<![CDATA[In the digital era, two-factor authentication (2FA) is used as an additional security measure to protect user access to digital services. However, the storage methods of authentication data in 2FA applications have potential security vulnerabilities that can be exploited. This study analyzes five popular 2FA applications, namely Google Authenticator, 2FAS, Aegis Authenticator, Okta Verify, and TOTP Authenticator, focusing on how secret keys are stored and the potential exploitation risks. The experiment was conducted in a virtual Android environment using rooted BlueStacks 5. Data acquisition was performed using Media Manager and X-Plore File Manager, followed by data analysis with SQLite Browser and bypass with PyOTP. The results indicate that some applications store secret keys in plaintext or weak encryption, making authentication bypass possible by manually generating OTP codes. This study concludes that strengthening data storage security in 2FA applications is crucial to prevent unauthorized exploitation by malicious actors.]]>
Copyrights © 2025
