How to Bypass 2FA Gmail Protection and Google 2-Step Verification on Android Devices?

2FA is a great way to add extra protection to your online accounts beside a username and password. But, what if you need to turn off 2FA?

Is it even possible to bypass 2FA Gmail security?

It is and if you need to bypass 2FA or factory reset protection on your device, for any reason, this article will explain how to do that.

What is 2FA?

2FA or 2-factor authentication is an additional protection layer to the already existing login information. This ensures that the person trying to log in to an online account is who they say they are.

In other words, 2FA kicks in right after you enter your username and password, but before gaining access to the account. Instead, with 2FA Gmail, you need to provide an extra piece of info.

This can be:

Something you have: Token, smartphone, credit or debit card;
Something you know: A PIN, keystroke pattern, password, or an answer to a secret question;
Something you are: Biometric patterns, iris scan, voice recording, fingerprint, handprint, etc.

How do I Turn on 2FA Gmail Protection?

To turn on 2FA for Google account verification, follow these steps, as explained in Google Support:

Go to your Google account by clicking your image an selecting Manage your Google Account;
Select Security from the navigation panel on the left side;
Select 2-step verification under Signing into Google;
Click the Get Started buttonand follow the on-screen steps.

Now let’s say you forgot or lost your 2FA and you need it for Google account verification.

How to Bypass 2FA Gmail Protection?

Can 2FA be bypassed?

Of course, and there are several methods this can be done. We’ll talk about the five most common, but if you’re interested, read this report by KnowBe4 which mentions 11 ways to bypass Google 2-Step verification.

1) Using the Password Reset Function

This is what the hackers did in the example above. They sent a fake Gmail alert, phished an SMS token and finally had their victims reset their passwords.

2) Using an OAuth Mechanism

Another 2FA Gmail bypassing method is to use a 3rd party login mechanism called OAuth. If you’re not familiar with OAuth, this is when you use Google or Facebook to log in to another account.

Although this is a convenient way to log in to a website and Google or Facebook should be safe, it’s also a way for the hacker to bypass 2FA. Instead, they can use OAuth integration to log in without needing the login credentials.

3) Using Race Conditions

A “race condition” is the repeated usage of a previously known value, such as the app’s ability to use used or unused tokens later. For this, the hacker would first need to have access to those previous values, which they can get by intercepting a previous code.

4) Using Brute Force

Finally, if there is no rate limitation in the input fields, an attacker can attempt to brute force the 2FA code, especially if it’s number-based. As the normal length of a code is 4-6 numbers, that’s “only” 151,800 possibilities. You don’t need a supercomputer to crack that.

Also read: 18 Types of Cyber Security Threats You Should be Aware of and How to Deal With Them.

5) Using Social Engineering

For this, the hacker needs to have the target’s username and password already. With that, they can send out an email to their victim, with a Google verification code request that was sent to the target’s number. Once the target sends the code, the attacker can easily bypass 2FA.

In another case scenario, the hacker can trick the user into clicking on a phishing link in an email, where the user will provide their credentials.

Then, the hacker can use these to log in to the real site. When the target also receives and enters the code, the hacker will see this on the fake site and can enter the code on the real site to bypass 2FA.

Can 2-Factor Authentication be Hacked? How Hackers Can Get Around 2-Factor Authentication?

Can hackers bypass 2-step verification?

In 2018, hackers were able to bypass Gmail and Yahoo 2FA verification. Those same hackers also created phishing sites for secure email services like ProtonMail and Tutanota.

According to an Amnesty International report, the users first received a fake Gmail security alert about their account being compromised and having to change their passwords.

Next, they were sent to a fake Google or Yahoo site where they had to enter their login credentials. From this page, the targets were redirected to another page telling them that they’ve been sent a Google verification code via SMS.

Upon entering the code, the user would see the password reset form. If they did reset, the hackers were given full access to their accounts.. Since the Google spoof email looked like a legitimate email from Google, few who got it looked at it twice.

How to Bypass Google 2-Step Verification on Your Android Phone?

Check out: 15 Easy Ways to Make Your Android Phone More Private and Secure

According to Litmus, in 2018 (June), 46% of email opens came from mobile devices, while 35% came from webmail and 18% from desktops.

You probably signed in to your email account from your device once or twice at least.

