VK introduces 2FA and plans to make it mandatory in 2022

VK is finally introducing two-factor authentication on all its services and plans to make it mandatory in February 2022 for administrators of large communities.

VKontakte, or more commonly known as VK, is Russia’s most popular social media platform with over 650 million users,

Starting in February, all communities that count over 10,000 subscribers must be managed by a 2FA secured admin account to prevent large-scale phishing incidents.

There are over 140,000 communities of this size on VK, so this increased security requirement affects a considerable number of users on the platform.

The most recent example of such an incident was seen this Monday when scammers hacked into the official Yandex Go community on VK and sent phishing messages to all of its subscribers.

The platform was able to regain control of the compromised account within two minutes, but some users had already lost money as a result.

The new user protection program that adds 2FA on all services is called ‘VK Protect‘ and will also include a security control center for users, helping them assess their security stance, access new privacy settings, and follow relevant tips on how to improve their account security.

Anton Antropov, VK Information Security Director, stated (translated) the following concerning the upcoming features:

We are creating a comprehensive system to improve user safety. Our goal is not only to provide technical protection for profiles and data using existing tools such as two-factor authentication and encryption, but also to help people use them wisely.

In the same context of fighting phishing and security gaps that could be hiding in the platform’s apps and services, VK  has also announced the restart and expansion of its bug bounty program.

2FA is not always secure 

While rolling out 2FA for all VK services is undoubtedly a positive development for the safety and security of the platform’s users, it is not always a perfect system for securing your accounts.

Two-factor authentication is commonly set up to send one-time passcodes (OTP) via SMS text. However, if a user gains access to your phone number via a SIM swap attack, they will be able to access these OTP codes.

When configuring 2FA, it is advised to use an authenticator app, such as Authy or Google Authenticator, that is only accessible through your device. This way, if a threat actor performs a SIM swap on your mobile device, they will still not have access to your 2FA codes.

All in all, users shouldn’t depend on 2FA alone but instead take a holistic approach when it comes to account security and their online presence in general. This approach includes using unique, strong passwords for every online account and being on the lookout for targeted phishing emails.

Source: https://www.bleepingcomputer.com/news/security/vk-introduces-2fa-and-plans-to-make-it-mandatory-in-2022/