Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

51–60 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#51

Post by zxcvbn4038 »

orclev wrote: post #3
hinkley wrote: post #2

Isn't this the old "SMS is not 2FA, stop calling it that" argument?

Yep. Everyone has been saying SMS is not a secure channel for forever now, and this is only one of many possible attacks that can be used to trivially bypass SMS based auth. It's sad but true that in general banks have some of the weakest security on the internet, most online games do a better job protecting user accounts from unauthorized access.

The banks didn't get the memo from NIST and if anything they are getting worse - they are actually ramping up their use of callback and SMS authentication. Last month I had several apps force an SMS authentication because I hand't logged in since paying bills the prior month. One app disabled Touch ID and forced an SMS auth before I could log in again. One bank locked me out of my account entirely because you can't log in or contact custom service without receiving an SMS code (no voice option), but their system refuses to send SMS to my number.

It would be great if the banks supported TOTP and U2F keys (or if they managed passwords correctly and didn't limit the length or force absurd character recipes).

I once applied for a job at a top 3 bank's IT security area and on the way to the interview room I noticed that every single desk had a well worn copy of Computer Security For Dummies. I think that may be the root cause of all banking security problems right there.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#52

Post by tlrobinson »

cbhl wrote: post #42
gruez wrote: post #36

Earlier quoted context omitted.

You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

Isn't that what the backup codes they give you when you enable it are for?

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#53

Post by otterley »

cbhl wrote: post #42
gruez wrote: post #36

Earlier quoted context omitted.

You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

Google Authenticator provides a list of backup codes that you can print and put in your wallet, or store as a secure note (e.g. in 1Password): https://support.google.com/accounts/answer/1187538?hl=en

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#54

Post by hocuspocus »

joering2 wrote: post #23
Latty wrote: post #15

Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's…

> It's a much better system. Sure and much more inconvenient one, because you have to carry this device with you everywhere. Even much better system would be a living being at each ATM machine checking your credentials.

You don't need it everywhere. One card reader at home plus one at your workplace and you've covered most use cases. When you travel for long period of times it's not hard to carry one in your luggage.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#55

Post by DBNO »

cwt137 wrote: post #38
DBNO wrote: post #34

Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input…

2FA is already a hassle for users. Now you want to make them do math too? This is not a solution. Just don't use SMS at all. Google Authenticator is a better solution than yours.

You make a good point about ease-of-use. I agree a phone app is much easier to use with a smartphone. However, people with flip phones couldn't install such an app. You might then argue the demographic with flip phones would either use an RSA device or not have 2FA enabled at all - which seems like a valid point.

Security-wise, having a secret user math function seems more secure than the Google app. I can give reasons why if needed.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#56

Post by [deleted] »

cwt137 wrote: post #38
DBNO wrote: post #34

Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input…

2FA is already a hassle for users. Now you want to make them do math too? This is not a solution. Just don't use SMS at all. Google Authenticator is a better solution than yours.

[deleted]

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#57

Post by DBNO »

agf wrote: post #50
DBNO wrote: post #34

Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input…

Two things. One, you'd need to use an app and something actually secure to combine the password (that's what you're proposing, a second password that mutates the token) and the 2FA token -- if the password was a simple algorithm like you're suggesting, attackers could guess it a good proportion of the time. This is a good example of why you (or I) shouldn't try and invent security measures; leave it to professionals.…

Good points - I retract my previous idea. Thanks for the comments.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#58

Post by [deleted] »

agf wrote: post #50
DBNO wrote: post #34

Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input…

Two things. One, you'd need to use an app and something actually secure to combine the password (that's what you're proposing, a second password that mutates the token) and the 2FA token -- if the password was a simple algorithm like you're suggesting, attackers could guess it a good proportion of the time. This is a good example of why you (or I) shouldn't try and invent security measures; leave it to professionals.…

[deleted]

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#59

Post by z3t4 »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

you could use a one time pad written one a paper.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#60

Post by zyx321 »

Afton wrote: post #41
idlewords wrote: post #30

Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://techsolidarity.org/resources/security_key_gmail.htm

Can you give flavor on this: "Now we need to remove our phone number as backup method. (If you're curious why it's important to not have a phone number on your account, see the ( https://techsolidarity.org/resources/security_key_faq.htm)[s... key FAQ].) " Unfortunately, the security key FAQ contains no info on why you shouldn't have your phonenumber. I assume it's because phone-number migrations can be used to take c…

It's pretty obvious in the context of this story. You can recover your Google password if you have access to SMS on that number and can answer the "security" question.
Post reply on HN