But a phone can drop out of your pocket, get forgotten in the restaurant, lost, or even stolen in many ways.

That’s why Google introduced new security features with Lollipop 5.1. One of the biggest is the Factory Reset Protection (FRP) or Google Account Verification.

What Does Google Account Verification do?

Before Android 5.1 Lollipop, a simple factory reset was all that was needed to bypass Google 2-step verification on your device.

As of Lollipop and thanks to Factory Reset Protection, this is no longer the case. Instead, if you try the factory reset to bypass Google account verification, the following message will show up on the device screen:

“This device was reset. To continue sign in with a Google account that was previously synced on this device.”

Obviously, this is a great way to protect your device in case it gets stolen or lost. However, the problem is when you purchase the device from a 3rd-party reseller and can’t unlock it.

Fortunately, there is a way you can bypass Google FRP Lock.

Bypass Google Account Verification Lock With an FRP Bypass APK

A lot of Samsung users report that this FRP Bypass method works for them.

In this case, you need:

An OTG cable;
USB stick;
Your PC;
Your Android phone;
FRP bypass APK.

A stable WiFI nNetwork Connection (Read: how to secure your home network)

To bypass Google 2-step verification:

Download an FRP bypass APK and copy it on your USB stick;
Restart your Android device (press and hold the power and volume down keys for 7+ seconds);
Connect the phone to the WiFI network (skip the Insert SIM card screen);
Check “I understand and agree to the terms and conditions above” and “No thanks”;
Tap Next;
Put the USB stick in your PC when you see the FRP Lock message;
Connect your Android and PC using the OTG cable and wait for the File Manager to kick in;
In the File Manager, tap Bypass Any Samsung Account Lock;
Tap on the next folder to open it and tap on the .txt file: Bypass Any Samsung Lock.apk;
Tap the Settings button when the Install Blocked message appears;
Go to Unkown Sources in the Settings (the gear icon);
Check Allow this installation only and tap OK;
In the Development Settings screen, tap Install under Do you want to install this application?;
Tap Open once the installation finishes;
Go to Settings and select Backup and Reset;
Tap Factory Data Reset on your phone;
Next, tap Erase Everything and wait a couple of minutes to finish;
The phone will now reset and you’ll see the initial setup screen;
Finally, remove the OTG cable from your devices and do the setup again. The FRP bypass is complete.

Disable FRP Bypass by Removing Your Google Account

This method works if you’re the one selling the phone, but not if you’re buying it.

Open Settings on your phone;
Tap Accounts;
Select your Google account;
Tap Remove Account and confirm.

Bypass Google Account Verification From the Setup

In order to bypass Google 2-step verification during setup, you’ll need to do the following:

Navigate to Settings > General Settings > Reset;
Follow the setup process until you get to Connect to the WiFi Network;
Tap the WiFi password textbox;
A Google keyboard will appear. Tap & hold the Spacebar and select English (or your native language);
Back in the WiFi connection screen enter your network password;
After a while, you’ll be prompted to enter your Google Account information. Enter your email address;
Press and hold the @ symbol;
Go to Google Keyboard Settings;
Tap the three dots menu;
Select Help & Feedback;
On the next screen, select Search Google & send results from your keyboard;
This will open a web page. Press and hold anywhere until you see a menu appear;
Tap Web Search within that menu and select Google App;
Tap the gear icon to open Settings;
Select Backup & Reset;
Tap Factory Data Reset;
Now, when you go through the setup, you can skip Google Account Verification and bypass Google FRP.

Reset Your Android Device to Bypass Google FRP

Finally, the fourth method to remove Google 2-step Verification is to reset your Android device:

Start the reset process on your Android device;
Tap Back when the Google Account Verification screen appears;
Select Add Network in the Wireless Network selection screen;
In the text box for the Network Name enter something randomly;
Press and hold to highlight the random string you entered;
Press Notification and go to App Settings;
Tap the three dots menu, select Account and go to Settings;
In the Settings menu, select Backup and Reset>Factory Data Reset.

Conclusion

Having 2FA protection is way better than not having just a username and password to protect your phone or other devices, but it’s still not 100% secure. As you can see, it is possible to bypass Google 2-step verification.

If you don’t want to be the one getting your hacked email hacked, make sure to use a secure email provider that includes a phishing protection mechanism and has zero-knowledge password protection.