7 ms·

It's even easier to steal a phone number. Lots of phone companies still just approve a port if you send them the required paperwork to initiate a port. That m

It's even easier to steal a phone number. Lots of phone companies still just approve a port if you send them the required paperwork to initiate a port. That means with zero verification from the account holder a number can vanish from your account.

IntelMiner 9y ago
PacketCable (VoIP over Cable internet) is even worse When it came out. If you wanted to "borrow" someone's phone number. All you had to do was clone the MAC address of the VoIP (EMTA) port If someone called the number. Both you and the victims phones would ring
- rootsudo 9y ago
  Same with CDMA. Just had to copy the phone number and ESN. Boom whichever phone was closest to the tower would ring, if both phones wear pinging with near freq then both could receive the same SMS and call, but only one could be on a call at a time. No actual interception. Things got a bit different with MDN and MIN were different to ESN pair. Calls still came but you couldn't auth or call out for data services. It's all a bit old now, but look up QPST, QXDM for the past decade and 20 years ago look up Oki900.
  - kevin_nisbet 9y ago
    For some reason I think CDMA could suffer from crosstalk in certain circumstances, but it was something relatively obscure, like one device had to be above another (like an apartment building), but otherwise in the same/similar coordinates, and then certain code assignments would allow crosstalk to happen. It was weird, because it could be one direction only. Unfortunately I don't really remember the details, since I worked on the core data network at the time.
aviv 9y ago
Worse. Some very large carriers don't even look at the supporting documentation (bill, LOA) submitted with port orders unless there's a rejection from the losing carrier and they want to double check the address entered or something. Hijacking numbers is crazy simple. Same for hijacking the SMS functionality of any number in the US (voice traffic remains untouched). In about 10 minutes you can start receiving SMS directed towards any number you want, and also be able to send out texts originating from that number. Anyone who relies on SMS for any type of authentication should stop.
- walrus01 9y ago
  SS7 was designed in an era of huge Monopoly telecoms that all trusted each other. Worked fine. Needs to be burnt to the ground, the ashes stomped around on a bit, and rebuilt with the same level of thought that has gone into the development of TLS1.3 for modern use. Won't happen though due to the sheerly massive installed base of telecom gear worldwide.
  - rusk 9y ago
    Yes, sunk costs mean that while those costs are amortized these technologies will remain in place. Upside is there's plenty of business in the area of plugging the holes in the meantime!
- threeseed 9y ago
  > Anyone who relies on SMS for any type of authentication should stop Err. That's pretty much every implementation of 2FA around the world. Why isn't this more well known ?
  - walrus01 9y ago
    Not nearly as many people know how terrible ss7 is and the lack of security/pki/crypto in old-school traditional telecom. It is also a lot more opaque to learn and has higher barriers to entry, and is a very clique like club of "Telco" people.
  - stilist 9y ago
    This is why the recent NIST guidelines on 2FA explicitly discourage using SMS. (Search for ‘SMS’ in the document: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html)
  - notzorbo3 9y ago
    The beauty of it is cases like Google's. They have this bizarre 2FA security-theater Google Authenticator thing, but then nearly force everyone to have their phonenumber as a "backup device". Guess what the send you when you forget your 2FA or password? Yep, an SMS. So out the door goes the whole point of 2FA. Your three factors (account name / email address + password + Google Authenticator) have now been reduced to one factor: your email address. I can rent a mobile tower in Malaysia or some other asian country, advertise your phonenumber as roaming there for about €10/h and start intercepting all your shit. Or just get your telco's inept service dept to forward your number somewhere else. Lessons here: 1. Even the giants get it wrong. 2. There is no security anywhere in the tech world. Literally everything is broken. Your electronic car locks / starter system, your phone, your internet, everything is horribly horribly horribly broken beyond any imagining, even for hyper-tech savvy people. 3. Remove your phonenumber as a backup device from your google account and never use it as a backup device every again.
burnte 9y ago
As someone who has tried to port about 1,100 phone numbers last year, this couldn't be further from the truth. Getting numbers ported is a GIGANTIC pain in the ass with ANY small detail being wrong will reject the entire batch. Since the slamming problem in the 90s it's been increasingly hard to port phone numbers without every T crossed and every I dotted exactly right.

