3 ms·

All the major 2FA attacks I have read about involved social engineering of the phone provider's customer service to number port. The thing is, since it is not a

• arthurfm 10y ago
  > All the major 2FA attacks I have read about involved social engineering of the phone provider's customer service to number port. SS7 attacks don't. [1] http://www.forbes.com/sites/thomasbrewster/2016/06/01/whatsapp-telegram-ss7-hacks/ http://www.forbes.com/sites/thomasbrewster/2016/06/01/whatsa... ... hackers can bypass the encryption protections by exploiting SS7 to create duplicate accounts that receive all the messages intended for the target phone. This is done by tricking the telecoms networks into believing the hacker’s phone has the same number as the target’s. That means they can set up a new WhatsApp or Telegram account with the same number and will receive the supposedly secret code that confirms they are a “legitimate” user. From there, they can impersonate their target, sending and receiving new calls and texts.