---
title: "Reverse Engineering Duo Mobile"
pubDate: 2023-12-01 18:57:00 -0500
draft: true
tags:
  [
    "re",
    "security",
    "duo mobile",
    "2FA",
    "android",
    "certificate pinning",
    "apk",
    "frida",
  ]
description: "Being restricted to Push notifications for 2FA is a pain - let's see what we can do about that."
---

My university uses Duo as it's primary 2FA provider. Unfortunately, each year Duo evolves into a more and more restrictive platform. Core services at UTSA (Canvas, ASAP, Degreeworks, Registration) are locked behind Duo, requiring manual, human intervention to access.

Effectively, automating access to services locked behind Duo is near impossible - not without some reverse engineering, at least.

## Entry Points

Duo is configured (at my university) to offer five different login methods:

- **Duo Push** (*default*)
  - A push notification is sent to a specific device, and the user must approve the login request.
- **Duo Mobile Passcode**
  - A passcode is generated inside the Duo Mobile app, and the user must enter it into the login prompt.
  - This method is one of the most interesting, as further research reveals that the passcode is a normal HOTP code, like those used by 99% of all 2FA providers.
  - In effect, Duo's authentication method is just a traditional 2FA code, but locked behind a proprietary app.
- **Text Message**
  - A text message with a 6-digit code is sent to the user's phone, and the user must enter it into the login prompt.
- **Phone Call**
    - A phone call is placed to the user's phone, and the user must answer and press **1** to approve, or **9** to report fraud.
- **Bypass Code**
  - A bypass code is a 9-digit code that can be used to bypass Duo authentication. These codes are generated by an IT Help Desk or Duo Admin, and are intended to be used in the event that a user loses access to their primary 2FA device.

## Passcodes and HOTP

This option is the most technically interesting, as it's the only option, that if reverse engineered, does **not** require a secondary device to exist outside of the Duo ecosystem. If one could figure out how passcodes are generated, one could generate their own passcodes, and use them to authenticate.

Most 2FA applications around the world use a standard called [HOTP][hotp] (HMAC-based One-time Password algorithm) provided by OATH to generate 2FA codes.

This standard is used by Bitwarden, Google Authenticator, Authy, and many other 2FA applications. They're ubiquitous, and they're easy to generate.

[hotp]: https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_algorithm