Analyzing 2FA Phishing Attacks and Their Prevention Techniques

Two factor authentication (2FA) provides a strong user authentication which increases the security of a vast range of web sites and their services. With its popularity, the 2FA still remains weak to attacks of phishing in which an attacker phishes the user's 2FA as well. In this paper, we analyzed how attacker captures the user 2FA using Man in The Middle (MITM) attack using reverse proxy, review past schemes proposed against this, and the 2FA-PP method by Ulqinaku et al where they introduced a mobile device connectivity to the user's browser that supports direct communication between the two devices through which the authentication will proceed, as a result bypassing the MITM. Finally, we discuss simpler measures the authentication protocols can assume where the integration is minimal and can be adapted easily both on the client and server side.