Karma. They should probably target Zuck next.
Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
241–250 of 312 posts
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#242Earlier quoted context omitted.
While you're correct it's not fine, not everyone has a smart phone or a TOTP device. There are some cases where SMS makes sense as 2FA since it's a reasonable compromise between having no 2FA or a TOTP device.
Most feature phones can also easily run a TOTP application (and have/do). There are J2ME TOTP applications that will run on hardware far back into the ancient past. There are all sorts of fun TOTP apps in the AdaFruit, Arduino, RPi hacking worlds. The algorithm is rather straightforward. The "hardest" part is the SHA1 hashing algorithm and people have written versions of that for just about every hardware under the s…
Just noticed the tab I had opened mentioning 6502 SHA1 hashing was to do it on old Tamagotchi hardware. Forgot that was also a 6502. Wonder if that person ever finished a TOTP Tamagotchi.
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#243I don't understand why there hasn't been a class action lawsuit against the telco's complete disregard for this security flaw in porting SIM/phone numbers. Literally this morning I read about this engineer that lost 100k from a hacker using the same attack https://www.ccn.com/100000-bitcoin-loss-bitgo-engineer-sim-h...
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#244Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…
My experience is that after you give your phone number to most companies it effectively becomes a single factor: it's trivial to get them to change passwords with that alone. AFAICT, the only protection is to not give them your phone number in the first place.
> "the only protection is to not give them your phone number in the first place."
That has its own risks. If you don't provide it to google and your account gets hacked, it's extremely hard to get it back. (My wife lost her original gmail account that way about 2 years ago. And of course there was no way to get any live support to try & fix it)
Basically if you don't provide your number, you're more open to the more prevalent traditional hacking. If you do provide a number, you're more open to a slightly less prevalent type of hacking. It doesn't leave much to choose from.
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#245Does twitter now mandate a phone number when creating an account, or are they happy with just an email address?
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#246Earlier quoted context omitted.
It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.
While you're correct it's not fine, not everyone has a smart phone or a TOTP device. There are some cases where SMS makes sense as 2FA since it's a reasonable compromise between having no 2FA or a TOTP device.
You don't need a "TOTP device". It's software. You can easily write an authenticator for a smartphone, a pc, a digital dumb phone, or pretty much anything.
I think the real issue is that companies like SMS because of the tracking it enables. With a single number you get instant geographic + general socioeconomic data on user along a unique tracking ID. But the particularly nice thing about this ID, from a corporate perspective, is how blithe users are with it. People will happily "validate" away on numerous sites. Now, by "sharing select information with our trusted partners" (as seems to be the preferred T&C jargon) companies can create extensive profiles on their users well above and beyond their activities on any given site.
Obviously you get none of this with a TOTP. Instead you get better security, better portability, and less external dependencies. But no tracking. So SMS wins in the current state of the internet.
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#247While companies definitely need to move away from SMS two factor it’s so entrenched (and simple) that more is needed. The government agencies that setup the mobile number portability system need to realise the seriousness of this flaw and allow a “Never transfer my Number” flag to be set in their databases. Until then even the lowest rung service desk agent at any telco has the ability to transfer numbers. A system l…
That's how domain registrars work. You set a "lock" so the domain can't be transferred away until you "unlock". Then you can tie this locking/unlocking procedure to 2FA, identify verification, whatever.
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#248Earlier quoted context omitted.
It's really ½FA, worse than 1FA authentication because it's sufficient to clear any 1 of the 2 factors.
I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck. If you had parts of either, or a hint, maybe a previously used password works for "verifying your ID" then I'd call that 1/2FA
It's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code that is sent via SMS. However, since you don't really even need access to the phone and can easily social engineer access to messages sent to the phone, it's not really a full one factor.
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#249Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…
My experience is that after you give your phone number to most companies it effectively becomes a single factor: it's trivial to get them to change passwords with that alone. AFAICT, the only protection is to not give them your phone number in the first place.
Maybe it's time to reconsider phone numbers. Think about it. There's already a divide between phones on one side, and tablets/laptops/pcs etc on the other. You can only use whatsapp on a phone (or a laptop connected to a phone). You need a special phone contract to make phone calls. You can make voice calls via voip/whatsapp/whatever but you have to understand what network the person is on. Then there's this security nonsense, with porting numbers and permission etc. If there was a voip standard where you just placed a voice call with someone else from any device, for free, with a known way of dealing with missed calls, where spam wasn't an issue (whitelist only, or at the very least some authenticated way of knowing who was calling you so you could block someone's actual number not the one they spoofed/could refuse to entertain number-withheld etc), you'd do away with loads of this nonsense in one go. And it's not like it would require any new infrastructure at all; it would be purely a protocol/software thing.
Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
#250Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…
Indian laws require a police report before telecom operators can transfer a line to a new SIM card. I was always surprised how easy it is in US to transfer in comparison.