8 ms·

Can you or someone else explain/link to me the basics of why SMS-based 2FA is so terrible? I've never really heard the sentiment before, but it appears to be co

Can you or someone else explain/link to me the basics of why SMS-based 2FA is so terrible? I've never really heard the sentiment before, but it appears to be common knowledge.

DennisAleynikov 8y ago
TOTP clients cannot be intercepted where as sms tokens can be compromised in a variety of ways.
- whitepoplar 8y ago
  TOTP tokens can absolutely be intercepted. A MITM attack can work like this: 1) User inputs username and pw into spurious site. 2) Spurious site prompts for the user's TOTP token. 3) Spurious site proceeds to immediately log in to the real site w/ username, pw, and valid TOTP token. 4) Bad guys get an HTTP session cookie which for many sites lasts practically indefinitely.
maccam94 8y ago
Telephone companies are insecure and susceptible to social engineering, and their backup authentication schemes often rely on publicly accessible information. This enables attackers to hijack the account and reassign the phone number to a device they control.
wolf550e 8y ago
https://twitter.com/Magoo/status/1024714909395824640 https://twitter.com/Magoo/status/1024714909395824640
afuchs 8y ago
Its too easy to hijack someone's phone number by socially engineering a phone company (ignoring routing/signaling vulnerabilities). A quick search brought up this article: https://www.theregister.co.uk/2016/12/06/2fa_missed_warning/ https://www.theregister.co.uk/2016/12/06/2fa_missed_warning/
kevin_b_er 8y ago
Because the telephone companies are terrible about security and often highly disorganized internally. They are beyond stupidly susceptible to Social Engineering and any "passcodes" against giving away access do not stand in the face of stupid customers and the need for customer service to satisfy them. Your number can easily be stolen or redirected to get and sometimes send SMS from/to your number. Your cell phone account is the linchpin for a very extensive identity theft attack.
- slg 8y ago
  In their defense, being able to successfully identify a customer is who they say they are is a difficult problem that is only compounded when you might only speak to a customer as infrequently as every few years. 2F devices and codes can be lost. Passwords and pins can be forgotten. Answers to security questions can change. Have you ever tried to access your own account with a company like this without this data? There are few things more frustrating than being locked out of your account because you can't recall what you said your favorite movie was in 2012. Throw in the low odds of actually being targeted in a social engineering attack and companies optimize for customer satisfaction and convenience over security. Blaming companies for responding to that incentives isn't going to accomplish anything. The way to fix things is to change the incentives by either increasing the punishment for falling for social engineering or create a system that makes it easier to remotely identify people.
nodesocket 8y ago
This seems to indicate a level of sophistication behind traditional hacking skills. How did they get the phone number to know which carrier to contact to socially engineer? Also, I am not sure I understand: > we suspect weaknesses inherent to SMS-based 2FA to be the root cause of this incident It seems that optaining employee login credentials was the root cause, and bypassing 2FA was the second hurdle but not the root cause.
- freeone3000 8y ago
  You don't need to know the carrier, just the number. Talk to a carrier in the country and ask to port "your" number to a new plan. Most salespeople would have no problem ignoring security for a sale.
c2h5oh 8y ago
1. It's too easy to get a duplicate sim card 2. MITM for SMS is not hard if you can get close and requires <$500 in hardware
michaelbuckbee 8y ago
Cellphone accounts can be readily compromised via social engineering (aka tricking the CSR into changing things). Here's a pretty hilarious and effective example where a crying baby background was used: https://www.youtube.com/watch?v=lc7scxvKQOo https://www.youtube.com/watch?v=lc7scxvKQOo
amckenna 8y ago
Here is a good example of an attack against a system secured by SMS based 2FA: https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoin-in-15-minutes-with-verizon-and-coinbase-com-ba75fb8d0bac https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoi...
w8rbt 8y ago
SS7 attacks. In May 2017, O2 Telefónica, a German mobile service provider, confirmed that cybercriminals had exploited SS7 vulnerabilities to bypass two-factor authentication (2FA) to make unauthorized withdrawals from users' bank accounts. The criminals first installed malware on people's computers, allowing them to steal online banking users' account credentials and phone numbers. Then the attackers purchased access to a fake telecom provider and set up redirects from the victims' phone numbers to lines controlled by them. https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
deleted 8y ago
[deleted]

Can you or someone else explain/link to me the basics of why SMS-based 2FA is so terrible? I've never really heard the sentiment before, but it appears to be common knowledge.

