Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

41–50 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#41

Post by Afton »

idlewords wrote: post #30

Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://techsolidarity.org/resources/security_key_gmail.htm

Can you give flavor on this: "Now we need to remove our phone number as backup method. (If you're curious why it's important to not have a phone number on your account, see the (https://techsolidarity.org/resources/security_key_faq.htm)[s... key FAQ].) "

Unfortunately, the security key FAQ contains no info on why you shouldn't have your phonenumber. I assume it's because phone-number migrations can be used to take control of your accounts?

EDIT: Yeah. Perhaps reading the article instead of just coming to the comments might have been useful.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#42

Post by cbhl »

gruez wrote: post #36
idlewords wrote: post #30

Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://techsolidarity.org/resources/security_key_gmail.htm

You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.)

Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#43

Post by DennisP »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

Hopefully we'll get to a world where people keep a U2F key on their keychain, and use it for all their important logins.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#44

Post by YZF »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

If you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#45

Post by BoppreH »

DBNO wrote: post #34

Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input…

Seems vulnerable to phishing. The attacker already uses phishing to get account number, password and phone number; now they just have to send a fake 2Factor message and observe how the number is translated.

Even if the function is lossy, it has very little entropy. Maybe even vulnerable to brute forcing...

I agree with the other poster, Google Authenticator looks like a better solution.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#46

Post by Veratyr »

joering2 wrote: post #23
Latty wrote: post #15

Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's…

> It's a much better system. Sure and much more inconvenient one, because you have to carry this device with you everywhere. Even much better system would be a living being at each ATM machine checking your credentials.

What credentials? In what way can you authenticate that you are the owner of a bank account to a human better than a smart card reader and PIN?

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#47

Post by WorldMaker »

eis wrote: post #18
orclev wrote: post #3

Earlier quoted context omitted.

Yep. Everyone has been saying SMS is not a secure channel for forever now, and this is only one of many possible attacks that can be used to trivially bypass SMS based auth. It's sad but true that in general banks have some of the weakest security on the internet, most online games do a better job protecting user accounts from unauthorized access.

It's sad but I have to agree. My local bank suddenly changed their Mastercard Securecode online verification scheme from a password to either SMS 2FA (for which they charge 9 cents per SMS and don't even support all numbers) or some really shitty mobile app which has a rating of 1.7 on the play store with tons and tons of people complaining that it just doesn't work and now renders their CC totally useless. I'm sure…

All of my banks are still Wish-It-Were-2FA and doing the silly "Security Question" bonus passwords dance. If someone were to point out to me an American bank that was doing the right thing technically, I'd probably switch in an instance, but at this point I've interacted with all of the major US banks and they all seem to be security idiots.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#48

Post by [deleted] »

cbhl wrote: post #42
gruez wrote: post #36

Earlier quoted context omitted.

You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

[deleted]

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#49

Post by otterley »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

There are plenty of second-factor mobile apps as well: Duo, Authy, Google Authenticator, and Symantec VIP access, just to name a few.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#50

Post by agf »

DBNO wrote: post #34

Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input…

Two things.

One, you'd need to use an app and something actually secure to combine the password (that's what you're proposing, a second password that mutates the token) and the 2FA token -- if the password was a simple algorithm like you're suggesting, attackers could guess it a good proportion of the time. This is a good example of why you (or I) shouldn't try and invent security measures; leave it to professionals.

Second, the regular passwords had already been compromised on these accounts. Presumably, at the time they phished the regular password, they could have phished the special 2FA password as well. It also means that 2FA could no longer be used as a password reset mechanism -- because you need to have another password to use it. You've essentially made if 3FA.

Post reply on HN