Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

81–90 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#81

Post by idlewords »

gruez wrote: post #36
idlewords wrote: post #30

Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://techsolidarity.org/resources/security_key_gmail.htm

You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

That does not provide an equivalent level of protection. If I can get you to enter your Google credentials into a site I control with a TOTP token, I own your email. That is not true for a security key.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#83

Post by adrr »

086421357909764 wrote: post #71
adrr wrote: post #66

Earlier quoted context omitted.

It would be secure if mobile companies gave us APIs to pull information about number like has it been ported recently or number has been forwarded. Banks would even pay for it.

It's a clear text transmission on the signaling channel. Unless you encrypt the message from originator to recipient, having info on number ports or forwards won't changes the risk or susceptibility. It's nothing new either, how do you think the NSA captures text messages around the globe?

It's one time use. Even they did intercept it they would have it use before the person.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#85

Post by techsupporter »

otterley wrote: post #49
cbhl wrote: post #35

Earlier quoted context omitted.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

There are plenty of second-factor mobile apps as well: Duo, Authy, Google Authenticator, and Symantec VIP access, just to name a few.

And now I'm trapped in this multi-app universe where every entity uses a different app. My employer uses Symantec, my school uses Duo, my bank has its own app (as does Steam), and a handful of sites use TOTP.

Argh.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#86

Post by Latty »

joering2 wrote: post #23
Latty wrote: post #15

Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's…

> It's a much better system. Sure and much more inconvenient one, because you have to carry this device with you everywhere. Even much better system would be a living being at each ATM machine checking your credentials.

Except it's not because they are very small, cheap devices that everyone has, generally a couple of. I have one at home, one at work, one in my bag, and everyone I know has one I could borrow if I needed one.

Essentially all security is a trade off against convinience, this is, in my eyes, a no-brainer. It's barely any more effort and much, much more secure.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#87

Post by spenvo »

kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

Apple's 2-Factor solution for Apple accounts requires a phone number, and SMS plays a role in reseting passwords in the absence of a secured device. I'm surprised more people aren't concerned about that approach. https://support.apple.com/en-us/HT204915 thread: https://twitter.com/spencerdailey/status/846516787533533184

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#88

Post by ribosometronome »

sytse wrote: post #74
3pt14159 wrote: post #68

Earlier quoted context omitted.

But what happens when thieves steal my phone? How do I authenticate then? Most places use SMS as a backup, which gets us back to the original problem. People with popular YouTube accounts have to deal with this all the time and the advice right now seems to be to buy a burner phone on a false name[1] and never share the phone number with anyone, which is just crazy. [1] Fraudsters are able to convince phone employees…

With Google Authenticator you would have to use your one-time codes to reset it if your phone is lost. With 1password the 2FA is no longer linked to the phone, this way you don't have to reset.

Google will also let you move your Authenticator to a new device with access to the account from another trusted device without needing to 2FA.

So, for example, I can temporarily move Authenticator to an tablet if my phone is lost/stolen using my laptop, which is already trusted.

There are some potential security drawbacks to this but access to a trusted device seems a reasonable compromise between security and convenience.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#89

Post by mattmanser »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

In the UK we got hardware authenticators for free. And most bank accounts for personal accounts are free too.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#90

Post by hdhzy »

YZF wrote: post #44
cbhl wrote: post #35

Earlier quoted context omitted.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

If you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.

Note that one time codes do not protect against phishing the same way U2F does (U2F is always bound to secure origin).
Post reply on HN