Analyzing the Security of OTP 2FA in the Face of Malicious Terminals

About this work

Abstract

This paper evaluates seven commercially deployed one-time-password two-factor authentication schemes against malware running on the user's login terminal, without compromising the second-factor device, authentication service, or network. The authors develop lightweight attack modules that capture passwords and OTPs while launching a fresh hidden session locally or remotely. Testing across popular services and multiple OTP variants shows that almost all examined deployments can be defeated under this terminal-malware threat model. Because the attack runs in the background, requires no administrator privileges, and shows low detectability against common anti-malware tools, the results demonstrate that OTP 2FA may provide little additional protection when the authentication terminal itself is malicious.