IntelMiner 9y ago

PacketCable (VoIP over Cable internet) is even worse When it came out. If you wanted to "borrow" someone's phone number. All you had to do was clone the MAC address of the VoIP (EMTA) port If someone called the number. Both you and the victims phones would ring

rootsudo 9y ago
Same with CDMA. Just had to copy the phone number and ESN. Boom whichever phone was closest to the tower would ring, if both phones wear pinging with near freq then both could receive the same SMS and call, but only one could be on a call at a time. No actual interception. Things got a bit different with MDN and MIN were different to ESN pair. Calls still came but you couldn't auth or call out for data services. It's all a bit old now, but look up QPST, QXDM for the past decade and 20 years ago look up Oki900.
- kevin_nisbet 9y ago
  For some reason I think CDMA could suffer from crosstalk in certain circumstances, but it was something relatively obscure, like one device had to be above another (like an apartment building), but otherwise in the same/similar coordinates, and then certain code assignments would allow crosstalk to happen. It was weird, because it could be one direction only. Unfortunately I don't really remember the details, since I worked on the core data network at the time.

aviv 9y ago

Worse. Some very large carriers don't even look at the supporting documentation (bill, LOA) submitted with port orders unless there's a rejection from the losing carrier and they want to double check the address entered or something. Hijacking numbers is crazy simple. Same for hijacking the SMS functionality of any number in the US (voice traffic remains untouched). In about 10 minutes you can start receiving SMS directed towards any number you want, and also be able to send out texts originating from that number. Anyone who relies on SMS for any type of authentication should stop.

walrus01 9y ago
SS7 was designed in an era of huge Monopoly telecoms that all trusted each other. Worked fine. Needs to be burnt to the ground, the ashes stomped around on a bit, and rebuilt with the same level of thought that has gone into the development of TLS1.3 for modern use. Won't happen though due to the sheerly massive installed base of telecom gear worldwide.
- rusk 9y ago
  Yes, sunk costs mean that while those costs are amortized these technologies will remain in place. Upside is there's plenty of business in the area of plugging the holes in the meantime!
threeseed 9y ago
> Anyone who relies on SMS for any type of authentication should stop Err. That's pretty much every implementation of 2FA around the world. Why isn't this more well known ?
- walrus01 9y ago
  Not nearly as many people know how terrible ss7 is and the lack of security/pki/crypto in old-school traditional telecom. It is also a lot more opaque to learn and has higher barriers to entry, and is a very clique like club of "Telco" people.
- stilist 9y ago
  This is why the recent NIST guidelines on 2FA explicitly discourage using SMS. (Search for ‘SMS’ in the document: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html)
- notzorbo3 9y ago
  The beauty of it is cases like Google's. They have this bizarre 2FA security-theater Google Authenticator thing, but then nearly force everyone to have their phonenumber as a "backup device". Guess what the send you when you forget your 2FA or password? Yep, an SMS. So out the door goes the whole point of 2FA. Your three factors (account name / email address + password + Google Authenticator) have now been reduced to one factor: your email address. I can rent a mobile tower in Malaysia or some other asian country, advertise your phonenumber as roaming there for about €10/h and start intercepting all your shit. Or just get your telco's inept service dept to forward your number somewhere else. Lessons here: 1. Even the giants get it wrong. 2. There is no security anywhere in the tech world. Literally everything is broken. Your electronic car locks / starter system, your phone, your internet, everything is horribly horribly horribly broken beyond any imagining, even for hyper-tech savvy people. 3. Remove your phonenumber as a backup device from your google account and never use it as a backup device every again.

burnte 9y ago

As someone who has tried to port about 1,100 phone numbers last year, this couldn't be further from the truth. Getting numbers ported is a GIGANTIC pain in the ass with ANY small detail being wrong will reject the entire batch. Since the slamming problem in the 90s it's been increasingly hard to port phone numbers without every T crossed and every I dotted exactly right.