Breaking Mobile Notification-based Authentication with Concurrent Attacks Outside of Mobile Devices

Notification-based authentication is an emerging Two-Factor Authentication (2FA) and passwordless solution that leverages interactive notifications on mobile devices to establish an additional layer of security beyond passwords. This method has gained popularity due to its convenience and ease of deployment in organizational settings. In this work, we aim to evaluate the effectiveness of notification-based authentication systems when a malicious entity is present on the user's computer, such as a keylogger or malicious extension, without compromising the mobile devices or communication channels. Furthermore, we investigate how the lack of information provided to users during the authentication workflow can lead to the approval of malicious authentication requests. Notably, we highlight the vulnerability of cross-service attacks, where an attacker authenticates to Service B while the user is attempting to authenticate to Service A. Our proof-of-concept attack program demonstrates the susceptibility of various notification-based authentication systems, and our user study reveals an alarming 82.2% cross-service attack success rate. These findings suggest a potential vulnerability in notification-based authentication systems, where the attacker compromise user account without compromising possession-factor device, such as smartphones.