5 ms·
In the US it is trivial to hijack any mobile number's SMS traffic. It takes less than a minute. SMS as 2FA should never ever be used by anyone.
by aviv 8y ago
In the US it is trivial to hijack any mobile number's SMS traffic. It takes less than a minute. SMS as 2FA should never ever be used by anyone.
- maym86 8y agoHow does it work? Why is it so easy?
- jeanlucas 8y agoSMS is not exactly the most secure protocol. But you do not need to use SMS for 2fa, that's a misconception.
- bena 8y agoIsn't it effectively plaintext? I don't know too much about the SMS protocol. But I do know that most protocols do start out plaintext because programmers are lazy and optimistic.
- village-idiot 8y agoThat’s one part of the problem. The other part is that it’s actually quite easy to convince most cell phone carriers to change the SIM card associated with a given phone number. Once you’ve pulled that off hijacking the account is easy.
- marcosdumay 8y agoIt's not exactly plaintext. Last time I saw it was using broken crypto (may have changed since then, but I doubt it), and it encrypts the data hop by hop, so that if you insert yourself as a hop, you'll just have decrypt (with your keys), read and encrypt it.
- 0xfeba 8y agoWell there's a few issues. The SS7 (https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7) does not have any authentication so anything over the telephone networks can be easily MITM'd. And at provider's stores they are too eager to please a "customer" so social engineering is very effective at swapping SIM cards out and hijacking your number.
- m-p-3 8y agoSearch for SS7, it's a swiss cheese of vulnerabilities.
- cryptonector 8y agoIt's easy because a) the signaling system in use is pathetically insecure, b) the wireless protocols are pathetically insecure.
- michrassena 8y agoI see the advice not to use SMS for 2FA comes up a lot on HN, and understand the reasons why that is true. But I find that recommendation comes up short. What are the alternatives, and how can they be widely deployed for little cost?
- village-idiot 8y agoToken based 2FA, either via something like google authenticator or a USB dongle like a Yubikey or RSA token. The point is to prove that you have possession of both knowledge and a physical token (hence two factor). And while sms to phone makes it seem like you are proving possession of the phone, you’re actually proving that you have the phone that texts will route to. That last bit is movable and subject to shockingly little security, hence the issue.
- aviv 8y agoEven 2FA that involves you receiving a call is more secure than 2FA that involves you getting a text, but of course that too should not be used, ever. It's just that SMS is that much worse. I wish I could share on HN the technique anyone anywhere can use to take over any mobile number's SMS traffic within a minute so we can discuss it at great detail, but obviously I know better and would never do it. Unfortunately this knowledge is not limited to myself and many people out there know this especially after being in telecom for a while.