19 ms·
Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
- idlewords 10y agoHere's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm
- gruez 10y agoYou dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)
- cbhl 10y agoSo long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?
- deleted 10y ago[deleted]
- tlrobinson 10y agoIsn't that what the backup codes they give you when you enable it are for?
- tptacek 10y agoYes, not to mention that you can enroll more than one TOTP authenticator. There are legit complaints about Google Authenticator (foremost among them that it's a nightmare when you have more than 4-5 accounts), but "no backups" isn't one of them. Don't back up TOTP secrets.
- otterley 10y agoGoogle Authenticator provides a list of backup codes that you can print and put in your wallet, or store as a secure note (e.g. in 1Password): https://support.google.com/accounts/answer/1187538?hl=en https://support.google.com/accounts/answer/1187538?hl=en
- jasonjayr 10y agoOne advantage that software TOTP provides over hardware TOTP, is that you can print the QRCode w/ the private key, and lock it in a safe. This allows you a trivial means of cloning and backing up the token. Unfortunately, this is against best practices, since you have multiple copies of the private key lying around; but this has been an acceptable trade-off for me thus far.
- kej 10y agoJust print the TOTP QR code and store it in a safe place. Then you can set up an authenticator on the new phone with the same key as the old one.
- biafra 10y agoYou can authenticate more than one device. At least with Google accounts in the past. Meanwhile I use Titanium backup to backup authenticator and restore it on a different device.
- tscs37 10y agoThere are alternative TOTP apps that offer backup options.
- alasdair_ 10y agoI use google authenticator along with a printed list of recovery codes. Half are stored in my safe and half in another location offsite. I own a yubikey but it's useless as a permanent device since it needs a fullsize USB port - something my phone (and the latest gen macbook) lack.
- Natanael_L 10y agoThey have a new USB C equipped version
- idlewords 10y agoThat does not provide an equivalent level of protection. If I can get you to enter your Google credentials into a site I control with a TOTP token, I own your email. That is not true for a security key.
- wereHamster 10y ago> First, order a Yubikey! Any Yubikey will do; we recommend the blue one because it's cheapest. You can buy it for $18 on Amazon: <link to amazon> I wouldn't buy a security device from amazon. You can buy that device on the official yubico website.
- wccrawford 10y agoIn case anyone doesn't know it, Amazon doesn't always have legit products. Sometimes sellers provide clones that look real enough to fool Amazon, if Amazon is even checking. And clearly you don't want a fake security device.
- Afton 10y agoCan you give flavor on this: "Now we need to remove our phone number as backup method. (If you're curious why it's important to not have a phone number on your account, see the (https://techsolidarity.org/resources/security_key_faq.htm)[security https://techsolidarity.org/resources/security_key_faq.htm)[s... key FAQ].) " Unfortunately, the security key FAQ contains no info on why you shouldn't have your phonenumber. I assume it's because phone-number migrations can be used to take control of your accounts? EDIT: Yeah. Perhaps reading the article instead of just coming to the comments might have been useful.
- zyx321 10y agoIt's pretty obvious in the context of this story. You can recover your Google password if you have access to SMS on that number and can answer the "security" question.
- city41 10y agoThe guide suggests adding Google Authenticator as a backup. Doesn't that mean this isn't any more secure than just using Authenticator? Why can't a crook say they don't have the key, and proceed to hack Authenticator?
- idlewords 10y agoBecause that would require them to have physical access to your unlocked mobile device. It's equivalent to saying "why can't a crook just steal your security key". The threat model this setup is protecting against is phishing. For that purpose, a security key is much better than TOTP (authenticator app).
- city41 10y agoThat doesn't make any sense to me. If they require physical access to my unlocked phone, then isn't the phone just as secure as the yubikey? If so, why bother with the yubikey? If the phone has other attack vectors, such as compromising the OS, and is indeed less secure than the yubikey, then doesn't having it as a backup just lower the bar for security to the phone? As far as I can tell, there's nothing stopping from someone just ignoring the yubikey if authenticator is also an option.
