Is Real time Phishing Eliminated with FIDO? Social Engineering Downgrade Attacks against FIDO Protocols
FIDO's Universal 2 Factor (U2F) is a web authentication mechanism designed to provide resilience to real time phishing a class of attacks that undermines multi factor authentication by allowing an attacker to relay second factor onetime tokens from the victim user to the legitimate website in real time. A U2F dongle is simple to use, and is designed to ensure users have complete mental models of proper usage. We show that social engineering attacks allow an adversary to downgrade FIDO's U2F to alternative authentication mechanisms. Websites allow such alternatives to handle dongle malfunction or loss. All FIDO supporting wesbites in Alexa's top 100 allow choosing alternatives to FIDO, and are thus vulnerable to real time phishing attacks. We crafted a phishing website that mimics Google login's page and implements a FIDO downgrade attack. We then ran a carefully designed user study to test the effect on users. We found that, while registering FIDO as their second authentication factor, 55 of participants fell for real time phishing, and another 35% would potentially be susceptible to the attack in practice.
IACR Cryptol. ePrint Arch.