Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
1–10 of 225 posts
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#2Isn't this the old "SMS is not 2FA, stop calling it that" argument?
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#3Isn't this the old "SMS is not 2FA, stop calling it that" argument?
Yep. Everyone has been saying SMS is not a secure channel for forever now, and this is only one of many possible attacks that can be used to trivially bypass SMS based auth. It's sad but true that in general banks have some of the weakest security on the internet, most online games do a better job protecting user accounts from unauthorized access.
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#4SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#5Is there a good technical explanation of how SS7 works, technical docs, etc?
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#6It would be nice to have a WhatsApp API that could be use for 2FA, banks probably already have your number.
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#7Is there a good technical explanation of how SS7 works, technical docs, etc?
The article links to the Wikipedia page, which is a good starting point.
> Signalling System No. 7 (SS7) is a set of telephony signaling protocols developed in 1975, which is used to set up and tear down most of the world's public switched telephone network (PSTN) telephone calls. It also performs number translation, local number portability, prepaid billing, Short Message Service (SMS), and other mass market services.
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#8It would be nice to have a WhatsApp API that could be use for 2FA, banks probably already have your number.
I would much prefer something with end to end crypto like Signal. Of course, that creates problems with key rotation, but perhaps that could trigger additional validation of some sort.
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#9It would be nice to have a WhatsApp API that could be use for 2FA, banks probably already have your number.
I would much prefer something with end to end crypto like Signal. Of course, that creates problems with key rotation, but perhaps that could trigger additional validation of some sort.
There already exists a much better solution for 2FA - the OATH protocol's TOTP and HOTP. It uses a local token to hash a counter or the current time with no need for anyone else to have your current token or communicate it directly in any means. These are already popularly implemented in Google Authenticator and Authy.
Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
#10This is really scary... can banks please start using something like Google Authenticator? I was assuming that 2FA over SMS was the most secure thing ever...apparently that's not the case.