Downgrade/Recovery Attacks

This chapter covers downgrade/recovery attacks against multifactor authentication (MFA) solutions, focusing on alternative authentication methods vendors provide to recover MFA‐protected accounts. It describes three common attack types specifically related to recovery issues: alternate email address recovery, master code abuse, and guessing personal‐knowledge questions. Attackers abuse alternate email address recovery in at least two ways: takeover of alternate email addresses and rerouting recovery. Of all the ways someone can recover their MFA‐protected account, perhaps answering, fairly simple, preregistered personal‐knowledge questions is the least secure and easiest of all to hack. The chapter presents some developer defenses to downgrade/recovery attacks, including threat model recovery and adaptive personal‐knowledge questions. It also suggests some user defenses to downgrade/recovery attacks, including avoiding personal‐knowledge questions, giving wrong answers, and protecting master codes.