Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

181–190 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#181

Post by Ntrails »

bostik wrote: post #158
cbhl wrote: post #35

Earlier quoted context omitted.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

> fingerprints have the unfortunate property of not being rotatable if compromised Coworker has a wonderful term for this. He calls fingertips "amputationware". It really drives the point home. But there is another very good reason to avoid fingerprints auth methods. The scanners are by design doing some level of fuzzy matching, so if/when[0] someone finds a way to generate an input that reproduces the signal pattern…

How does it compare to the Vein scanning auth tools in terms of efficacy?

Obviously the non rotable issue remains (although less viable to amputation auth)

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#182

Post by user5994461 »

cbhl wrote: post #35
kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

10 or 50$ per person is less than peanuts.

The challenging part is setting up the 2FA and integrating it into all your systems.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#183

Post by Kurtz79 »

kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

I thought the whole point of multi-factor authentication is to reduce the risk of breach by having different unrelated means of authentication, each of which is assumed not fully secure.

Wouldn't acquiring the 1st factor access (say, normal user credentials) be subject to similar social engineering attacks ?

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#184

Post by Doxin »

inyorgroove wrote: post #130
Latty wrote: post #15

Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's…

I have always been curious, do those devices work on linux?

They work perfectly fine. From the browsers POV all that's going on is a input field. Since you manually type in the number from the device there's no need for OS support either.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#185

Post by acdha »

thaumasiotes wrote: post #164
derefr wrote: post #115

Earlier quoted context omitted.

Easier: register with an SMS-enabled VoIP provider, like Twilio or voip.ms, and use said virtual SMS number as your 2FA. Rather hard to steal. You can then set the service up to forward received SMS messages to your regular SMS number—but, if your phone is compromised/stolen, you can go back to the account and immediately turn off this forwarding. --- Sadly, this approach reduces the security back to single-factor, s…

> Sadly, this approach reduces the security back to single-factor, since you get into the SMS account with something you know, rather than something you have. I don't understand why Google Authenticator is supposed to be so conceptually different from a password. The codes it provides are a deterministic (and public!) function of a code shared between you and the party you're authenticating to. Or in other words, it'…

The differences from a password:

1. Not shared across sites 2. Guaranteed minimum length 3. The portion going over the wire cannot be used more than once or after a few seconds 4. The phone app doesn't expose the seed or allow you to copy it off the device. Running on iOS has strong guarantees against access by other apps.

That's not perfect and U2F is a huge improvement but it's safer than SMS and given the number of google users who get attacked daily a reasonable incremental improvement.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#186

Post by lawl »

ismail wrote: post #32

The problem with SS7 is that trust is assumed. Mobile carriers that have roaming agreements will have either a direct link or via a hub. So what happened here was the network of the foreign roaming partner was used to redirect the SMS traffic on the victims carriers. Would not be surprised if it was an inside job. With ss7 you can do fun things like query the last location update/logged in base station for a mobile p…

@baybal2 you are shadowbanned. Only people with "showdead" on csn see your comments. You should probably make a new account.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#187

Post by tdist »

bostik wrote: post #158
cbhl wrote: post #35

Earlier quoted context omitted.

SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rot…

> fingerprints have the unfortunate property of not being rotatable if compromised Coworker has a wonderful term for this. He calls fingertips "amputationware". It really drives the point home. But there is another very good reason to avoid fingerprints auth methods. The scanners are by design doing some level of fuzzy matching, so if/when[0] someone finds a way to generate an input that reproduces the signal pattern…

Do note however, that masterprints are not applicable for all current solutions.[1] Their statement is of course biased, but they nevertheless point out a significant flaw in the referenced study.

[1]: https://corporate.fingerprints.com/en/newsroom/faq-regarding...

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#189

Post by jessaustin »

runeks wrote: post #162
danjoc wrote: post #33

Last July, NIST called out SMS 2FA as insecure https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo... Second comment: SMS should have been removed long time ago considering the SS7 problems. Better to use a secure token. Is the bank taking responsibility and covering the loss for their customers?

> Is the bank taking responsibility and covering the loss for their customers? I think they should be required to. Although, isn't it possible that the sum of withdrawn amounts could be so large that the bank simply can't cover the loss, thus making it insolvent?

Haha there should be a rule about double-checking transfers that could break the bank.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#190

Post by Natanael_L »

tgsovlerkhgsel wrote: post #174
tptacek wrote: post #97

Earlier quoted context omitted.

U2F is great but everything is better than SMS.

SMS can provide transaction authentication: "If you want to transfer $1000 to account 1243567890, confirm with code ABCDEF". Assuming an attentive user, this protects against malware silently changing amount and recipient on a transaction the user is making - an attack the banks were struggling with. It also makes phishing much harder, since the attacker needs to convince the user to enter the code after reading this…

U2F works because it is replay protected. Whatever you "authorize" the scammer to do means nothing to the bank when he tries to relay it.

Either he acts as a transparent proxy between you and your bank without attacking, or the authentication fails.

Edit: with local malware you're doomed unless you have trusted external hardware with a dedicated screen.

Post reply on HN