- tptacek 10y agoU2F security keys are a mutual authentication mechanism. The key authenticates the site as the site authenticates the key. Phone TOTP applications can't do that.
- city41 10y agoThat still doesn't answer my question. If you read the guide that I am asking about, it advocates using security keys and also setting up phone TOTP as a backup. But I also don't need to know too badly, so I think I'll just move on.
- 10y ago
- hinkley 10y agoIsn't this the old "SMS is not 2FA, stop calling it that" argument?
- orclev 10y agoYep. Everyone has been saying SMS is not a secure channel for forever now, and this is only one of many possible attacks that can be used to trivially bypass SMS based auth. It's sad but true that in general banks have some of the weakest security on the internet, most online games do a better job protecting user accounts from unauthorized access.
- eis 10y agoIt's sad but I have to agree. My local bank suddenly changed their Mastercard Securecode online verification scheme from a password to either SMS 2FA (for which they charge 9 cents per SMS and don't even support all numbers) or some really shitty mobile app which has a rating of 1.7 on the play store with tons and tons of people complaining that it just doesn't work and now renders their CC totally useless. I'm sure they are losing customers left and right. Mobile phones (especially Android) are incredibly insecure. Why not use these little token generators like in the past? Another bank of mine can't issue proper bank reference letters anymore which are required in many cases to open other accounts or form a company. The same bank also stopped the Visa support of their debit cards so they are practically useless apart from using at the ATM. Another bank with a business account can't issue credit cards anymore. For many transfers they require tons of verification and paperwork, opening a new account gets harder and harder. I have to fill out a stupid W-8ben form even though I have nothing to do with the US. It goes on and on. It seems in the past 5 or so years banks in general have gone into a slow but steady self-destruct mode - especially with all that speculation in the debt casino. Banking is becoming a more and more frustrating experience even though it's so core to our society.
- WorldMaker 10y agoAll of my banks are still Wish-It-Were-2FA and doing the silly "Security Question" bonus passwords dance. If someone were to point out to me an American bank that was doing the right thing technically, I'd probably switch in an instance, but at this point I've interacted with all of the major US banks and they all seem to be security idiots.
- kevin_b_er 10y agoSMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.
- cbhl 10y agoSMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers). Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rotatable if compromised. And there are FIDO U2F security keys, but you still need to issue $18-$50 tokens to each user, and you need host application support.
- DennisP 10y agoHopefully we'll get to a world where people keep a U2F key on their keychain, and use it for all their important logins.
- noja 10y agoWe have a long way to go. People need to understand: * How U2F works on their phone * What if the U2F key gets lost or stolen (revocation) * How to have a backup of the U2F key * Are multiple identities possible (home/work/whatever)
- DennisP 10y agoI think a lot of this is close enough to the way mechanical keys work that it's not a huge leap. You can have more than one house key, you change the lock if a key gets stolen, etc. It's a little different, but not really more complicated.
- 10y ago
- finnn 10y agoIs there a good technical explanation of how SS7 works, technical docs, etc?
- a3n 10y agoThe article links to the Wikipedia page, which is a good starting point. > Signalling System No. 7 (SS7) is a set of telephony signaling protocols developed in 1975, which is used to set up and tear down most of the world's public switched telephone network (PSTN) telephone calls. It also performs number translation, local number portability, prepaid billing, Short Message Service (SMS), and other mass market services. https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
- toomuchtodo 10y agohttps://events.ccc.de/congress/2009/Fahrplan/events/3555.en.html https://events.ccc.de/congress/2009/Fahrplan/events/3555.en....
- imron 10y agoAsking 'for a friend'? ;-)
- philprx 10y agohttp://www.P1security.com http://www.P1security.com
- Techbrunch 10y agoIt would be nice to have a WhatsApp API that could be use for 2FA, banks probably already have your number.
- finnn 10y agoI would much prefer something with end to end crypto like Signal. Of course, that creates problems with key rotation, but perhaps that could trigger additional validation of some sort.
