Posted at 03-06-2025, 03:54 PM
(This post was last modified: 05-06-2025, 12:57 PM by lossauzasalle.)
They thought this approach would provide them with ironclad protection, especially after switching to otp tokens instead of regular mobile apps. The problem was that their validation system didn't limit the number of OTP entry attempts in any way, and on top of that, it used a predictable time offset. I removed the time range, validated 30 seconds forward and backward, and with a 10-thread brute force, obtained a valid code in 4 minutes. I can't say that this is a universal method, but in combination with social engineering, it sometimes works even against supposedly “invulnerable” solutions