Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

191–200 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#191

Post by sebcat »

ribosometronome wrote: post #88
sytse wrote: post #74

Earlier quoted context omitted.

With Google Authenticator you would have to use your one-time codes to reset it if your phone is lost. With 1password the 2FA is no longer linked to the phone, this way you don't have to reset.

Google will also let you move your Authenticator to a new device with access to the account from another trusted device without needing to 2FA. So, for example, I can temporarily move Authenticator to an tablet if my phone is lost/stolen using my laptop, which is already trusted. There are some potential security drawbacks to this but access to a trusted device seems a reasonable compromise between security and conve…

Also worth noting: Google Authenticator is just TOTP[1] (X=30, Digit=6, HMAC-SHA-1 IIRC). You can just copy the URL from the QR code and use it from whatever you like, as long as your clock is somewhat synced.

[1] https://tools.ietf.org/html/rfc6238

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#192

Post by Natanael_L »

distances wrote: post #125
raverbashing wrote: post #93

Earlier quoted context omitted.

You can get a pre printed card for cheap for 2fa. No need for RSA token

This is how it works often in Europe, a paper slip with a bunch of one-time tokens. I don't see how any technical solution would be better in security or usability.

U2F is just a button

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#193

Post by toast0 »

derefr wrote: post #153
voltagex_ wrote: post #150

Earlier quoted context omitted.

A lot of providers will block VoIP and SMS gateways being used as verification (see PayPal for an example).

AFAIK you can get a number from a different carrier and then transfer it to the VoIP carrier. When queried, it will still show up as "owned" by the original carrier.

It depends on how they classify; numbers are issued in blocks of 1000, and the allocations are public knowledge, but you can also do a real time carrier lookup, which changes after porting completes.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#194

Post by [deleted] »

finnn wrote: post #8
Techbrunch wrote: post #6

It would be nice to have a WhatsApp API that could be use for 2FA, banks probably already have your number.

I would much prefer something with end to end crypto like Signal. Of course, that creates problems with key rotation, but perhaps that could trigger additional validation of some sort.

[deleted]

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#195

Post by toast0 »

dublinben wrote: post #133
techsupporter wrote: post #85

Earlier quoted context omitted.

And now I'm trapped in this multi-app universe where every entity uses a different app. My employer uses Symantec, my school uses Duo, my bank has its own app (as does Steam), and a handful of sites use TOTP. Argh.

At least TOTP (and U2F) are standards. All sites and organizations should be using them, not something they've created themselves.

DUO and other similar tools where you accept on the phone instead of getting a code and having to type it in can be more convenient than typing; and provided you get the push, you can take care of it from the notification so you don't have to find the app, so it's not terrible if you need seven different apps.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#196

Post by tptacek »

amfontenot wrote: post #154
idlewords wrote: post #144

Earlier quoted context omitted.

Because that would require them to have physical access to your unlocked mobile device. It's equivalent to saying "why can't a crook just steal your security key". The threat model this setup is protecting against is phishing. For that purpose, a security key is much better than TOTP (authenticator app).

You make this point frequently, but it really seems out of place here on HN where you have near 100% technically competent users who aren't going to get phished, at least not in any way that a security key is going to protect against. (Thinking of the recent Google Docs incident.) Security keys are great for journalists, activists, and high profile business people, but for your average geek it's an unnecessary amount…

The whole reason U2F exists is because technically savvy users were getting phished. Sophisticated phishing campaigns are basically indistinguishable from legitimate pages; targeted phishing campaigns will take advantage of the normal rhythms of your work and the identity of your coworkers. The fact that you're certain you're too competent to be phished probably makes you more vulnerable, not less.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#197

Post by tptacek »

city41 wrote: post #146
idlewords wrote: post #144

Earlier quoted context omitted.

Because that would require them to have physical access to your unlocked mobile device. It's equivalent to saying "why can't a crook just steal your security key". The threat model this setup is protecting against is phishing. For that purpose, a security key is much better than TOTP (authenticator app).

That doesn't make any sense to me. If they require physical access to my unlocked phone, then isn't the phone just as secure as the yubikey? If so, why bother with the yubikey? If the phone has other attack vectors, such as compromising the OS, and is indeed less secure than the yubikey, then doesn't having it as a backup just lower the bar for security to the phone? As far as I can tell, there's nothing stopping fro…

U2F security keys are a mutual authentication mechanism. The key authenticates the site as the site authenticates the key. Phone TOTP applications can't do that.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#198

Post by Latty »

inyorgroove wrote: post #130
Latty wrote: post #15

Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's…

I have always been curious, do those devices work on linux?

They aren't devices that connect to your computer. They are standalone things (a little like a calculator) with a screen that shows you a token to type in, like a 2FA app. Works with any web browser supporting a form with a text input.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#199

Post by city41 »

tptacek wrote: post #197
city41 wrote: post #146

Earlier quoted context omitted.

That doesn't make any sense to me. If they require physical access to my unlocked phone, then isn't the phone just as secure as the yubikey? If so, why bother with the yubikey? If the phone has other attack vectors, such as compromising the OS, and is indeed less secure than the yubikey, then doesn't having it as a backup just lower the bar for security to the phone? As far as I can tell, there's nothing stopping fro…

U2F security keys are a mutual authentication mechanism . The key authenticates the site as the site authenticates the key. Phone TOTP applications can't do that.

That still doesn't answer my question. If you read the guide that I am asking about, it advocates using security keys and also setting up phone TOTP as a backup.

But I also don't need to know too badly, so I think I'll just move on.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#200

Post by tptacek »

city41 wrote: post #199
tptacek wrote: post #197

Earlier quoted context omitted.

U2F security keys are a mutual authentication mechanism . The key authenticates the site as the site authenticates the key. Phone TOTP applications can't do that.

That still doesn't answer my question. If you read the guide that I am asking about, it advocates using security keys and also setting up phone TOTP as a backup. But I also don't need to know too badly, so I think I'll just move on.

The subtlety is in how phishing attacks work. If you initiate a login yourself, unbidden by any outside request, the likelihood of you being phished in that scenario is epsilon. In that situation, the TOTP authenticator on your phone is fine. However, if you're logging in as a middle step in a series of steps to get something done (say, answering a request you received via Slack or an email), the likelihood that you could be being phished grows. In those scenarios, the mutual authentication done by the security key helps protect you.

The security key is slightly easier to use than the TOTP authenticator and it's what you'll tend to use most of the time. But if you happen to forget it at home or you're logging in to check your mail and your security key is halfway across the house but you have your phone handy or something like that, the TOTP backup option is convenient. You also need some kind of backup in case you lose the security key.

Post reply on HN