# Timing Attack in Google Authenticator - Per User Prompt

WordPress Google Authenticator plugin used strict === on SHA1 app-password hash, enabling timing attack to brute-force app password and bypass OTP for account takeover.

- Payout: $25
- Severity: high
- Program: Ian Dunn
- Credited: whitehatter
- Disclosed: 2017-10-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/277534
- Library page: https://bugbountylibrary.com/r/h1%3A277534
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:source-review vuln:auth-bypass vuln:crypto vuln:mfa-bypass

**Target:** WordPress plugin authenticate hook app-password check
**Root cause:** App password validated with non-constant-time strict equality (sha1(...) === $valid_password_hash) instead of hash_equals(), leaking byte-by-byte timing information.
**Steps:**
1. Enable app password for a target account (non-default).
2. Send repeated login requests to the authenticate hook with candidate app passwords.
3. Measure response timing to infer matching SHA1 prefix bytes.
4. Iteratively recover the full hash prefix via timing oracle.
5. Submit recovered app password; OTP check is skipped because is_using_application_password is true.
**How found:** Code review of the plugin's authenticate hook spotted strict === comparison on a hash and noted hash_equals() was already used elsewhere in the same class, indicating an inconsistency.
**Exploitation:** Attacker repeatedly submits login attempts with crafted app passwords, measuring response time to recover the SHA1 hash byte-by-byte via the non-constant-time comparison, then logs in without the real password or a valid OTP token.
**Insight:** When a plugin uses hash_equals() in one auth path but === in another, the inconsistent path is a timing oracle; also check whether bypassing one check (app password) skips a second factor entirely.