About Us

Laser Focus World is an industry bedrock—first published in 1965 and still going strong. We publish original articles about cutting-edge advances in lasers, optics, photonics, sensors, and quantum technologies, as well as test and measurement, and the shift currently underway to usher in the photonic integrated circuits, optical interconnects, and copackaged electronics and photonics to deliver the speed and efficiency essential for data centers of the future.

Our 80,000 qualified print subscribers—and 130,000 12-month engaged online audience—trust us to dive in and provide original journalism you won’t find elsewhere covering key emerging areas such as laser-driven inertial confinement fusion, lasers in space, integrated photonics, chipscale lasers, LiDAR, metasurfaces, high-energy laser weaponry, photonic crystals, and quantum computing/sensors/communications. We cover the innovations driving these markets.

Laser Focus World is part of Endeavor Business Media, a division of EndeavorB2B.

Laser Focus World Membership

Never miss any articles, videos, podcasts, or webinars by signing up for membership access to Laser Focus World online. You can manage your preferences all in one place—and provide our editorial team with your valued feedback.

Magazine Subscription

Can you subscribe to receive our print issue for free? Yes, you sure can!

Newsletter Subscription

A Laser Focus World newsletter subscription is free to qualified professionals:

The Daily Beam

Showcases the newest content from Laser Focus World, including photonics- and optics-based applications, components, research, and trends. (Daily)

Product Watch

The latest in products within the photonics industry. (9x per year)

Bio & Life Sciences Product Watch

The latest in products within the biophotonics industry. (4x per year)

Laser Processing Product Watch

The latest in products within the laser processing industry. (3x per year)

Get Published!

If you’d like to write an article for us, reach out with a short pitch to Sally Cole Johnson: [email protected]. We love to hear from you.

Photonics Hot List

Laser Focus World produces a video newscast that gives a peek into what’s happening in the world of photonics.

Following the Photons: A Photonics Podcast

Following the Photons: A Photonics Podcast dives deep into the fascinating world of photonics. Our weekly episodes feature interviews and discussions with industry and research experts, providing valuable perspectives on the issues, technologies, and trends shaping the photonics community.

Social Media

Bluesky • Facebook • Instagram • LinkedIn • YouTube

Meet the Laser Focus World Team

Editorial

Sales

Editorial Advisory Board

  • Professor Andrea M. Armani, University of Southern California
  • Ruti Ben-Shlomi, Ph.D., LightSolver
  • James Butler, Ph.D., Hamamatsu
  • Natalie Fardian-Melamed, Ph.D., Columbia University
  • Justin Sigley, Ph.D., AmeriCOM
  • Professor Birgit Stiller, Max Planck Institute for the Science of Light, and Leibniz University of Hannover
  • Professor Stephen Sweeney, University of Glasgow
  • Mohan Wang, Ph.D., University of Oxford
  • Professor Xuchen Wang, Harbin Engineering University
  • Professor Stefan Witte, Delft University of Technology
My Watchlist
Indicators
Industrial Laser Index
Markets
Stocks
ETFs
Tools
Markets:
Overview
News
Currencies
International
Treasuries

BTR: Understanding the Critical 2FA Vulnerability in QR Code Enrollment Processes Uncovered by Silent Sector – Lauro Chavez

By: PRLog

SILVER SPRING, Md. - Oct. 1, 2024 - PRLog -- Silent Sector, a leading cybersecurity firm specializing in protecting mid-market businesses, has discovered a major flaw in the two-factor authentication (2FA) enrollment process that could leave millions of organizations vulnerable to cyberattacks. The vulnerability lies in the use of QR codes for 2FA, a common security practice across industries, and poses an urgent threat to the security of organizations that rely on this method to protect sensitive accounts.

The vulnerability Silent Sector identified is related to the secret key embedded in QR codes used for 2FA enrollment. When users scan a QR code to link their authentication apps, such as Google Authenticator or Microsoft Authenticator, to access their accounts, the secret key that allows this link never expires. This creates a critical security risk: if a QR code was sent via email, saved to a device, or stored in a repository, hackers could potentially access that code, re-enroll in the 2FA process, and bypass account security measures.

"Many organizations trust QR codes as part of their authentication systems, but this discovery shows a significant gap in security," said Lauro Chavez, Partner and Head of Research at Silent Sector. "The issue is that these QR codes, and the secret keys they contain, can be reused indefinitely. That's a massive risk if they fall into the wrong hands."

The Scale of the Threat

Two-factor authentication, or 2FA, is widely used by businesses and individuals to add an extra layer of security to account logins. The process typically requires users to enter not just a password but also a one-time passcode (OTP), which is generated by an authentication app on a user's phone. This is typically performed after enrolling in the multi-factor authentication process. This process is frequently enabled by scanning a QR code during the initial setup.

Indeed, for the better part of a decade, QR code-based 2FA has been considered a highly secure method because it was believed that the secret key embedded in the code expired after the initial setup. However, Silent Sector's discovery reveals that this is not the case. The secret key embedded in the QR code remains valid indefinitely, allowing a malicious actor to use it to re-enroll and gain access to accounts even if the original user is unaware.

"This vulnerability has the potential to impact millions of businesses worldwide, especially those in the mid-market, which may not have the resources or expertise to deal with such sophisticated threats," Chavez explained. "The ability to reuse these codes without expiration is particularly concerning, as many organizations may not even realize the risk."

To read the remainder of the interview, please visit:
https://bit.ly/3zEuqTs

Photos: (Click photo to enlarge)

Lauro Chavez, Silent Sector


Source: Silent Sector

Read Full Story - BTR: Understanding the Critical 2FA Vulnerability in QR Code Enrollment Processes Uncovered by Silent Sector – Lauro Chavez | More news from this source

Press release distribution by PRLog

More News

View More
3 Overlooked Value Stocks Set to Surge as Rates Drop
Via MarketBeat
Topics Artificial Intelligence Economy
Tickers CAVA CMG LULU UPS
Hims & Hers Stock Pushes to Highs on Healthcare Rate Cut Frenzy
Via MarketBeat
Topics Economy
Tickers HIMS
After the Fed's Rate Cut, PNC Could See a Mortgage Refinance Boom
Via MarketBeat
Topics Economy
Tickers PNC
AIRO Group's Pullback: An Undervalued Growth Opportunity?
Via MarketBeat
Topics Supply Chain
Tickers AIRO
Caterpillar Stock Hits All-Time High—Is There More Room to Run?
Via MarketBeat
Topics Artificial Intelligence Economy World Trade
Tickers CAT
Stock Quote API & Stock News API supplied by www.cloudquote.io
Quotes delayed at least 20 minutes.
By accessing this page, you agree to the following
Privacy Policy and Terms Of Service.