Google Authenticator: Serious security breach could cause many accounts to be stolen

Other affected 2FA applications

March 9, 2020 at 5:24 pm Reading time: 1 minute

Two-factor authentication can make your account more secure. However, anyone using Google Authenticator could be a target for the new Trojan. These vulnerabilities exploited a strange divide and even affected other applications.

Serious misconfiguration of Google Authenticator could lead to account theft. (Source: BrianAJackson / depositphotos.com)

The purpose of two-factor authentication (2FA) is to protect your account with a second level of security. When you log in, an additional code is generated that must be entered to access it. However, 2FA apps for Android (such as Google Authenticator or Microsoft Authenticator) have known security vulnerabilities.

The Android version of these 2FA applications allows screenshots to truly record the generated code, such as ZDnet reports. At the same time, there are even Trojan horses specifically designed to open Android applications and take screenshots of the generated code and send it to hackers. These can then be logged into your account.

Best virus scanner for Android

Go to gallery

Controversial: The security breach was reported to Google in 2014. Just a few changes to the application code can prevent the screenshot feature. Microsoft was also informed of a misconfiguration on Github in 2018. Nothing happens in either application.

Not all 2FA applications are affected, but most

Now, we have downloaded some applications on the Android smartphone and tried to take screenshots in the program. In addition to Google and Microsoft versions, the popular 2FA applications Authy and 2FSA Auth are also affected. In LastPass Authentificator and andOTP only, we cannot take screenshots.

Of course, your smartphone must first be infected with this particular Android Trojan. Our tips for the best antivirus programs in Android will help you. Despite the security vulnerabilities of the applications mentioned above, two-factor authentication is still a tried and tested method for hacking. The linked article explains how to set up a secure 2FA process.