3 ms·
Not in Russia. Numerous examples exist when victim's number was linked to attacker's sim card to obtain 2FA code, then linked back to victim's sim so he does n
by Andrew_nenakhov 7y ago
Not in Russia. Numerous examples exist when victim's number was linked to attacker's sim card to obtain 2FA code, then linked back to victim's sim so he does not notice anything.
This happened both by government-linked parties, where they are able to coerce providers to do it, mostly targeting prominent political opposition members. It also happened without government involvement, done by provider's personnel with sufficient access and some entrepreneur attitude.
The rule of thumb to protect against it:
- do not use SMS 2FA
- if you do, use a foreign SIP number with SMS capabilities
- if you HAVE to use local sim, use SIM that belongs to someone else and noone knows you use it
- jetzzz 7y agoJust google for "форум пробив" and you will find black market for accessing any kind of information, including SMS, phone location, etc and associated services for hacking accounts (VK, Gmail, etc). You don't need to be a government, it is open for everyone.
- Andrew_nenakhov 7y agoThat type of service can allow the attackers to access SMS contents, but not from swapping numbers back and forth between SIM cards. And without it, the victim will know he is being attacked.
- laurentdc 7y ago> if you do, use a foreign SIP number with SMS capabilities Any good providers? I've tried Twilio SMS forwarding, but different services (e.g. Steam) reject it for 2FA since they're pretty much considered throwaway numbers, I suppose there's some sort of blacklist
- Andrew_nenakhov 7y agoI have used zadarma.com, they are very cheap and have an app for Android that works rather well
- 29083011397778 7y agoI've had a lot of luck with Voip.ms as a provider for short-codes. Their wiki states that they cannot guarantee they work (which I take no surprise in), but I don't recall having one fail since they rolled it out. I've used it for Signal, Whatsapp, and more that I'm sure I've forgotten. Even better, SMS is forwarded to email - available from my desktop or phone.
- Nextgrid 7y agoFor UK numbers lookup Andrews & Arnold. They have mobile numbers from a national carrier's numbers block so no way for them to be flagged as VoIP. They work fine with both calls & SMS.
- saalweachter 7y agoIt's also important to know your threat model. Namely, random attacks versus targeted attacks. Shitty 2fa will still deter people who get a list of a hundred million emails/usernames and passwords and try them on banks, Twitter etc from putting in the extra work to break into your account specifically. If you expect targeted attacks - from governments, because you oppose them, from determined criminals, because you have a lot of nice stuff to steal, or from people around you, because you know too many assholes - maybe it might as well not exist, but for most people, most of the time, any 2fa is better than none.