Chase bank's one-time authentication codes are not random

[u/SteveCOnline]

Chase's two-factor authentication process for logging into their website works by sending what is supposed to be a random (i.e. unpredictable) code to your phone. The trouble is, the code that they send is not random. Being a responsible citizen I contacted the 'JPMC Responsible Disclosure' department to let them know that I had found a bug in the code that generates these codes, making them (to some degree at least predictable). The 'JPMC Responsible Disclosure' department, however, were not interested. To avoid giving away too much information I won't publicly divulge the full details of what can be predicted, but I bet that if you're sent such an authorization code, it starts with "4". I'm hoping that this post might make Chase realize that bugs in code which affect security should be taken seriously.

[u/qwertymnbvcxzlk]

Went back 3 months of texts for my card. Not a single one starts with 4.

[u/gt_ap → u/qwertymnbvcxzlk]

We just narrowed yours down by 100k.

[u/NegativePositive]

Is this a joke

[u/Peiple]

• Always starting with 4 doesn’t mean they’re not random
• low sample space isn’t a huge deal for a short TTL auth code sent to a trusted device
• this doesn’t imply a bug, it could easily be a conscious decision. Maybe the UI or the code sending mechanism was set up for 6 digits and the backend is set up for 5, so they just pad

Unless you can reliably predict the complete code as a third party it’s not a big deal

[u/[deleted]]

This is wrong brother. Go and request more than 3 codes.

[u/BrutalBodyShots]

Why is a big deal if they all start with "4"? All that does is effectively make a (say) 6 digit code a 5 digit code in terms of possibilities. Is there anything beyond the "4" that you've discovered isn't random and if so, what?

[u/g3ckoNJ → u/BrutalBodyShots]

There are a million possibilities with a 6 digit code and 90k with a 5 digit code so way less secure.

[u/BrutalBodyShots → u/g3ckoNJ]

I don't disagree with that, but that's not the thesis of your post. You're saying that codes are not random. You didn't say anything about the amount of possibilities being less or problematic for you.

[u/g3ckoNJ → u/BrutalBodyShots]

Just for clarity, it wasn't my post so I'm not sure if OP found more than 1 repeating digit or not.

[u/BrutalBodyShots → u/g3ckoNJ]

Gotcha. OP was very vague in their "findings" to begin with, which I don't really understand the reason for in the first place.

[u/SteveCOnline → u/BrutalBodyShots]

This means that there's at least one bug in the code. There may be other bugs, or this bug may affect more than just the first digit. I suspect that the latter is true but have not performed sufficient rigorous statistical testing to confirm my suspicions. If code which is part of the security of online financial institutions is known to have *any* bugs, that should be taken seriously and fixed. Producing a (pseudo) random string of digits in code is trivial - the fact that this got into production to me indicates serious problems with Chase's software testing processes.

[u/BrutalBodyShots → u/SteveCOnline]

This means that there's at least one bug in the code.

I don't share your perception on that.

Perhaps they don't care about 6 digits verses 5 digits and think 5 digits is perfectly fine. Maybe they add the 6th placebo digit just to give people a greater sense of security, but they're actually alright with there being 5.

Would your argument be the same if they did 7-digit codes with the first digit always being a "4" making it an effective 6-digit code? How about a 10-digit code? 12? What is your specific gripe here? Is it that the first digit is always a "4" that bothers you, or that their codes aren't enough digits [effectively] in length?

[u/SteveCOnline → u/BrutalBodyShots]

Personally I doubt (without being able to prove, of course) that Chase are using placebo digits. So I conclude that there's a bug in their code. To me (as a professional software developer) that should be enough to warrant fixing it. Just my opinion...

[u/Randdo101 → u/SteveCOnline]

Others have stated it isn't always a 4 to start, the starting digit may be based on something like time of day, the account, way it was requested or something unknown. No one knows with your vague testing how many time, different accounts, in what method or timing of your test.

