2 ms·

SMS-based 2FA is a joke not just because of SS7 attacks, but mostly because most (if not all) phones are set to display SMS messages on the lock screen. So go

by jwr 8y ago

SMS-based 2FA is a joke not just because of SS7 attacks, but mostly because most (if not all) phones are set to display SMS messages on the lock screen. So go grab somebody's phone and enjoy access to anything that uses SMS-based 2FA, because those messages are going to be shown even if you are unable to unlock the phone. Far from "academic exercices" or "state-level actors", I'd say.

tgsovlerkhgsel 8y ago
Grabbing phones off people doesn't scale, and is reasonably hard to pull off since you need to first map from the online identity to the exact physical location, then actually physically get there yourself. Much easier to just social engineer the provider into giving you a replacement SIM.
- dogma1138 8y ago
  Grabbing phones of people also means it doesn’t matter if they display messages or not if you have the SIM you don’t need their device. This isn’t any different than stealing a ubikey of someone it’s game over. Also at least in the U.K. it’s pretty hard to get a replacement SIM through social engineering you either need an ID in store or they send it to your billing address only with signed post. In either case the previous SIM would be disabled on the spot which would likely mean that the owner would notice and block it before this can be leveraged for an attack and this is also less scalable than stealing phones since it’s actually more involved in most cases.
dogma1138 8y ago
If you can grab a phone from someone you can execute a much simpler physical attack called rubber hose cryptanalysis :) So yes what you are describing is nonsensical you need to know the target, be able to steal their device and use it within a time frame before it would be disabled. And this is if they don’t use say an iPhone or an Android phone with biometric login which often hides the notifications. Also the biggest hole in this premise is that you wouldn’t even care if the device displays texts when locked or not since if you have the device you can take out the SIM and put it into your own phone. So based on this any TOTP or U2F token is useless since they can be stolen and used. Seriously if this is your threat model I don’t think you should leave the house since you are clearly in a lot of danger.

by jwr 8y ago

tgsovlerkhgsel 8y ago

Grabbing phones off people doesn't scale, and is reasonably hard to pull off since you need to first map from the online identity to the exact physical location, then actually physically get there yourself. Much easier to just social engineer the provider into giving you a replacement SIM.

dogma1138 8y ago
Grabbing phones of people also means it doesn’t matter if they display messages or not if you have the SIM you don’t need their device. This isn’t any different than stealing a ubikey of someone it’s game over. Also at least in the U.K. it’s pretty hard to get a replacement SIM through social engineering you either need an ID in store or they send it to your billing address only with signed post. In either case the previous SIM would be disabled on the spot which would likely mean that the owner would notice and block it before this can be leveraged for an attack and this is also less scalable than stealing phones since it’s actually more involved in most cases.

dogma1138 8y ago

If you can grab a phone from someone you can execute a much simpler physical attack called rubber hose cryptanalysis :) So yes what you are describing is nonsensical you need to know the target, be able to steal their device and use it within a time frame before it would be disabled. And this is if they don’t use say an iPhone or an Android phone with biometric login which often hides the notifications. Also the biggest hole in this premise is that you wouldn’t even care if the device displays texts when locked or not since if you have the device you can take out the SIM and put it into your own phone. So based on this any TOTP or U2F token is useless since they can be stolen and used. Seriously if this is your threat model I don’t think you should leave the house since you are clearly in a lot of danger.