14 ms·
Can We Stop Pretending SMS Is Secure Now?
- billpg 6y agoI once had to send a fax that included a letter-head to authorize a domain transfer. Because fraudsters can't reproduce letter-head, I guess?
- dspillett 6y agoIt isn't even a reproduction problem. Who was bothering to verify that the letterhead was genuine? Letterheads for identity assurance were very much part of the security theatre of their day. In the case of domain transfers it might have really not been about security at all. Given the other dark patterns associated with that business I'd not be surprised if the requirement existed purely as a soft lock-in measure, to create friction to make transferring out more of a hassle.
- ryanlol 6y agoJust wait until he learns that all you need to intercept an email is a forged LOA!
- iscoelho 6y agoI really do wonder why this issue is not given more light. You can potentially BGP hijack a domain (via DNS) and e-mail (via SMTP) as a private individual so easily. Image a nation-state. These protocols only have bandaids like DNSSEC and RPKI stopping you from doing it, which both have painfully small adoption and don't realistically stop a determined attacker. This could happen at anytime by an individual with the motivation, and it only needs to be successful for a few minutes to gain access to a huge amount of private data. This has to be a huge national security risk, right? Why do we not take it seriously?
- biglost 6y agoWhere i live you can use an email as a proof of anything at court
- hansel_der 6y agoso can a fax, but bureaucratic shortsightedness is not a good proof of anything.
- EGreg 6y agoHow do you do these attacks exactly??
- bawolff 6y ago> You can potentially BGP hijack a domain (via DNS) and e-mail (via SMTP) as a private individual so easily. No you can't. Well various attacks exist against ip routing, dns, email forging etc,in practice they are really hard to pull off as an individual who isn't in a privileged network position (with possible exception of email forging. That one is a bit easier depending on stuff) > You can potentially BGP hijack a domain (via DNS) I think you might be confusing stuff here. Unless you bgp hijack the nameserver, but if you have that ability, why not go after the site directly?
- deleted 6y ago[deleted]
- ryanlol 6y ago> No you can't. Yes you can > they are really hard to pull off as an individual who isn't in a privileged network position “privileged network position”, as in someone with a couple of thousand dollars to spend.
- iscoelho 6y agoIf you've worked in the industry, you know you can get a BGP uplink these days with bare minimum IRR source validation with only a signature on a contract (not even payment is required to turn up generally). Using this, you can advertise any IP prefix you want. Since a lot of providers advertise /23+ as well, if you hijack the /24, you will always be the BGP best path and will be able to accomplish a full internet-wide hijack. Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. If you are a nation-state, you already have all of the above, and nobody to hold you accountable for using it.
- jlohn 6y agoSorry about the ignorance, but what's a LOA?
- rambojazz 6y agoHow does that work?
- ryanlol 6y agoBGP hijacking, you can send a fake LOA to almost any ISP and have them announce whatever IPs you’d like.
- gspr 6y agoBut at least for e-mail you can sign messages that are supposed to have serious consequences. I've never seen a signed SMS.
- ryanlol 6y agoOnly weird nerds actually sign their emails (beyond DKIM), people conducting meaningful transactions do not.
- tialaramex 6y agoSo, let's suppose you have a really excellent forged letter of authorization saying you are authorized to read my mail. Totally convincing, anyone who sees it will have no doubt it's real. What do you suppose you can do to give that effect? In the US SMS case LOAs work because it's in the interests of the people who can make it happen to make it happen. The LOA is just to cover their backsides, "Why did you redirect this Michigan man's SMS messages and thereby enable his life savings to be stolen?" "Oh we had this Letter of Authorization, so we honestly believed it's what he wanted". They don't believe that, but their lawyers are confident that it's enough excuse that, at least until after somebody powerful is inconvenienced, it will hold up. But nobody benefits from helping you give effect to your (convincing but bogus) LOA for my email. My ISP doesn't want anything to do with this work, if you're lucky they'll tell you that it's none of their business - more likely it just goes in the round file and you never hear back from them. There is no central clearing house for email that you can give a few bucks to for my emails so long as you have an LOA to keep them on the right side of the law. Instead for email everybody involved is getting paid by me, not by you, so they've got no reason to help you at all.
