Breaking Mobile Notification-Based Authentication with Concurrent Attacks Outside of Mobile Devices

About this work

Abstract

This work evaluates notification-based 2FA and passwordless authentication when an attacker controls software on the user's computer but does not compromise the phone, wearable, authentication service, or communication channel. It introduces a concurrent-login attack that blocks the legitimate session and launches a hidden attacker session, exploiting the limited contextual information shown in authentication notifications. The attack also supports cross-service scenarios in which the attacker targets a different service from the one the user intends to access. A proof-of-concept evaluation finds broad susceptibility among deployed systems, and a user study reports an 82.2% approval rate for cross-service attack notifications.