7 ms·

You say you telephone the users. What if they are traveling? How do you verify the other person on the phone is who they say they are?

JoachimSchipper 15y ago
Worse, GSM encryption is pretty broken, people could be listening in, etc. Phoning people is still sensible in that attackers have to be close to the target, though (or get a wiretap).
- asharp 15y ago
  Surprisingly not, mostly due to some very strange bits of the GSM protocol. Basically, as long as you have enough signal such that the victims handset can hear your commands, you can tell it that you are stronger then any other signal, and the handset will instantly switch to your cell. What's worse is that there exist secure GSM encryption/etc. standards, however as the cell tower chooses what encryption to use, it is mostly pointless. (I remember watching a video about this. Apparently your phone is meant to show a massive warning if they are using unencrypted GSM. None do). http://www.youtube.com/watch?v=rXVHPNhsOzo http://www.youtube.com/watch?v=rXVHPNhsOzo is a good video about this.
  - JoachimSchipper 15y ago
    There is a lot wrong with GSM, and I didn't even know about this particular attack (thanks!), but you still have to be reasonably close to the victim - it's harder than "attack from anywhere on the internet".
    - asharp 15y ago
      Most certainly agree. Unfortunately, dropping the range limit from "Anywhere on earth" to "From a nearby mountain" doesn't fill me with all that much confidence.
JonnieCache 15y ago
>How do you verify the other person on the phone is who they say they are? This came up in another thread some time ago, and it was suggested that one very simple way to do this is to have the person call you back. Ultimately though there is no real solution to this problem except meeting the person face to face.
- linker3000 15y ago
  That pretty much covers it. We telephone them in house on their extension number and there's only 60-ish employees so we know their voices. Externally they have to call back.
- uxp 15y ago
  In enabling my Gmail account to use 2 factor authentication, Google required me to hand over my text-enabled cell phone number, and they texted me a code which I was required to input in a form. Similar to having the client call you back, but this can be automated.

JoachimSchipper 15y ago

Worse, GSM encryption is pretty broken, people could be listening in, etc. Phoning people is still sensible in that attackers have to be close to the target, though (or get a wiretap).

asharp 15y ago
Surprisingly not, mostly due to some very strange bits of the GSM protocol. Basically, as long as you have enough signal such that the victims handset can hear your commands, you can tell it that you are stronger then any other signal, and the handset will instantly switch to your cell. What's worse is that there exist secure GSM encryption/etc. standards, however as the cell tower chooses what encryption to use, it is mostly pointless. (I remember watching a video about this. Apparently your phone is meant to show a massive warning if they are using unencrypted GSM. None do). http://www.youtube.com/watch?v=rXVHPNhsOzo http://www.youtube.com/watch?v=rXVHPNhsOzo is a good video about this.
- JoachimSchipper 15y ago
  There is a lot wrong with GSM, and I didn't even know about this particular attack (thanks!), but you still have to be reasonably close to the victim - it's harder than "attack from anywhere on the internet".
  - asharp 15y ago
    Most certainly agree. Unfortunately, dropping the range limit from "Anywhere on earth" to "From a nearby mountain" doesn't fill me with all that much confidence.

JonnieCache 15y ago

>How do you verify the other person on the phone is who they say they are? This came up in another thread some time ago, and it was suggested that one very simple way to do this is to have the person call you back. Ultimately though there is no real solution to this problem except meeting the person face to face.

linker3000 15y ago
That pretty much covers it. We telephone them in house on their extension number and there's only 60-ish employees so we know their voices. Externally they have to call back.
uxp 15y ago
In enabling my Gmail account to use 2 factor authentication, Google required me to hand over my text-enabled cell phone number, and they texted me a code which I was required to input in a form. Similar to having the client call you back, but this can be automated.