16 ms·
Criminals Are Tapping into the Phone Network Backbone to Empty Bank Accounts
- gruez 8y agoHow are bad actors getting access to SS7? Is SS7 being transported over public IP networks and subject to intercept? Are they bribing/hacking telecoms themselves?
- philprx 8y agoMajors: 1. Renting access by pretending to be legit telecom business 2. Internal access 3. Internet hacking into less protected telecom operators to then compromise the SS7 core network nodes and send traffic from there. Other ways exist, but these represent the bulk.
- walrus01 8y agoSmall telecoms in developing nations, corruption of the LEC telecom in places vulnerable to bribery, and CLEC interconnections for SS7 traffic.
- codedokode 8y agoAlmost every telecom company in the world has access to SS7 network so the attack surface is very wide.
- DanielDent 8y agoAt one point, one of the attack vectors was said to be by spoofing or otherwise manipulating traffic to/from a wireless femtocell. The same wireless femtocells that many operators will gladly sell or give to you for free or very little $. I don't know how effectively that strategy still works today, but I think it speaks to the significant degree to which the phone system is completely insecure and untrustworthy by design.
- manjana 8y agogruez, SS7MAP - it's a CLI app written in Erlang, you can find it on Github I think. At least it is useable :)
- zAy0LfpBZLC8mAC 8y agoSS7 is just another network that you can buy access to from telcos.
- sonnyvan 8y agoYikes! Banks need to start supporting other 2FA methods such as TOTP or U2F
- jfk13 8y agoSome do. Of the four banks where I currently have accounts, only one uses SMS-based 2FA codes; the other three all provide chip-and-pin card readers or similar gadgets to generate transaction-specific auth codes.
- LinuxBender 8y agoSome do, but their backend systems are still vulnerable. Most folks here on HN would not believe me if I said that many of the back-end systems do not use encryption. There are still many automation jobs that use clear-text FTP on the WAN and for some jobs, even across the internet.
- walrus01 8y agoYou think that's bad, huge banks are still doing this shit: https://www.reddit.com/r/canada/comments/978l87/bmo_web_banking_is_still_incredibly_insecure/ https://www.reddit.com/r/canada/comments/978l87/bmo_web_bank... https://en.wikipedia.org/wiki/Bank_of_Montreal https://en.wikipedia.org/wiki/Bank_of_Montreal Here's the password requirements for Coast Capital Savings: https://www.reddit.com/r/VictoriaBC/comments/92e7cf/coast_capital_passwords/ https://www.reddit.com/r/VictoriaBC/comments/92e7cf/coast_ca... https://en.wikipedia.org/wiki/Coast_Capital_Savings https://en.wikipedia.org/wiki/Coast_Capital_Savings
- digitalsushi 8y agoand, the banks that support 2FA need to figure out a way to keep supporting their data subscription services. there is no good OFX for 2FA
- et-al 8y agoYeah, this list is still pitiful: https://twofactorauth.org/#banking https://twofactorauth.org/#banking
- dsfyu404ed 8y ago30yr ago on the big nations could do this. 15yr ago most nations could do this. Today organized crime or well funded companies can do this. 10yr from now small time criminals will be able to do this. Technology trickles down really well. This is just another instance.
- gammateam 8y agosmall time criminals have been doing this for years? I guess its so lucrative that they aren't considered small time after executing it on a useful bank account its rampant on instagram, which introduced non-SMS OTP just a few months ago after everyone figured out their negligence was just to data mine phone numbers
- xfitm3 8y agoWhile I agree SMS based MFA is less than ideal the real issue is telephony security. Weak security allows ANI spoofing, message interception (as seen here), IMSI catching, and who knows what else. I stopped picking up calls from unknown numbers since its practically all spam. It'll probably never be secure but I can dream.
- philprx 8y agoProblem of this attack is that the subscriber never gets any indication that the attack occured. So you can't do anything to defend yourself.
- jechamt 8y agoThe attack described is two-part: 1. The criminals launch a phishing campaign against you specifically to get your bank username and password. This is defensible, although the harder step, by being vigilant, not clicking links, regularly changing your password, ensuring your password is unique so they won't be able to find it on a database of another breached web service, etc. 2. They intercept your SMS-based 2FA. This is not possible if you are not using SMS-based 2FA. Switch to a more secure method of 2FA, or communicate your concerns to your bank if none is available (really, make it public, because this is a big deal), or switch banks. I believe there are things you can do to defend yourself, although having to do these things is clearly not ideal. Hopefully just knowing about it will improve a person's defensive posture against such types of attacks. Edit: formatting (for anyone who's ever wondered: https://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc)
- SiVal 8y ago"Switch to a more secure method of 2FA" What would you suggest? I've heard that using your phone for 2FA is a bad idea several times now, but I'm not hearing suggested alternatives. Clearly your alternatives are limited by what you're offered, but I would still welcome advice for what practical alternatives I should try to use instead of phone.