- problems 10y agoThere already exists a much better solution for 2FA - the OATH protocol's TOTP and HOTP. It uses a local token to hash a counter or the current time with no need for anyone else to have your current token or communicate it directly in any means. These are already popularly implemented in Google Authenticator and Authy.
- deleted 10y ago[deleted]
- pm90 10y agoThis is really scary... can banks please start using something like Google Authenticator? I was assuming that 2FA over SMS was the most secure thing ever...apparently that's not the case.
- imron 10y agoNah, it's not the case [0] and hasn't really ever been. It's only now, due to its ubiquity with banking and other high-value sites that the incentives are there to abuse it. As an aside, as someone who spends time between multiple different countries, SMS 2fa is a real pain to deal with. 0: https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto...
- ryanmarsh 10y agoPhreaking, the cutting edge way to commit computer fraud in 2017. Who would have guessed?
- deleted 10y ago[deleted]
- twothamendment 10y agoNow where did I put that whistle? I thought it was right next to my red box?
- Tepix 10y agoCute, but highly inaccurate.
- finnn 10y agoWhen I asked (via Twitter) if my credit union would provide a secure 2FA option, they told me: > We're always on the lookout of how we can keep our members' accounts secure. Right now, the Mobile Texts are FFIEC compliant.
- blacksmith_tb 10y agoAs long as that means your funds are insured and will be replaced after they're stolen via SMS phreaking, I suppose that's not the worst answer they could have given you. Though I wonder how long it would take to get the replacement funds...
- finnn 10y agoI wonder how you would prove that that a given transaction was fraudulent, and how much of a hassle that would be? And of course, that's assuming someone notices the transaction. If it was small enough, it could probably go unnoticed.
- zulln 10y agoIn addition to someone taking my money it is a privacy issue.
- criddell 10y agoI wonder if there would be some way to have FFIEC revoke their acceptance of SMS as 2FA?
- Latty 10y agoBanks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money. It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's still pretty good. The readers are also cheap and standardised, so you can use any one of them for any account, which is useful.
- joering2 10y ago> It's a much better system. Sure and much more inconvenient one, because you have to carry this device with you everywhere. Even much better system would be a living being at each ATM machine checking your credentials.
- deleted 10y ago[deleted]
- Veratyr 10y agoWhat credentials? In what way can you authenticate that you are the owner of a bank account to a human better than a smart card reader and PIN?
- zyx321 10y agoIt's the old military-grade 4 factor authentication: Something you know, something you have, something you are, and someone who shoots you if you try anything funny.
- hocuspocus 10y agoYou don't need it everywhere. One card reader at home plus one at your workplace and you've covered most use cases. When you travel for long period of times it's not hard to carry one in your luggage.
- Latty 10y ago
- danellis 10y agoWhere and how do these people get access to the PSTN?
- abstractbeliefs 10y agoWell, the article explained that in this instance, it was via a foreign run telco. So, essentially, to get in you just need to find the weakest telco connected to the main SS7 network and own them, and use their infra as a staging point.
- codewithcheese 10y agoNamecheap only supports SMS 2FA. The have been suggesting they will support Authenticator for years now https://blog.namecheap.com/two-factor-authentication/ https://blog.namecheap.com/two-factor-authentication/ Pretty unacceptable considering how important domain control is.
- joering2 10y ago+1. You find horror stories even on HN in the past how reckless Namecheap is. I personally had my domains on hold frozen without traffic being routed to my servers when my ex-gf chat with them gave my username (no password) and claimed it is her account because obviously she knew my full name and address where I live. While they didn't give her access to my account they sure froze my domain for about 5 days until everything got solved. Not long after I moved to NameSilo.
- Karunamon 10y agoHoly crap! I'll keep that in mind next time my registrations are up. This combined with their unwillingness to make proper 2FA a priority (a tweet told me they were 'setting up the infrastructure' 3 months ago) is a strong signal to look elsewhere.
