4 ms·

> I received an SMS saying “Enter Uber code 5483 to confirm your number”. Thinking someone entered their number incorrectly or similar, and assuming - as I had

> I received an SMS saying “Enter Uber code 5483 to confirm your number”. Thinking someone entered their number incorrectly or similar, and assuming - as I had my phone with me - that my account was safe, I ignored the message. This sounds like yet another example of why SMS is not a good second factor. The Uber rep's responses seem to ignore the question of how this account was compromised (instead providing suggestions for good password hygiene), so it's not clear to me whether they even think that the SMS PIN is supposed to provide any security at all.

accountyaccount 9y ago
Seems like it's possible that the user's phone number was hijacked? In that case SMS verification actually makes their account less secure because it can become a single point of failure.
- phonon 9y ago
  Wouldn't he know if his phone number was hijacked though? I found Uber's silence on how the 2FA was defeated the biggest issue here.
  - URSpider94 9y ago
    Could have been hijacked for a brief time, or could have been attacked through a network exploit that duplicates all SMS'es and reflects the copies to an attacker ...
marcosdumay 9y ago
> This sounds like yet another example of why SMS is not a good second factor. You know, that name is becoming customary, but this is not two factor authentication. Two factor authentication requires that you successfully authenticate on both of two separated channels to gain access. That SMS crap companies keep doing require that you authenticate on any one of two channels to gain access.
- i336_ 9y ago
  I think it's because I'm tired, but I'm not following. I login to $app with my password. $app bounces me to SMS. I then go back to $app with the SMS code. So I needed my password with $app and the code from the SMS.
  - Bartweiss 9y ago
    In the article, it looks like the code via SMS was never required. Uber sent it out, then allowed a login without it. I've seen something like this before, where companies over two factor auth via SMS, but also allow SMS as a password reset channel - which means it's not two factor anymore.' But in general, you're right. The problem with SMS as a second factor isn't that it's not two-factor, it's the ease of compromising both factors at once. Hijacking phone numbers is disturbingly easy, and smartphones mean that you can steal one physical token and get both email access (for password reset) and SMS access (for the code).
  - marcosdumay 9y ago
    I got the impression there was no password input. It's getting way too common to do phone based verification, and authenticate new phones by SMS codes. If it asked for the password (does Uber use passwords at all?) then yes, I was just saying dumb things; please ignore.
  - codedokode 9y ago
    If your Android phone is infected then 2FA effectively becomes single factor that is under attacker's control.
Bartweiss 9y ago
This actually seemed way worse than the monetary details. Uber offered TFA via SMS, and then apparently failed to require it. That's really bad, and sparks concern about all of their other security practices. Assuming this is accurate, I guess it's time to assume there's an unexplained failure in Uber's security/login rules?
- URSpider94 9y ago
  I assume that the attacker did one of two things: either they were somehow cloning the SMS messages so they came to both the customer's phone and to them, or they jumped the gun on an SMS redirect they had set up and the first TFA got sent to the customer; they then retried later and got the message on their channel. The logical fallacy in your answer is in assuming that, just because the customer got an SMS with a TFA code, an attacker did not get the same or subsequent code and use it. We don't know that. Of course, it's also possible that Uber's TFA is broken ...
  - Bartweiss 9y ago
    I had been assuming that cloning was very unlikely, yeah. It seems substantially harder than actual redirection or capture would be. But honestly, I hadn't considered the possibility that they triggered an SMS and then got access later, maybe with a second (rerouted) SMS. That's a good point.
nix0n 9y ago
If I get an SMS like this one day, what can I do to stop someone from hijacking my account?
- lnx01 9y ago
  Immediately cancel /close/delete your Uber account. As in the linked article, Uber does not allow you to remove a payment method only change it to another card or to Paypal. You could also immediately cancel/freeze your credit card until you've resolved the issue with your stolen Uber account.

accountyaccount 9y ago

Seems like it's possible that the user's phone number was hijacked? In that case SMS verification actually makes their account less secure because it can become a single point of failure.

phonon 9y ago
Wouldn't he know if his phone number was hijacked though? I found Uber's silence on how the 2FA was defeated the biggest issue here.
- URSpider94 9y ago
  Could have been hijacked for a brief time, or could have been attacked through a network exploit that duplicates all SMS'es and reflects the copies to an attacker ...

marcosdumay 9y ago

> This sounds like yet another example of why SMS is not a good second factor. You know, that name is becoming customary, but this is not two factor authentication. Two factor authentication requires that you successfully authenticate on both of two separated channels to gain access. That SMS crap companies keep doing require that you authenticate on any one of two channels to gain access.

i336_ 9y ago
I think it's because I'm tired, but I'm not following. I login to $app with my password. $app bounces me to SMS. I then go back to $app with the SMS code. So I needed my password with $app and the code from the SMS.
- Bartweiss 9y ago
  In the article, it looks like the code via SMS was never required. Uber sent it out, then allowed a login without it. I've seen something like this before, where companies over two factor auth via SMS, but also allow SMS as a password reset channel - which means it's not two factor anymore.' But in general, you're right. The problem with SMS as a second factor isn't that it's not two-factor, it's the ease of compromising both factors at once. Hijacking phone numbers is disturbingly easy, and smartphones mean that you can steal one physical token and get both email access (for password reset) and SMS access (for the code).
- marcosdumay 9y ago
  I got the impression there was no password input. It's getting way too common to do phone based verification, and authenticate new phones by SMS codes. If it asked for the password (does Uber use passwords at all?) then yes, I was just saying dumb things; please ignore.
- codedokode 9y ago
  If your Android phone is infected then 2FA effectively becomes single factor that is under attacker's control.

Bartweiss 9y ago

This actually seemed way worse than the monetary details. Uber offered TFA via SMS, and then apparently failed to require it. That's really bad, and sparks concern about all of their other security practices. Assuming this is accurate, I guess it's time to assume there's an unexplained failure in Uber's security/login rules?

URSpider94 9y ago
I assume that the attacker did one of two things: either they were somehow cloning the SMS messages so they came to both the customer's phone and to them, or they jumped the gun on an SMS redirect they had set up and the first TFA got sent to the customer; they then retried later and got the message on their channel. The logical fallacy in your answer is in assuming that, just because the customer got an SMS with a TFA code, an attacker did not get the same or subsequent code and use it. We don't know that. Of course, it's also possible that Uber's TFA is broken ...
- Bartweiss 9y ago
  I had been assuming that cloning was very unlikely, yeah. It seems substantially harder than actual redirection or capture would be. But honestly, I hadn't considered the possibility that they triggered an SMS and then got access later, maybe with a second (rerouted) SMS. That's a good point.

nix0n 9y ago

If I get an SMS like this one day, what can I do to stop someone from hijacking my account?

lnx01 9y ago
Immediately cancel /close/delete your Uber account. As in the linked article, Uber does not allow you to remove a payment method only change it to another card or to Paypal. You could also immediately cancel/freeze your credit card until you've resolved the issue with your stolen Uber account.