Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

arstechnica.com

Post reply on HN
Print view View original

141–150 of 225 posts

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#141

Post by blibble »

inyorgroove wrote: post #130
Latty wrote: post #15

Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's…

I have always been curious, do those devices work on linux?

they don't attach to the PC at all they are a simple standalone device you put your card into

they look like this: http://l7.alamy.com/zooms/04452dfd35964790b44ee6514745de5c/n...

to transfer money you enter your PIN, then the target account number and amount to transfer, and it gives you a code you type into the browser

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#142

Post by bigiain »

kevin_b_er wrote: post #4

SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

The Telco's here have been telling the banks this for years:

https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#143

Post by StavrosK »

tptacek wrote: post #109
ams6110 wrote: post #107

Earlier quoted context omitted.

Except SMS is better than nothing, right? Yes it's flawed. But it's a harder attack than simple password auth. An attacker has to to target an individual and know their phone number, and be able to spoof their phone.

It depends. SMS is better than nothing as a second factor, but SMS has a weird way of worming its way into single-factor status. I think people should avoid SMS 2FA, and should be skeptical of the security of companies that offer only SMS and neither of TOTP or U2F.

This frustrates me endlessly about Namecheap. They only allow SMS, and, for something as valuable as my domain name (figuratively the keys to my kingdom), that's unacceptable.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#144

Post by idlewords »

city41 wrote: post #124
idlewords wrote: post #30

Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://techsolidarity.org/resources/security_key_gmail.htm

The guide suggests adding Google Authenticator as a backup. Doesn't that mean this isn't any more secure than just using Authenticator? Why can't a crook say they don't have the key, and proceed to hack Authenticator?

Because that would require them to have physical access to your unlocked mobile device. It's equivalent to saying "why can't a crook just steal your security key".

The threat model this setup is protecting against is phishing. For that purpose, a security key is much better than TOTP (authenticator app).

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#145

Post by c22 »

adrr wrote: post #83
086421357909764 wrote: post #71

Earlier quoted context omitted.

It's a clear text transmission on the signaling channel. Unless you encrypt the message from originator to recipient, having info on number ports or forwards won't changes the risk or susceptibility. It's nothing new either, how do you think the NSA captures text messages around the globe?

It's one time use. Even they did intercept it they would have it use before the person.

Easy enough if they requested it.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#146

Post by city41 »

idlewords wrote: post #144
city41 wrote: post #124

Earlier quoted context omitted.

The guide suggests adding Google Authenticator as a backup. Doesn't that mean this isn't any more secure than just using Authenticator? Why can't a crook say they don't have the key, and proceed to hack Authenticator?

Because that would require them to have physical access to your unlocked mobile device. It's equivalent to saying "why can't a crook just steal your security key". The threat model this setup is protecting against is phishing. For that purpose, a security key is much better than TOTP (authenticator app).

That doesn't make any sense to me. If they require physical access to my unlocked phone, then isn't the phone just as secure as the yubikey? If so, why bother with the yubikey?

If the phone has other attack vectors, such as compromising the OS, and is indeed less secure than the yubikey, then doesn't having it as a backup just lower the bar for security to the phone? As far as I can tell, there's nothing stopping from someone just ignoring the yubikey if authenticator is also an option.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#147

Post by hughes »

nawgszy wrote: post #118
0xfeba wrote: post #63

Earlier quoted context omitted.

In the US they have finally started rolling out chip-based cards. However, there's no PIN needed if you run the card as credit, defeating much of the security.

I just moved to the States from Canada. Surprised me how far behind payment technologies are here. Swiping is at least as common as the chip readers. I have been to two places that accepted tap and it blew the employee's mind both times that I had a card capable of doing that. I find this an especially entertaining juxtaposition with the transit systems. In Canada, you swipe on the bus and tap in the stores; in the U…

I found that strange as well. Chip and signature, or swipe and pin are the common options. Both miss the entire security aspect of chip and pin.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#148

Post by throwaway91111 »

ams6110 wrote: post #107
tptacek wrote: post #97

Earlier quoted context omitted.

U2F is great but everything is better than SMS.

Except SMS is better than nothing, right? Yes it's flawed. But it's a harder attack than simple password auth. An attacker has to to target an individual and know their phone number, and be able to spoof their phone.

Ok, a 2fa protecting anything of value (such as money) should not be trivially breakable by state actors.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#149

Post by MertsA »

adrr wrote: post #83
086421357909764 wrote: post #71

Earlier quoted context omitted.

It's a clear text transmission on the signaling channel. Unless you encrypt the message from originator to recipient, having info on number ports or forwards won't changes the risk or susceptibility. It's nothing new either, how do you think the NSA captures text messages around the globe?

It's one time use. Even they did intercept it they would have it use before the person.

That's not the scenario. If I want into your account and I only have the password I don't wait for you to try to log in, I just try to log in and sniff the message to "prove" that I have the phone.

Re: Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol

#150

Post by voltagex_ »

derefr wrote: post #115
3pt14159 wrote: post #68

Earlier quoted context omitted.

But what happens when thieves steal my phone? How do I authenticate then? Most places use SMS as a backup, which gets us back to the original problem. People with popular YouTube accounts have to deal with this all the time and the advice right now seems to be to buy a burner phone on a false name[1] and never share the phone number with anyone, which is just crazy. [1] Fraudsters are able to convince phone employees…

Easier: register with an SMS-enabled VoIP provider, like Twilio or voip.ms, and use said virtual SMS number as your 2FA. Rather hard to steal. You can then set the service up to forward received SMS messages to your regular SMS number—but, if your phone is compromised/stolen, you can go back to the account and immediately turn off this forwarding. --- Sadly, this approach reduces the security back to single-factor, s…

A lot of providers will block VoIP and SMS gateways being used as verification (see PayPal for an example).
Post reply on HN