- ryanlol 6y ago> What do you suppose you can do to give that effect? To any ISP as I ask them to announce your MX IP addresses. > There is no central clearing house for email that you can give a few bucks to for my emails so long as you have an LOA to keep them on the right side of the law. There is, it’s called BGP.
- wealthyyy 6y agoYou don't need LOAs. You need a contract and an API with a upstream provider where you can attack numbers real-time.
- deleted 6y ago[deleted]
- hansel_der 6y agocan we stop pretending electronic communication involving of-the-shelf components is secure? i guess the pandemic has left us with little choice but meeting in person is still the only way to have a private conversation and i guess this won't change in the near future given the state of society.
- lxgr 6y agoNothing is secure, but some things are more secure than others. I'd argue it's still worth comparing and making conscious security tradeoffs.
- gregwebs 6y agoDoes using Google Voice for SMS resolve all security concerns?
- lxgr 6y agoNo, since many services intentionally don't allow using a VoIP number for SMS 2FA, for example Venmo. It's infuriating.
- aYsY4dDQ2NrcNzA 6y agoBut it sure is great when you can use Google Voice for this.
- mtgx 6y agoCompanies pretend SMS keeps you secure so they can get your phone number for promotions and tracking purposes. Facebook was caught red-handed doing exactly this. Look up articles about it. Google used to require a phone number for 2FA for a long time, too, but it's optional now.
- pmlnr 6y agoNobody ever pretended SMS is secure, but it's also the only thing that actually arrives on a phone in many rural areas of the world.
- loloquwowndueo 6y agoThen you probably don’t have a suitable internet connection and 2FA is not a concern to you, right? Also, did you know (tm) that other 2FA mechanisms such as OATH or Fido/fido2 don’t involve stuff arriving anywhere, other than the actual 2fa code? You generate it locally and then type it when promoted by the remote application. If you need 2FA, you have a computer with a suitable internet connection. If you can’t use non-SMS 2FA it’s likely you also actually have no use for it.
- deleted 6y ago[deleted]
- hansel_der 6y agothis! sms is also on the same security level with email, fax or a signed letter but way more convenient
- dathinab 6y agoit's actually less secure then email. Or even a signed letter depending on what security you are looking for.. And some 2FA are actually less demanding wrt. information delivery then SMS.
- lxgr 6y agoSpeak for yourself. I find it incredibly inconvenient compared to email.
- pmlnr 6y ago> sms is also on the same security level with email No, it's really not. Email can be cryptographically signed, SMS can not.
- 6y ago
- llimos 6y agoI've seen a few threads like this in the last few days. From where I'm standing, it seems to be a US-only issue. Can anyone please confirm that in a country that does not allow porting numbers without a code being sent to said number, and does not allow interceptions of the type described in the article, that using SMS for MFA is, in fact, secure?
- BillinghamJ 6y agoNo, I'm pretty sure eg SS7 attacks work for most (all?) countries. This particular issue might be US-specific, but the fundamental security problems of SMS are not US-exclusive
- wealthyyy 6y agoThis is not a SS7 attack. SS7 attacks doesn't work in practice. Eg A lot of carriers in US are CDMA. GSMA Carriers like AT&T has great firewalls in place to block SS7 attacks. Further, You can detect SS7 attacks. Major Banks already has measures in place...
- baybal2 6y agoSS7 attacks work in practice. Any network in existence that has roaming enabled is vulnerable to fake roaming requests, and they cannot be "firewalled." Seeing you implying that CDMA is somehow more resistant than GSM means you know very little how cell networks work. The telephony layer for both is SS7.
- wealthyyy 6y agoThe Banks already has anti fraud detection systems in place to detect Roaming attacks. They can see whether number is Roaming enabled or not. The Telecoms do prevent it with Firewalls. As for CDMA, Please see, https://www.wyden.senate.gov/imo/media/doc/Verizon%20SS7%20Letter.pdf https://www.wyden.senate.gov/imo/media/doc/Verizon%20SS7%20L...
- wealthyyy 6y agoMr Krebs, Please do your due diligence. The attack vector only works for Landlines, VOIP, Toll-free. Upstream agreements already block Mobile carriers. Further, SMS from Short Codes are blocked by default. You can only receive SMS from long-numbers. Eg Wicker ..
