The Password Reset MitM Attack

[Nytro]

Abstract—We present the password reset MitM (PRMitM)
attack and show how it can be used to take over user accounts.
The PRMitM attack exploits the similarity of the registration and
password reset processes to launch a man in the middle (MitM)
attack at the application level. The attacker initiates a password
reset process with a website and forwards every challenge to the
victim who either wishes to register in the attacking site or to
access a particular resource on it.
The attack has several variants, including exploitation of a
password reset process that relies on the victim’s mobile phone,
using either SMS or phone call. We evaluated the PRMitM
attacks on Google and Facebook users in several experiments,
and found that their password reset process is vulnerable to
the PRMitM attack. Other websites and some popular mobile
applications are vulnerable as well.
Although solutions seem trivial in some cases, our experiments
show that the straightforward solutions are not as effective as
expected. We designed and evaluated two secure password reset
processes and evaluated them on users of Google and Facebook.
Our results indicate a significant improvement in the security.
Since millions of accounts are currently vulnerable to the
PRMitM attack, we also present a list of recommendations for
implementing and auditing the password reset process.

 

Download: https://www.ieee-security.org/TC/SP2017/papers/207.pdf