5 ms·

While I agree SMS based MFA is less than ideal the real issue is telephony security. Weak security allows ANI spoofing, message interception (as seen here), IMS

by xfitm3 8y ago

While I agree SMS based MFA is less than ideal the real issue is telephony security. Weak security allows ANI spoofing, message interception (as seen here), IMSI catching, and who knows what else. I stopped picking up calls from unknown numbers since its practically all spam. It'll probably never be secure but I can dream.

philprx 8y ago
Problem of this attack is that the subscriber never gets any indication that the attack occured. So you can't do anything to defend yourself.
- jechamt 8y ago
  The attack described is two-part: 1. The criminals launch a phishing campaign against you specifically to get your bank username and password. This is defensible, although the harder step, by being vigilant, not clicking links, regularly changing your password, ensuring your password is unique so they won't be able to find it on a database of another breached web service, etc. 2. They intercept your SMS-based 2FA. This is not possible if you are not using SMS-based 2FA. Switch to a more secure method of 2FA, or communicate your concerns to your bank if none is available (really, make it public, because this is a big deal), or switch banks. I believe there are things you can do to defend yourself, although having to do these things is clearly not ideal. Hopefully just knowing about it will improve a person's defensive posture against such types of attacks. Edit: formatting (for anyone who's ever wondered: https://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc)
  - SiVal 8y ago
    "Switch to a more secure method of 2FA" What would you suggest? I've heard that using your phone for 2FA is a bad idea several times now, but I'm not hearing suggested alternatives. Clearly your alternatives are limited by what you're offered, but I would still welcome advice for what practical alternatives I should try to use instead of phone.
    - mutagen 8y ago
      An app or hardware generating TOTP or HOTP codes is generally considered better than SMS based authentication but is susceptible to phishing and requires planning around phone upgrades or backup measures in case of a lost device. Google Authenticator app, Yubikey, or the like.
    - sakopov 8y ago
      I'm not claiming this is more secure by any means but I started using a Google Phone number for 2FA associated with a Google account which uses a hardware token for authentication. My reasoning being that a Google phone number cannot be transferred without logging into the account and releasing the number. So I figured if I used the most secure 2FA method for that account it would be safer than relying on my telco which doesn't employ any serious security measures and is likely more susceptible to social engineering than Google.
  - firebird84 8y ago
    I think there needs to be a larger effort to shame the banks into fixing their MFA support. Some of them sign onto FIDO2 for example but don't enable it for their customers. I've looked for every bank I do business with and NONE of them support non-SMS MFA.
  - tabhygfr3 8y ago
    "Switch to a more secure method of 2FA" If you can... All the institutions (bank, 401K, IRA) I use will fall back to SMS even if you have a more secure method. I gave up trying to find one that didn't. Instead I got a burner phone with cash. Don't really know if it helps but it seems less likely that some database dump has my name associated with that number.
z2 8y ago
It's great that the FTC in the US rolled with the flood of scam calls and partnered with call blocking lists [0], but ignorant question--why are scammers able to cycle through and commandeer and route through so many domestic phone numbers and remain untraceable to enforcement? 0: https://www.consumer.ftc.gov/articles/0548-blocking-unwanted-calls https://www.consumer.ftc.gov/articles/0548-blocking-unwanted... Edit: Thanks for the pointers! Sorry this was a bit of a tangential question.
- philprx 8y ago
  They often buy SIP services from VoIP operators, as a business, and cycle through the subscriptions. But it's a totally different problem than the problem depicted in this article.
  - bostik 8y ago
    There's a good practical look into how this works in Martin Vigo's talk.[0] 0: https://media.ccc.de/v/35c3-9383-compromising_online_accounts_by_cracking_voicemail_systems https://media.ccc.de/v/35c3-9383-compromising_online_account...
- bluGill 8y ago
  Because once you get connected to the SIP network you are assumed trusted. Getting connected to the SIP network is easy and requires no verification.
Scoundreller 8y ago
That’s great and all, until you’re applying for jobs. Or in sales/support. Or just new to an area. Or have a child at day-care. When I’m on-call and they spoof a similar phone number (same area and exchange code), I gotta answer it.
- lsiebert 8y ago
  Per quora, area code 308 probably has the smallest population of any area code, so getting a phone number based there and screening for 308 numbers would probably work well. Honestly if google voice had a captcha system I could implement for non contact numbers, that would be sweet.
  - TheAceOfHearts 8y ago
    This is actually a feature on the Pixel 2 and Pixel 3: Screen your calls before answering them [0]. When you activate it on an incoming call it'll play a message for the caller, show you a transcript of their response, and allow you to respond with a few canned messages of your own. The best part is that it works entirely offline [1], so it doesn't require sacrificing your privacy. It's incredibly convenient. For a while I'd been receiving a ton of spam calls. Eventually I caved and enabled "Filter spam calls" on my Phone app. Suddenly, all the calls stopped. I ultimately decided that this was a worthwhile privacy tradeoff for me, especially since I rarely use my phone. I only use it to occasionally interact with businesses, and as a way for close family to reach me at a moment's notice in case of an emergency. [0] https://support.google.com/phoneapp/answer/9118387 https://support.google.com/phoneapp/answer/9118387 [1] https://support.google.com/phoneapp/answer/9094888 https://support.google.com/phoneapp/answer/9094888
    - golem14 8y ago
      Isn’t this a standard google voice feature for the last 12 years or so?
      - bestnameever 8y ago

by xfitm3 8y ago

philprx 8y ago

Problem of this attack is that the subscriber never gets any indication that the attack occured. So you can't do anything to defend yourself.