DennisAleynikov 8y ago

TOTP clients cannot be intercepted where as sms tokens can be compromised in a variety of ways.

whitepoplar 8y ago
TOTP tokens can absolutely be intercepted. A MITM attack can work like this: 1) User inputs username and pw into spurious site. 2) Spurious site prompts for the user's TOTP token. 3) Spurious site proceeds to immediately log in to the real site w/ username, pw, and valid TOTP token. 4) Bad guys get an HTTP session cookie which for many sites lasts practically indefinitely.

maccam94 8y ago

Telephone companies are insecure and susceptible to social engineering, and their backup authentication schemes often rely on publicly accessible information. This enables attackers to hijack the account and reassign the phone number to a device they control.

wolf550e 8y ago

https://twitter.com/Magoo/status/1024714909395824640 https://twitter.com/Magoo/status/1024714909395824640

afuchs 8y ago

Its too easy to hijack someone's phone number by socially engineering a phone company (ignoring routing/signaling vulnerabilities). A quick search brought up this article: https://www.theregister.co.uk/2016/12/06/2fa_missed_warning/ https://www.theregister.co.uk/2016/12/06/2fa_missed_warning/

kevin_b_er 8y ago

Because the telephone companies are terrible about security and often highly disorganized internally. They are beyond stupidly susceptible to Social Engineering and any "passcodes" against giving away access do not stand in the face of stupid customers and the need for customer service to satisfy them. Your number can easily be stolen or redirected to get and sometimes send SMS from/to your number. Your cell phone account is the linchpin for a very extensive identity theft attack.

slg 8y ago
In their defense, being able to successfully identify a customer is who they say they are is a difficult problem that is only compounded when you might only speak to a customer as infrequently as every few years. 2F devices and codes can be lost. Passwords and pins can be forgotten. Answers to security questions can change. Have you ever tried to access your own account with a company like this without this data? There are few things more frustrating than being locked out of your account because you can't recall what you said your favorite movie was in 2012. Throw in the low odds of actually being targeted in a social engineering attack and companies optimize for customer satisfaction and convenience over security. Blaming companies for responding to that incentives isn't going to accomplish anything. The way to fix things is to change the incentives by either increasing the punishment for falling for social engineering or create a system that makes it easier to remotely identify people.

nodesocket 8y ago

This seems to indicate a level of sophistication behind traditional hacking skills. How did they get the phone number to know which carrier to contact to socially engineer? Also, I am not sure I understand: > we suspect weaknesses inherent to SMS-based 2FA to be the root cause of this incident It seems that optaining employee login credentials was the root cause, and bypassing 2FA was the second hurdle but not the root cause.

freeone3000 8y ago
You don't need to know the carrier, just the number. Talk to a carrier in the country and ask to port "your" number to a new plan. Most salespeople would have no problem ignoring security for a sale.

c2h5oh 8y ago

1. It's too easy to get a duplicate sim card 2. MITM for SMS is not hard if you can get close and requires <$500 in hardware

michaelbuckbee 8y ago

Cellphone accounts can be readily compromised via social engineering (aka tricking the CSR into changing things). Here's a pretty hilarious and effective example where a crying baby background was used: https://www.youtube.com/watch?v=lc7scxvKQOo https://www.youtube.com/watch?v=lc7scxvKQOo

amckenna 8y ago

Here is a good example of an attack against a system secured by SMS based 2FA: https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoin-in-15-minutes-with-verizon-and-coinbase-com-ba75fb8d0bac https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoi...

w8rbt 8y ago

SS7 attacks. In May 2017, O2 Telefónica, a German mobile service provider, confirmed that cybercriminals had exploited SS7 vulnerabilities to bypass two-factor authentication (2FA) to make unauthorized withdrawals from users' bank accounts. The criminals first installed malware on people's computers, allowing them to steal online banking users' account credentials and phone numbers. Then the attackers purchased access to a fake telecom provider and set up redirects from the victims' phone numbers to lines controlled by them. https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7

deleted 8y ago

[deleted]