Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

61–70 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#61

Post by wccrawford »

wereHamster wrote: post #39
idlewords wrote: post #30

Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://techsolidarity.org/resources/security_key_gmail.htm

> First, order a Yubikey! Any Yubikey will do; we recommend the blue one because it's cheapest. You can buy it for $18 on Amazon: I wouldn't buy a security device from amazon. You can buy that device on the official yubico website.

In case anyone doesn't know it, Amazon doesn't always have legit products. Sometimes sellers provide clones that look real enough to fool Amazon, if Amazon is even checking.

And clearly you don't want a fake security device.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#62

Post by ovao »

otterley wrote: post #53
cbhl wrote: post #42

Earlier quoted context omitted.

So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

Google Authenticator provides a list of backup codes that you can print and put in your wallet, or store as a secure note (e.g. in 1Password): https://support.google.com/accounts/answer/1187538?hl=en

Google provides backup codes, not Google Authenticator. Each service you add to your Authenticator keychain will have its own backup codes, if any.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#63

Post by 0xfeba »

Latty wrote: post #15

Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's…

In the US they have finally started rolling out chip-based cards. However, there's no PIN needed if you run the card as credit, defeating much of the security.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#64

Post by DBNO »

BoppreH wrote: post #45
DBNO wrote: post #34

Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input…

Seems vulnerable to phishing. The attacker already uses phishing to get account number, password and phone number; now they just have to send a fake 2Factor message and observe how the number is translated. Even if the function is lossy, it has very little entropy. Maybe even vulnerable to brute forcing... I agree with the other poster, Google Authenticator looks like a better solution.

Good points. After further consideration and from the other comment, I was basically thinking of a 3FA system.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#65

Post by zyx321 »

Veratyr wrote: post #46
joering2 wrote: post #23

Earlier quoted context omitted.

> It's a much better system. Sure and much more inconvenient one, because you have to carry this device with you everywhere. Even much better system would be a living being at each ATM machine checking your credentials.

What credentials? In what way can you authenticate that you are the owner of a bank account to a human better than a smart card reader and PIN?

It's the old military-grade 4 factor authentication: Something you know, something you have, something you are, and someone who shoots you if you try anything funny.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#66

Post by adrr »

kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

It would be secure if mobile companies gave us APIs to pull information about number like has it been ported recently or number has been forwarded. Banks would even pay for it.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#67

Post by jasonjayr »

cbhl wrote: post #42
gruez wrote: post #36

Earlier quoted context omitted.

You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

One advantage that software TOTP provides over hardware TOTP, is that you can print the QRCode w/ the private key, and lock it in a safe.

This allows you a trivial means of cloning and backing up the token. Unfortunately, this is against best practices, since you have multiple copies of the private key lying around; but this has been an acceptable trade-off for me thus far.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#68

Post by 3pt14159 »

YZF wrote: post #44
cbhl wrote: post #35

Earlier quoted context omitted.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

If you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.

But what happens when thieves steal my phone? How do I authenticate then? Most places use SMS as a backup, which gets us back to the original problem.

People with popular YouTube accounts have to deal with this all the time and the advice right now seems to be to buy a burner phone on a false name[1] and never share the phone number with anyone, which is just crazy.

[1] Fraudsters are able to convince phone employees that they forgot their phone number and left their phone at home.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#69

Post by finnn »

blacksmith_tb wrote: post #24
finnn wrote: post #14

When I asked (via Twitter) if my credit union would provide a secure 2FA option, they told me: > We're always on the lookout of how we can keep our members' accounts secure. Right now, the Mobile Texts are FFIEC compliant.

As long as that means your funds are insured and will be replaced after they're stolen via SMS phreaking, I suppose that's not the worst answer they could have given you. Though I wonder how long it would take to get the replacement funds...

I wonder how you would prove that that a given transaction was fraudulent, and how much of a hassle that would be? And of course, that's assuming someone notices the transaction. If it was small enough, it could probably go unnoticed.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#70

Post by andrewvc »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

The big problem that SMS solves that nothing else does is that you can be completely irresponsible/unlucky and it still works. You can lose your u2f key , lose any one time backup codes on paper, and so long as you can convince your phone company that you are you you're fine.

I don't think most people are responsible enough to deal with more secure MFA. Most people don't know how to keep custody of stuff like that.

Post reply on HN