jechamt 8y ago
The attack described is two-part: 1. The criminals launch a phishing campaign against you specifically to get your bank username and password. This is defensible, although the harder step, by being vigilant, not clicking links, regularly changing your password, ensuring your password is unique so they won't be able to find it on a database of another breached web service, etc. 2. They intercept your SMS-based 2FA. This is not possible if you are not using SMS-based 2FA. Switch to a more secure method of 2FA, or communicate your concerns to your bank if none is available (really, make it public, because this is a big deal), or switch banks. I believe there are things you can do to defend yourself, although having to do these things is clearly not ideal. Hopefully just knowing about it will improve a person's defensive posture against such types of attacks. Edit: formatting (for anyone who's ever wondered: https://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc)
- SiVal 8y ago
  "Switch to a more secure method of 2FA" What would you suggest? I've heard that using your phone for 2FA is a bad idea several times now, but I'm not hearing suggested alternatives. Clearly your alternatives are limited by what you're offered, but I would still welcome advice for what practical alternatives I should try to use instead of phone.
  - mutagen 8y ago
    An app or hardware generating TOTP or HOTP codes is generally considered better than SMS based authentication but is susceptible to phishing and requires planning around phone upgrades or backup measures in case of a lost device. Google Authenticator app, Yubikey, or the like.
  - sakopov 8y ago
    I'm not claiming this is more secure by any means but I started using a Google Phone number for 2FA associated with a Google account which uses a hardware token for authentication. My reasoning being that a Google phone number cannot be transferred without logging into the account and releasing the number. So I figured if I used the most secure 2FA method for that account it would be safer than relying on my telco which doesn't employ any serious security measures and is likely more susceptible to social engineering than Google.
- firebird84 8y ago
  I think there needs to be a larger effort to shame the banks into fixing their MFA support. Some of them sign onto FIDO2 for example but don't enable it for their customers. I've looked for every bank I do business with and NONE of them support non-SMS MFA.
- tabhygfr3 8y ago
  "Switch to a more secure method of 2FA" If you can... All the institutions (bank, 401K, IRA) I use will fall back to SMS even if you have a more secure method. I gave up trying to find one that didn't. Instead I got a burner phone with cash. Don't really know if it helps but it seems less likely that some database dump has my name associated with that number.

z2 8y ago

It's great that the FTC in the US rolled with the flood of scam calls and partnered with call blocking lists [0], but ignorant question--why are scammers able to cycle through and commandeer and route through so many domestic phone numbers and remain untraceable to enforcement? 0: https://www.consumer.ftc.gov/articles/0548-blocking-unwanted-calls https://www.consumer.ftc.gov/articles/0548-blocking-unwanted... Edit: Thanks for the pointers! Sorry this was a bit of a tangential question.

philprx 8y ago
They often buy SIP services from VoIP operators, as a business, and cycle through the subscriptions. But it's a totally different problem than the problem depicted in this article.
- bostik 8y ago
  There's a good practical look into how this works in Martin Vigo's talk.[0] 0: https://media.ccc.de/v/35c3-9383-compromising_online_accounts_by_cracking_voicemail_systems https://media.ccc.de/v/35c3-9383-compromising_online_account...
bluGill 8y ago
Because once you get connected to the SIP network you are assumed trusted. Getting connected to the SIP network is easy and requires no verification.

Scoundreller 8y ago

That’s great and all, until you’re applying for jobs. Or in sales/support. Or just new to an area. Or have a child at day-care. When I’m on-call and they spoof a similar phone number (same area and exchange code), I gotta answer it.

lsiebert 8y ago
Per quora, area code 308 probably has the smallest population of any area code, so getting a phone number based there and screening for 308 numbers would probably work well. Honestly if google voice had a captcha system I could implement for non contact numbers, that would be sweet.
- TheAceOfHearts 8y ago
  This is actually a feature on the Pixel 2 and Pixel 3: Screen your calls before answering them [0]. When you activate it on an incoming call it'll play a message for the caller, show you a transcript of their response, and allow you to respond with a few canned messages of your own. The best part is that it works entirely offline [1], so it doesn't require sacrificing your privacy. It's incredibly convenient. For a while I'd been receiving a ton of spam calls. Eventually I caved and enabled "Filter spam calls" on my Phone app. Suddenly, all the calls stopped. I ultimately decided that this was a worthwhile privacy tradeoff for me, especially since I rarely use my phone. I only use it to occasionally interact with businesses, and as a way for close family to reach me at a moment's notice in case of an emergency. [0] https://support.google.com/phoneapp/answer/9118387 https://support.google.com/phoneapp/answer/9118387 [1] https://support.google.com/phoneapp/answer/9094888 https://support.google.com/phoneapp/answer/9094888
  - golem14 8y ago
    Isn’t this a standard google voice feature for the last 12 years or so?
    - bestnameever 8y ago