Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

71–80 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#71

Post by 086421357909764 »

adrr wrote: post #66
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

It would be secure if mobile companies gave us APIs to pull information about number like has it been ported recently or number has been forwarded. Banks would even pay for it.

It's a clear text transmission on the signaling channel. Unless you encrypt the message from originator to recipient, having info on number ports or forwards won't changes the risk or susceptibility. It's nothing new either, how do you think the NSA captures text messages around the globe?

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#72

Post by yeukhon »

kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

I feel mobile OS developers should create native multi-auth software on tbe phone.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#73

Post by hinkley »

matt_wulfeck wrote: post #28
orclev wrote: post #3

Earlier quoted context omitted.

Yep. Everyone has been saying SMS is not a secure channel for forever now, and this is only one of many possible attacks that can be used to trivially bypass SMS based auth. It's sad but true that in general banks have some of the weakest security on the internet, most online games do a better job protecting user accounts from unauthorized access.

True but SMS was the only available 2fa for a long time. In fact, it's still largely the only available 2fa for most things (sadly). As bad as it is, it's better than just a straight password.

Blizzard Entertainment Group had better security for imaginary currency for five years than most financial organizations have today. They were handing out key fobs at conventions.

It's not that they aren't available. It's that only a couple places (like online brokerages) even bother.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#74

Post by sytse »

3pt14159 wrote: post #68
YZF wrote: post #44

Earlier quoted context omitted.

If you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.

But what happens when thieves steal my phone? How do I authenticate then? Most places use SMS as a backup, which gets us back to the original problem. People with popular YouTube accounts have to deal with this all the time and the advice right now seems to be to buy a burner phone on a false name[1] and never share the phone number with anyone, which is just crazy. [1] Fraudsters are able to convince phone employees…

With Google Authenticator you would have to use your one-time codes to reset it if your phone is lost. With 1password the 2FA is no longer linked to the phone, this way you don't have to reset.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#75

Post by tqkxzugoaupvwqr »

3pt14159 wrote: post #68
YZF wrote: post #44

Earlier quoted context omitted.

If you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.

But what happens when thieves steal my phone? How do I authenticate then? Most places use SMS as a backup, which gets us back to the original problem. People with popular YouTube accounts have to deal with this all the time and the advice right now seems to be to buy a burner phone on a false name[1] and never share the phone number with anyone, which is just crazy. [1] Fraudsters are able to convince phone employees…

Typically, you are asked to print out backup codes when you enable 2FA. In addition, you could copy these backups codes into your password manager and sync your password file with multiple devices, so whenever one device is gone you can access all your passwords, including 2FA backup codes from other devices.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#76

Post by [deleted] »

DBNO wrote: post #64
BoppreH wrote: post #45

Earlier quoted context omitted.

Seems vulnerable to phishing. The attacker already uses phishing to get account number, password and phone number; now they just have to send a fake 2Factor message and observe how the number is translated. Even if the function is lossy, it has very little entropy. Maybe even vulnerable to brute forcing... I agree with the other poster, Google Authenticator looks like a better solution.

Good points. After further consideration and from the other comment, I was basically thinking of a 3FA system.

[deleted]

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#77

Post by kej »

cbhl wrote: post #42
gruez wrote: post #36

Earlier quoted context omitted.

You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

Just print the TOTP QR code and store it in a safe place. Then you can set up an authenticator on the new phone with the same key as the old one.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#78

Post by Rafert »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

I have high hopes for the W3C WebAuthn spec [1], it combines the security of FIDO U2F keys with the ease and ubiquity of devices with fingerprint scanners. Would be cool if Apple will support it too.

1: https://www.w3.org/TR/webauthn/

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#79

Post by tgb »

kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

I found that my Blizzard account 2fa app had been forgotten when I moved from my old phone, so I was locked out of an account I don't use very regularly. But they had an option to just text me a code, which worked and I got access to my account. I didn't know if I should be relieved because it worked or disappointed that their secure 2fa was so easily side stepped.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#80

Post by noja »

DennisP wrote: post #43
cbhl wrote: post #35

Earlier quoted context omitted.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

Hopefully we'll get to a world where people keep a U2F key on their keychain, and use it for all their important logins.

We have a long way to go. People need to understand:

* How U2F works on their phone

* What if the U2F key gets lost or stolen (revocation)

* How to have a backup of the U2F key

* Are multiple identities possible (home/work/whatever)

Post reply on HN