- excalibur 8y agoMotherboard/Vice is trying to load another article at the bottom of this one, but the one it wants to pull up is apparently MIA, and causes the article I actually WANT to read to cut to a 404 before I can reach the end. If you must shove additional content down our throats, can you at least make it a bit more failsafe? #notagoodlook
- pwg 8y agoWith NoScript (https://noscript.net/ https://noscript.net/) blocking their Javascript I get the whole article, no attempt to load any other article, and no 404 anywhere on the page.
- stopit788 8y agoi got a horse 404 too
- mrhappyunhappy 8y agoUse reader view. I’ve had mine set to open all links and my life has been much less stressful now that I don’t have to deal with website styles and nonsense the likes of which you describe above. Try it.
- walrus01 8y agoSS7 is fundamentally broken and nobody is ever going to fix it. It's based on telcos all trusting each other in the year 1985. The sheer mass of installed equipment that nobody wants to spend hundreds of thousands of dollars to upgrade means that implementing authentication and security on top of SS7 is never going to happen. Any extensions on top of SS7 that implement something resembling proper security will thoroughly break backwards compatibility with all old PSTN equipment. If you use SMS or anything phone network related for 2FA you're doing it wrong. My job title has "network engineer" in it. It's time to simply disregard the existence of the PSTN and move on to modern communications methods. By modern, I mean things that are based on packet-switched IP networks, with software applications using battle tested public/private key crypto implemented at layers 4-7 in the OSI model.
- philprx 8y agoCrypto attempts have been made, but now we're starting to see both industry associations (GSMA) and open source (P1 Security SigFW [1]) working on filtering and encrypting SS7. If placed in front of the legacy equipment, that could enable operators to gradually move toward signed+encrypted signaling traffic. Problem is that this industry can be slow to react and would probably need government/regulatory pressure to move faster. [1] https://github.com/P1sec/SigFW/ https://github.com/P1sec/SigFW/
- DanielDent 8y agoGSMA standards have always included purposeful insecurity, e.g. look at the history of A5/1 & A5/2. It's a group that buys into the idea of secure backdoors, I'm not sure it's possible for them to build a secure system. I actually think the current Huawei mess is direct fallout from our history of creating purposefully insecure systems: if the overall system was designed to be secure, the network infrastructure potentially being compromised wouldn't be such a significant issue.
- spc476 8y agoI work at a company whose customer is the Phone Company. As I complained to my manager, "We may have a two-week sprint, but the Phone Company has a two-year sprint."
- joshe 8y agoWow, I really thought we were still at the social engineering scale (convincing the guy in the cell shop). Does anyone know if Google Voice texts are also subject to this kind of attack? In the sense that they have to honor SS7 rerouting commands or anything like that.
- techsupporter 8y agoGoogle Voice is, by and large, just* using Bandwidth.com's API to send and receive SMS. The same attacks still work though it is marginally harder to forcibly port or steal a number from a Google Voice account because Bandwidth passes the port auth request onward to Google for approval. Point being, Google Voice is not a telco on its own. They rent underlying access, of sorts, and that access still relies on SS7. * For suitably large values of "just."
- rufugee 8y agoWhat about using a service like Twilio to receive texts?
- techsupporter 8y agoI think Twilio is running its own infrastructure so some of the attack risk is mitigated but there's still no prevention of doing things like temporarily rerouting SMS or other things like that through SS7 access. Point being, SMS-based "authentication" is so laughably insecure as to be pointless if you become a target of someone who wants into your checking account.
- rsync 8y agoThis will not work. A Twilio Number cannot receive messages from a short code. Almost every single two factor authentication code from a bank or other institution comes from a short code. No number you receive or port into Twilio is Classified as a mobile number – so they cannot receive messages from short codes. I spoke to engineers from Twilio at the 2018 Signal conference and they confirmed - there is no technical limitation, but they would have to do a lot of work and deal with a lot of spam issues if they allowed their numbers to be classified as "mobile" and able to receive SMS from shortcodes - and they are declining to do that for now. So whether you source a new number from Twilio or port in an existing mobile number, once it hits Twilio it is no longer a mobile number. Yes, you can receive SMS/MMS from "normal" numbers just fine.
- umanwizard 8y agoOther than hoarding gold (edit: or cryptos, or anything similar), what is the best way to make sure my net worth doesn't just go to zero from one day to the next?