- riobard 10y agoSo SS7 is like BGP where you can just announce your number/IP block?
- baybal2 10y agoYou can announce "this IMEI roams through me," to the original carrier. Some operators have some safeguards to prevent a locally active IMEI to be roamed, sometimes it is possible to have traffic routed both ways if they don't.
- zyx321 10y agoThe Sueddeutsche article claims that German customers were affected too. Most German banks I know of support TAN-generators[1] which are completely unhackable by any known methods. Insert your card, scan the barcode on your screen, confirm the target IBAN and amount, and you get a unique TAN that is calculated from your transaction parameters. [1] https://www.amazon.de/ReinerSCT-Tanjack-chipTAN-SmartTAN-Tangenerator/dp/B00QUVVA3O https://www.amazon.de/ReinerSCT-Tanjack-chipTAN-SmartTAN-Tan...
- closeparen 10y agoYeah, here in the US you just tell the company billing you your account number and hope they don't abuse or leak it.
- kwhitefoot 10y agoThe headline makes it sound as if abusing SS7 was all they needed to do but in fact they had to have the other factor as well so it really is not quite as scary as it at first appears. It also seems from the article that the thieves were able to log in to the accounts with just a password and only needed the SMS to sign transactions. It's different here in Norway; the banks require two factor authentication to log in as well as signing transactions. I don't claim it's perfect but at least no one can log in unless they control both factors.
- runeks 10y ago> It also seems from the article that the thieves were able to log in to the accounts with just a password and only needed the SMS to sign transactions. This "feature" was enabled by default for my Danish online bank as well. I've since disabled it.
- matt_wulfeck 10y agoI'm still a little irked that Google constantly reminds me to add a phone number as a backup for my email account. I already have google push login, OTP, as well as backup codes. This proves that the phone can be more a liability in the face of much better technology.
- ismail 10y agoThe problem with SS7 is that trust is assumed. Mobile carriers that have roaming agreements will have either a direct link or via a hub. So what happened here was the network of the foreign roaming partner was used to redirect the SMS traffic on the victims carriers. Would not be surprised if it was an inside job. With ss7 you can do fun things like query the last location update/logged in base station for a mobile phone, due to roaming carrier x can query for customers on carrier y in another country. If you link up to one of the roaming hubs you can pretty much get the location of anyone with a mobile phone. Feature phones included.
- baybal2 10y agoExactly, The roaming hole was known to Russian blackhat scene, and was actively exploited for ages. I say, first number hijacking services were offered around 2001 to 2005, when Russia had a paid SMS content craze. Back then, the most apparent use of that was to steal somebody's number and then send paid sms to your number. The fact that big IMEI databases gathered with Android scamware are now being sold around "social marketing" community only makes things worse. The best known attack with that was an attempted hacking of British MPs personal emails a few years ago. Russian phone operator Megafon was complicit, yet they never even got a slap on the wrist. All and every eMail or blog site that has password reset through SMS (Including whats up, and gmail) is open to that attack.
- lawl 10y ago@baybal2 you are shadowbanned. Only people with "showdead" on csn see your comments. You should probably make a new account.
- baybal2 10y agoI am fully aware of that. My hope is to have HN people remove my ban.
- danjoc 10y agoLast July, NIST called out SMS 2FA as insecure https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo... Second comment: SMS should have been removed long time ago considering the SS7 problems. Better to use a secure token. Is the bank taking responsibility and covering the loss for their customers?
- runeks 10y ago> Is the bank taking responsibility and covering the loss for their customers? I think they should be required to. Although, isn't it possible that the sum of withdrawn amounts could be so large that the bank simply can't cover the loss, thus making it insolvent?
- jessaustin 10y agoHaha there should be a rule about double-checking transfers that could break the bank.
- DBNO 10y agoEdit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments! Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input at login. Analysis: Security would increase; but ease-of-use would decrease, especially in regards to how a user would reset their password if they lose both their password and their program that calculates the cryptographic hash.
