Google Doesn’t Fix Dangerous Vulnerabilities in Google Authenticator for Years

[DronVR]

Google hasn’t fixed a dangerous vulnerability in Google Authenticator for years

ThreatFabric specialists last month discovered the first-ever malware to steal two-factor authentication codes generated by Google Authenticator. Researchers called the malware Cerberus, and its function of stealing codes is still under development and has not yet been used in real attacks.

Cerberus is a hybrid of banking Trojan and Remote Access Trojan (RAT) for Android devices. After infecting the device using the banking Trojan functions, malware steals banking data. In the event that the victim's account is protected by the two-factor authentication mechanism of the Google Authenticator application, Cerberus acts as a RAT and provides its operators with remote access to the device. Attackers open Google Authenticator, generate a one-time code, take a screenshot of it, and then gain access to the victim’s account.

Cerberus is not only the first-ever malware with the functions of stealing one-time two-factor authentication codes. The Trojan uses a very simple technique for this - it creates a screenshot of the Google Authenticator interface.

Researchers at Nightwatch Cybersecurity Decided to study what exactly in Google Authenticator makes possible the functions of Cerberus, in particular the screenshot function. Android OS allows applications to protect their users from the ability of other applications to take screenshots of their content - for this, the FLAG_SECURE option must be added to the application settings. As it turned out, Google did not add this flag to Google Authenticator.

According to researchers at Nightwatch Cybersecurity, Google could fix this problem back in 2014, after one of the GitHub users wrote about it, but did not. The problem remained uncorrected in 2017, when Nightwatch Cybersecurity experts informed the company about it, and remains one to this day.

Source