- solotronics 8y agoCryptocurrencies. Its pub-priv key security for money. Hardware wallets are really cool ex: https://wiki.trezor.io/FAQ:Overview https://wiki.trezor.io/FAQ:Overview
- empath75 8y agoThat's a sure fire way to do exactly what he said he didn't want to do.
- sgarman 8y agoSeems like a heavily volatile way to store your "net worth."
- gammateam 8y agoI guess it is ironic that stablecoins are probably the most secure way to store your money crypto security, usually legacy underpinnings, no volatility
- umanwizard 8y agoI know what cryptocurrencies are. I should have been more specific than "Other than hoarding gold" to include other volatile commodities.
- RcouF1uZ4gsC 8y agoAssuming you are a regular person, and that you do not have the US Government out to get you, put your money in an FDIC (or equivalent) insured bank account. The financial system is pretty good at making sure that even with these hacks and breaches, the actual depositors don't actually lose money. Other alternatives such as hoarding gold, digging a hole in your backyard and burying cash, buying cryptocurrencies has a higher chance of resulting in your losing your money than if you just put it in a bank account.
- cenal 8y agoSomeone stole 415-867-5309 from me by forging the port paperwork. My carrier refused to do a port back. I filed an FTC complaint and they couldn’t have cared less. Phones are a broken system.
- openmosix 8y agoWhat carrier was that? I keep hearing stories that, for some reasons, only involve T-Mobile - so I was wondering which one was that.
- jackhack 8y agoPhone number hijacking is a real problem, especially with cell phones, and thieves use it as part of an overall identity (and retirement fund) theft approach. For those who didn't catch it, that's a somewhat "famous" phone number. In the 80s, there was a song by that name: "867-5309 (Jenny)" by the band Tommy Tutone. https://en.wikipedia.org/wiki/867-5309/Jenny https://en.wikipedia.org/wiki/867-5309/Jenny Neat tip: you can use your area code + this number in almost any system that asks for a phone number (especially useful supermarket "loyalty" customer tracking systems). If they ask for a name, just tell them "Jenny".
- c22 8y ago> Neat tip: you can use your area code + this number in almost any system that asks for a phone number (especially useful supermarket "loyalty" customer tracking systems). If they ask for a name, just tell them "Jenny". Do you actually do this? It hasn't worked for me most places I've tried it. In a couple cases it froze/crashed their system. I always wondered what people who legitimately have this number do.
- empath75 8y agoThe entire security model of the PSTN is just broken. It's not just SS7, it's stingrays, caller id, robocalls, porting numbers, etc, etc. It's time to deprecate the entire system.
- manjana 8y agoPeople have lived happily alongside this vulnerability for decades.. There's also a pretty cool CLI application called SS7MAP for pentesting which is not quite that old (a year perhaps), I haven't gotten around to trying it yet.. I had forgotten. Interesting stuff.. And this is extactly why you often hear the phrase "you shouldnt rely on 2 Factor Auth."
- foobiekr 8y agoSince it is tax time, when people normally discover their accounts have gotten locked by people trying their account name and passwords from the endless stream of credentials thefts, I would observe that there are several brokerages which will issue a brand new password and read it to you over the phone without a single challenge (even the useless public records questions) if the ANI on the inbound call is correct.
- kevin_b_er 8y agoThis is why we should all be paranoid over things like the Mobile Authentication Taskforce and "Project Verify" where the US cell carriers are colluding to form a new authentication/identification to replace passwords with single-factor phone identification. We know our cell accounts are utterly and woefully insecure, but expect this push to come in the near future.
- zkms 8y ago> we should all be paranoid over things like the Mobile Authentication Taskforce and "Project Verify" where the US cell carriers are colluding to form a new authentication/identification to replace passwords with single-factor phone identification. There's lots of infosec paranoia is ill-based in reality but I've got to concur here. It's gotten so easy and uncomplicated to social-engineer a fraudulent port / SIM swap that there's an entire cottage industry of bored teenagers that do exactly that, in part to commandeer Instagram accounts with coveted usernames. Basing authentication/identification on an industry that's simultaneously pathologically incompetent (fraudulent ports/SIM-swaps) and also grossly evil (selling real-time locations of all their subscribers without their consent to a phantasmagorically layered and non-auditable set of resellers and intermediaries) when it comes to security is pure folly.
