4 ms·

Isn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (o

Isn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (on a large scale)

bebop 10y ago
Would the short phrase from the website over TSL mitigate this? Even if someone could snoop the GSM, there would still be some (hopefully random) string that only the web server and client would know.
- gravypod 10y ago
  The main in the middle could just decode any secret being sent. The only way I'd want to participate in a system like this is via a smartcard or a challenge based system over TLS
wool_gather 10y ago
Yes, and not only MITM, but IRL impersonation attacks; Wired published an article about it today: https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Attackers convinced (either with their official badges or by conning) the targets' cell service providers to change the SIM info associated with the accounts, and thereby intercepted SMS authentication codes.
- gravypod 10y ago
  Yea, using a closed source and poorly vetted protocol for secure operations doesn't really sound like a good idea to me. I hope this gets fixed.
  - tyfon 10y ago
    As far as I know they are not relying on "gsm encryption" to be protected but are sending encrypted messages over sms.
- aegirth 10y ago
  You are confusing this method with one time SMS. This isn't SMS, it uses the Javacard-based SIM toolkit to decrypt a challenge sent to to the mobile number. the passcode for decryption is usually a 4 or 6 character PIN number. For an attacker to MITM this he would have to both have the number assigned to his own SIM and he would also have to impersonate the victim an show up in person to a bank or a security apparatus and social engineer his way so they program the new SIM with his personal PIN. a bit harder that just calling up the service provider to say 'I lost my mobile phone, i have this extra SIM card laying around, can you assign my number to that?'

Isn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (on a large scale)

bebop 10y ago

Would the short phrase from the website over TSL mitigate this? Even if someone could snoop the GSM, there would still be some (hopefully random) string that only the web server and client would know.

gravypod 10y ago
The main in the middle could just decode any secret being sent. The only way I'd want to participate in a system like this is via a smartcard or a challenge based system over TLS

wool_gather 10y ago

Yes, and not only MITM, but IRL impersonation attacks; Wired published an article about it today: https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Attackers convinced (either with their official badges or by conning) the targets' cell service providers to change the SIM info associated with the accounts, and thereby intercepted SMS authentication codes.

gravypod 10y ago
Yea, using a closed source and poorly vetted protocol for secure operations doesn't really sound like a good idea to me. I hope this gets fixed.
- tyfon 10y ago
  As far as I know they are not relying on "gsm encryption" to be protected but are sending encrypted messages over sms.
aegirth 10y ago
You are confusing this method with one time SMS. This isn't SMS, it uses the Javacard-based SIM toolkit to decrypt a challenge sent to to the mobile number. the passcode for decryption is usually a 4 or 6 character PIN number. For an attacker to MITM this he would have to both have the number assigned to his own SIM and he would also have to impersonate the victim an show up in person to a bank or a security apparatus and social engineer his way so they program the new SIM with his personal PIN. a bit harder that just calling up the service provider to say 'I lost my mobile phone, i have this extra SIM card laying around, can you assign my number to that?'