiving information that was sent to the original
[5]. With that data of biometrics of others, an attacker could use number is tough [4]. While this is a possibility, it is more common
this information to replicate biometric features such as a for attackers to social engineer cellphone providers. By using
fingerprint to pass MFA. This proves to be a great vulnerability if social engineering and impersonating customers, attackers have
an attacker is able to actually use the information. This is the been successful in resetting accounts and moving numbers to a
biggest problem behind this compromise. The attackers actually different SIM Card. In turn, an attacker can then bypass secondary
have to do something with the data to make it a threat [5]. As authentication by using the code sent to that phone number. In
technology has advanced, so has biology research. The recent years, cellphone providers have become more
reconstruction of biometric entities based on DNA has become knowledgeable about social engineering attempts and have put in
more of a reality than futuristic movie betrayals. Fingerprint additional security steps to secure customers’ accounts [4]. Setting
brute-forcing has been discussed in the past as a method to defeat a Personal Identification Number (PIN), password and proof of
biometrics. Using an application that is allowed to send templates driver’s license has made it more difficult to modify account
to a system can start out using a simple fingerprint template. An settings without proper authentication. This has made it much
attacker then can modify the pixels and keep resubmitting until more difficult for an attacker to social engineer cellphone
successful authentication. However, this does not stop at providers. In recent years, cybercriminals have found other ways
fingerprints, as facial recognition can also be altered [8]. To stop to use SMS tokens to bypass 2FA. Using phishing and social
attacks like brute-forcing, putting a threshold for a number of tries engineering, cybercriminals have targeted Yahoo and Gmail email
would stop this type of attack. However, manipulation of a accounts. By sending out phishing emails to people, users were
biometric device could bypass this security feature. prompted to enter their credentials to log in. The webpage would
request to confirm their cell phone number, while the user
Any data stolen is considered a compromise of data and submitted their number, the webpage would make a request to
considered an incident but since the data that was stolen is send out a confirmation code. The user would then enter the SMS
personal to that user, that person only has one face, one iris, and token to the phishing website. At this point, the attacker has the
only nine other fingers. Maybe all those fingers were scanned into user’s credentials, a way to bypass 2FA, and access to their email
the system. At this point, biometrics is rendered worthless as account. The MFA is a good secure system but with anything, it
another form of authentication. A user cannot grow another finger can be defeated by using basic attacks like phishing and social
or modify their DNA footprint. As biometrics become widely engineering attacks.
Another common attack vector used for bypassing MFA is brute- authentication systems. IBM Systems Journal, 40(3), 614-634.
forcing tokens. If an attacker is able to successfully authenticate https://doi.org/10.1147/sj.403.0614
with the first step, an attacker will try to authenticate using [6] Vegh, L. (2018). Cyber-physical systems security through
another form. Brute-forcing tokens can be a way to bypass the multi-factor authentication and data analytics. Proceedings of
authentication methods [10]. However, with additional security the 2018 IEEE International Conference on Industrial
methods put into place such as the number of tries and a time limit, Technology (ICIT), Lyon, France, 1369-1374. Piscataway, NJ:
has made this method unpopular. However, if secondary IEEE. https://doi.org/10.1109/ICIT.2018.8352379
authentication is set up poorly and allows for unlimited attempts [7] Mao, Z., Florêncio D., & Herley, C. (2011). Painless
at secondary authentication, the possibility for a brute-force to migration from passwords to two factor authentication.
occur is significantly higher. Companies are now releasing push to Proceedings of the 2011 IEEE International Workshop on
phone accept or reject authentication attempts. This goes back to Information Forensics and Security (IWIFS), Iguacu Falls,
logging of a failed secondary authentication attempt, but users can Brazil, 1-6. Piscataway, NJ: IEEE.
also be vigilant of signs of compromise. An uneducated user https://doi.org/10.1109/WIFS.2011.6123150
accepting the second form of authentication from a smartphone [8] Martinez-Diaz, M., Fierrez-Aguilar, J., Alonso-Fernandez, F.,
device would make it look like a legitimate authentication. Ortega-Garcia J., & Siguenza, J.A. (2006). Hill-climbing and
Logging and alarms built around this activity are rendered brute-force attacks on biometric systems: A case study in
worthless and a compromise of an organization’s resources could match-on-card fingerprint verification. Proceedings of the
occur. 40th Annual 2006 International Carnahan Conference on
Security Technology, Lexington, KY, 151-159. Piscataway, NJ:
4. CONCLUDING REMARKS IEEE. https://doi.org/10.1109/CCST.2006.313444
The protection of data is crucial to maintain critical operational [9] Goodman, M. (2015, February 24). Fingerprint and iris
information for a company. The use of additional resources like scanners seem secure, but they aren't hack-proof. SLATE.
MFA has been utilized to establish control over data. Passwords Retrieved from https://slate.com/
by themselves no longer provide the necessary security for critical [10] Amir, S. (2017, July 15). 4 Methods to Bypass two factor
infrastructure and data. Not only does Multi-Factor Authentication Authentication. Shahmeer Amir. Retrieved from
(MFA) add an additional step when authenticating users but also https://shahmeeramir.com/
adds another layer of assurance and security. Logging of MFA
attempts can be viewed and used in security analyst work. With
proper logging and alarming, a compromise of a user account can
be quickly handled. The combination of a password and another
form of authentication can provide an adequate layer of security.
A combination of MFA solutions can strengthen the security of a
company or organization. Biometric technology is the front runner
in the advancement of MFA. The development and research of
biometric are being integrated into many platforms and stands to
be the easiest way to authenticate. Biometric data is difficult to
replicate and unique to each user. However, with the advancement
in DNA research, there stands to be data exposure of biometric
data that can be used to further escalate into security attacks or the
ransom of DNA information. As security becomes higher priority
and systems are strengthened with security in mind, social
engineering attempts will become more widely used. Passwords
are no longer the best secure method. While MFA is not full proof,
it does add an additional layer of security that can stop access to
confidential data.

5. REFERENCES
[1] Brodkin, J. (2013, May 23). Kim Dotcom claims he invented
two-factor authentication-but he wasn't first. Ars Technica.
Retrieved from https://arstechnica.com/
[2] Korolov, M. (2017, November 14). How hackers crack
passwords and why you can't stop them. Cyber Security
Online (CSO). Retrieved from https://www.cso.com.au/
[3] BARR Advisory (2018, June 11). Follow these NIST
guidelines to boost password security. BARR Advisory.
Retrieved from https://www.barradvisory.com/
[4] Fujii, H., & Tsuruoka, Y. (2013) SV-2FA: Two-factor user
authentication with SMS and voiceprint challenge response.
Proceedings of the 8th International Conference for Internet
Technology and Secured Transactions (ICITST-2013),
London, UK, 283-287. Piscataway, NJ: IEEE. https://doi.org/
10.1109/ICITST.2013.6750207
[5] Ratha, N. K., Connell, J. H., & Bolle, R. M. (2001).
Enhancing security and privacy in biometrics-based