- baybal2 8y agoA popular attack these days is usage of fake roaming requests. They require nothing except knowledge of your IMEI, and IMEIs can be bought bulk online from android app devs. That's how British MPs were, allegedly, pwned en masse in 2016
- philprx 8y agoAre you sure you're not mixing up IMEI (identifiers of hardware handsets and end devices, can be often reflashed), with IMSI (identifiers on the SIM, and therefore the number and subscription associated with the SIM (simplified description)) ? You don't need to "buy", but you need to FIND, the IMSI of the target you're going to do fake roaming (fake Location Update) request on. This is most of the time doable.
- baybal2 8y agoI did, thanks for correcting me.
- theseatoms 8y agoMeanwhile, Twilio is raking it in on the back of this broken system.
- rsync 8y agoCan you elaborate? How does Twilio benefit specifically from these vulnerabilities in ss7 ?
- toothbrush 8y agoSlightly unrelated, but i'm fishing for suggestions. I have a beef with my local Australian bank, the ING (of Dutch fame). Their login system consists of your "customer number" (printed on the back of your debit card) and a 4 digit numeric PIN. Yes, 4 digits. In 2019. To add a payee to your address book the only auth that happens is over SMS; to actually transfer money out of the account you can select any existing address book contact with no further verification. I like their product offering (cheapest / best in class locally) but this is such a worry to me. I've repeatedly talked to their customer support about this issue (and their Twitter is full of complaints about this) but they keep giving canned responses and redirecting to their "Online Security Guarantee" https://www.ing.com.au/security.html https://www.ing.com.au/security.html. Any ideas how to get through to someone who understands what's going on, before I grudgingly take my business elsewhere?
- handzbagz 8y agoThis seems pretty common with a lot of banks. I've got accounts with several high street UK banks and almost all of them have some kind of reliance on SMS, maximum password requirements (like 10 letters with no symbols) or 'secret words' where you have to pick a few choice letters from an word which is presumably kept in plain text. I can only assume they are relying more on legal recourse and insurance than data security experts and I assume that if a hack did happen I would be reimbursed but it's a bit of a worry.
- amaccuish 8y agoWith Barclays you can rely soley on the card reader and disable login using "memorable data". Lots of other banks in the UK offer card readers (of the top of my head, Barclays, Nationwide, Natwest).
- AllegedAlec 8y agoThat's really weird. Over here, the ING has quite stringent password demands, and require a password change every 6 months. Furthermore, 2 factor authentication via phone is required for every transaction.
- 8y ago
- newnewpdro 8y agoUsing sms or smartphones in any capacity for 2fa is dumb
- purplezooey 8y agoI bet the 1A2 Key system was harder to hack
- n2j3 8y agotext-version: https://termbin.com/9w1q https://termbin.com/9w1q
- samstave 8y agooff topic: how much defunct/dormant telco infra has been left laying around which could be put to use? are old copper lines between cities still there? Old mode fiber?
- welder 8y agoWhen https://n26.com https://n26.com launches in the US they could prevent this attack, unless they fool customer support somehow. In the EU they have non-SMS based 2fa and optionally send a push notification for all transactions. Also, I'm looking for a bank that blocks all debits/transactions/transfers unless pre-authorized via app. Anyone know if that exists?
- StreamBright 8y agoI am glad my bank does not use phone numbers for anything. 2FA works with a special device that is not on GSM networks, for identification they use other means (not including the phone number).
- philjohn 8y agoAnd this is just another reason why SMS based 2FA is fundamentally broken. I bank with Barclays in the UK and they give each of their account holders a PinSentry device. This is a physical device that you have to insert your card into, and then enter your pin code to unlock, you then use it to sign/verify transactions that you are trying to make. Don't have access to the pin sentry device? Guess who can't add a new transfer recipient.
- cravespotato 8y agoBarclays is a terrible example. If someone obtain your pin and nick your card then can do anything with your bank account as the card works with any pinsentry. Much better is HSBC. The device you get is the only one that works, you cannot use different device.
- mdekkers 8y agoIf someone obtain your pin and nick your card If that is the case there are many options available to you that do not require pinsentry. This argument makes no sense in the context of this discussion.
- cravespotato 8y agoIt does because I just demonstrated Barclays way is less secure. Like it or not.
- handzbagz 8y agoThe chink in the chain for Barclays though is their mobile app on-boarding that relies on bank account information and SMS authentication which turns your phone into a PinSentry too. Don't get me wrong, Barclays probably does it better than anyone else but I was surprised when I set up a new phone recently.
- philjohn 8y agoThat's odd - when I installed the iOS app I either had to get a one-time-code by using a Barclays ATM, or by identifying with my physical PinSentry device ...
- tonyquart 8y agoI've heard about such scams since years ago at sites like http://whycall.me http://whycall.me and another similar sites. People should be aware of these kind of scams by now. Keep spreading the word and informing our family about them is the key.