- cwt137 10y ago2FA is already a hassle for users. Now you want to make them do math too? This is not a solution. Just don't use SMS at all. Google Authenticator is a better solution than yours.
- DBNO 10y agoYou make a good point about ease-of-use. I agree a phone app is much easier to use with a smartphone. However, people with flip phones couldn't install such an app. You might then argue the demographic with flip phones would either use an RSA device or not have 2FA enabled at all - which seems like a valid point. Security-wise, having a secret user math function seems more secure than the Google app. I can give reasons why if needed.
- deleted 10y ago[deleted]
- BoppreH 10y agoSeems vulnerable to phishing. The attacker already uses phishing to get account number, password and phone number; now they just have to send a fake 2Factor message and observe how the number is translated. Even if the function is lossy, it has very little entropy. Maybe even vulnerable to brute forcing... I agree with the other poster, Google Authenticator looks like a better solution.
- 10y ago
- mdekkers 10y agoMy bank's 2FA literally comes on a piece of paper. A set of numbered codes, and the banking app/site tells me which code to use for any given transfer.
- ihaveahadron 10y agoGotta watch out for that remote paper hacking though.
- ardaozkal 10y agoI mean, paper can't get intercepted as easily as a phone, so...
- distances 10y agoYea, I have the same from two different banks. For me this seems to be the obvious 2FA solution, but comments here are mostly about elaborate technical approaches. Is there something I'm missing?
- mdekkers 10y agoI was really surprised, and the first time I came across this. I gave it some thought, and concluded I am more comfortable with this solution over anything technical.
- EGreg 10y agoThese days what is a good way to authenticate people AND prevent them from making millions of accounts?
- jdmichal 10y agoThis sounds a lot like attacks on the CAN buses within car systems. We can no longer afford to have zero-authentication, zero-authorization networks anywhere.
- stcredzero 10y agoIn August, Lieu called on the FCC to fix the SS7 flaws that make such attacks possible. It could take years to fully secure the system given the size of the global network and the number of telecoms that use it. One of the newly discovered great sins of the early 21st century, is to disseminate insecure code. Before the public became widely aware of chemical pollution, I'm sure many polluters thought themselves innocent and environmentalists as pernicious busybodies.
- ihaveahadron 10y ago"It could take years to fully secure the system given the size of the global network" How does shit like this happen
- cyberferret 10y agoAnother feather in the cap for a dedicated 2FA solution such as Google Authenticator etc. that doesn't use SMS? Though having replaced two phones since using that solution - it can be a pain to have to re-set it up with each provider every time. I can see that if someone is prone to losing their phone, it will become a major issue. I think the problem is that all the companies whom I use 2FA for have totally different methodologies for re-setting it up on a new device. Whilst some have an automated way of verifying my identity and resetting the new device almost instantly, I have had a couple that needed talking to a human support rep (inconvenient, but understandable) and one company that needed another employee in the company to do a full 2FA verification themselves, and then talk to a company support rep on my behalf to verify my request to reset my 2FA settings! (WTF). Thus, each time I replace my phone, I find myself actually culling the number of services where I use 2FA purely because it was too much of a pain to go through the reset process, and it was actually easier to drop 2FA with them altogether (or in one case actually drop the service altogether).
- rbolkey 10y agoThere are some more friendly options than Google Authenticator if it's a hassle to keep setting up over and over. I keep my 2FA in 1Password, and it works pretty well. I can access the codes from the desktop app without getting out my phone, or from my phone or tablet if I'm mobile. The only scary issue is that all that information is encrypted in Dropbox. And I use 2FA on Dropbox! Hello cyclic dependencies! As a result, Dropbox is the only 2FA that I don't store in 1Password.
- partycoder 10y agoPhreaking in 2017, interesting. The golden age of phreaking ended with SS7. SS5 was very insecure, people could just emit tones in certain frequencies and pull off tricks like calling for free. Maybe this is the beginning of a new era. I think major websites should stop using SMS and ask for just an authenticator app or secure keys. SMS should be regarded as a bad security practice.