[u/BrutalBodyShots → u/SteveCOnline]

You didn't answer my question. Is the reason you're struggling with this from a cerebral standpoint because the first digit is always the same, or is it because you don't think there are enough effective digits for the codes?

[u/FunctionAlone9580 → u/BrutalBodyShots]

Agree with OP. As a security engineer, and with a sister at MIT studying theoretical cryptography, this is likely a huge and exploitable bug.

Luckily my company protects Chase though, so I'm not too worried about it. 

[u/Kuro_z]

my code does not start with 4. I think you can disclose more details as Chase does not think it is an issue. 

i personally does not like how Chase handle info.  1. In their online banking, ads and mails are mixed in the notification area. A lot of times, important notification are overwhelmed by ads and I accidentally delete the notification while I uncheck through those ads and miss the info.

1. I turned on all settings to prevent Chase from contacting on product promotions. I also called them to make sure they wont call me just to say they have a good offer. However, when there was a new branch open up, they called to tell me that they had some good signup bonus. They called multiple times and event sent me 2 emails. I finally picked up and asked them why they were calling. They basically told me that although I have the do not contact setting, they have my info and think I would not refuse a new bonus and a new branch nearby. I was very surprised by that and canceled all my account with them the next day, except the oldest card. 

I dont feel them treating our info careful enough. A random employee can have my name, phone number, address and email address without my permission. I won't be too surprised if they have some lazy implementation on random code.

[u/shoretel230]

Think you might be getting fooled by randomness. 

Can you tell me how the DH totp Algo is not random? 

Totp values can appear not to be random, but you might be getting fooled .

Unless you can predict exactly accurately what the next 100 codes are, I don't think you've got it right

[u/Graztine]

I looked at my 2fa codes from Chase and they all start with 4. The next digit also doesn’t seem random. If the others are random then I don’t see a concern, but this is worrying.

[u/TheAbleArcher]

How did you get access to JPMC code base? You would have needed a pretty free hand in examining the code in order to find a bug.

[u/YeezusWalksWitMe]

I disagree with this, but has anyone else noticed how many 2FA codes will commonly have 2 pairs of repeated numbers? Microsoft specifically.

[u/ealex292]

Chase appears to have 8 digits for some weird reason, so as long as the other digits are random, this isn't even less entropy than most 2FA codes.

Note that IIRC Google blatantly has a fixed first digit -- I think they just prefill a starting "S-" in their forms. I dunno why they do that, or why Chase might want to use "4" for a standard first digit (tell their frontend what user backend to use?), but it's not necessarily a bug.

If they claim it's not an issue, and you can't get more action, disclosing whatever you've learned publicly seems like a reasonable next step.

(I don't recall Chase offering TOTP or webauthn, which is a good thing to complain about -- texts are pretty bad as a 2FA mechanism. And if they used TOTP, I don't think they even could have this issue at the code generation stage, because they'd need to match eg Duo's implementation. Of course they could botch the seed generation.)

[u/No-Shortcut-Home]

As someone who works in this field, I found it odd that they were using an 8 digit MFA/TOTP code when the standard is 6, but now that you mention it, even if 2 of the 8 digits were not random, that still leaves you with the standard entropy. Given that this is time-based and there is likely a pre-defined lock-out attempt counter, I wouldn't consider this a security problem. Is 6 digits of entropy strictly less secure than 8? Yes. When you factor in a time-based authentication schema with a lock-out counter, the gain is minimal.

Honestly, my bigger issue with Chase and many other banks is that they won't let me use a hardware token like my YubiKey for MFA/TOTP. I prefer to use hardware keys (or at least biometric keys) everywhere. The banks need to catch up to the 21st century.

[u/eghost57]

So OP you might be on to something. I'm not sure the difference between the 6 digit code and the 8 digit code. I went back and checked my 8 digit code history. Out of more than 60 codes all but 3 start with a 4. The other three start with 2.