- wealthyyy 6y agoThe attack also works with Canadian carriers.
- jeroenhd 6y agoIt works for at least one mobile carrier, as demonstrated in the article Krebs references [1]. One carrier is enough. The ability to hijack text messages through an online service was also shown in an article Krebs' source mentioned [2]. Perhaps you're right that upstream agreements with mobile carriers should already be blocked, but in practice it's been proven not to be. There was a change to NetNumber's systems on 11 March to combat this, but there's no guarantee that their competitors don't have similar flaws or that the measures taken were good enough to stop the attack in practice. Even still, if the problem might be fixed in the entire US, that doesn't mean anything for the rest of the world. [1]: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1... [2]: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
- wealthyyy 6y agoAll your references are pointing to Lucky225 who is trying to market his anti-fraud product. NetNumber has no competitors. It's a routing database. The Vice article is a paid piece. This attack doesn't work with any of US Mobile carriers.
- wealthyyy 6y agoPlease see my comments at this thread, https://news.ycombinator.com/item?id=26468892 https://news.ycombinator.com/item?id=26468892 A lot of people confirmed this as FUD.
- m_eiman 6y agoHaving username+password+sms is strictly safer than having username+password. To require the attacker to know your phone number and do costly and/or time consuming things to get access to it means moving from "script kiddie re-using username+password from leaked user databases" to "targeted attacks". Sure, it's not Safe(tm), but it's a big step up from just username+password.
- asiachick 6y agoIt is? I thought the problem with SMS is you click "forgot password" and they send you a code via SMS to reset your password. Therefore username+password is safer than username+password+sms because username+password+sms = username (no password)
- hansel_der 6y agoi agree that username+sms is not good, but what are the other password reset vectors more secure than sms?
- caskstrength 6y agoAlmost anything (with exception of "3 easily googleable questions about you") is safer than sms. For example, emailing password reset link to my gmail account that is protected with real 2fa.
- lxgr 6y agoYes, and besides being more secure it is also more available: I'm much more likely to be able to receive email when resetting a password than I am to have cell reception and have the correct SIM card in my phone. (Examples for access to email but not SMS include: International travel, airplane Wi-Fi, bad cell signal.) I feel like much of what's wrong with SMS 2FA comes down to a misguided idea of "everyone has exactly one phone number", which is simply not true for a lot of people.
- wccrawford 6y ago
- switch007 6y agoCan we stop pretending that the faux concern for the security of our accounts by tech giants was anything other than an excuse to harvest our phone numbers? Twitter for example let's you sign up without a number but it then suddenly detects "suspicious activity" and demands your number. Many other sites enforce it or heavily nag you in the name of security.
- deepstack 6y agoExactly! Same with Google, FB. Disk space is almost free, let who ever sign up.
- b0afc375b5 6y agoAs a devil's advocate, how about the notion that requiring mobile numbers mitigates, if only a little, automated spam?
- nulbyte 6y agoThe problem with that is, if you are going to automate spam, you can afford a burner. Or heck, just pay the $16 or so and hijack someone else's number.
- erhan24 6y agoSpammers don't just use one account to spam.
- HenryBemis 6y agoThere are free services where you can see a number to get that 'activation code'. Plenty of such services out there.. (a quick search in DDG and this is the top result) https://mytempsms.com/receive-sms-online/country.html https://mytempsms.com/receive-sms-online/country.html
- 6y ago
- LordAtlas 6y agoIt's rather strange that in 2021, a prominent security research like Brian Krebs doesn't have a mobile-friendly website.
- dzdt 6y agoHow about we recognize that SMS should be secure and make it so? If the FCC would require mobile providers to add crypto features to SMS that prevent spoofing, would it not be possible to do so?
- afrcnc 6y agoCan we stop submitting Krebs articles and just submit the source instead? Such as this: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
- jabroni_salad 6y agoThe article you just linked is an advertisement for something called Okey Monitor and is not the original source for this event. The actual source is a Vice article, the author of which contracted a hacker to actually run an op on them as part of the investigation. However, submitting that directly would have simply attracted a bunch of really great political commentary instead of a discussion on SMS.
- SAI_Peregrinus 6y agoAnd it was already submitted, and discussed.
- fatnoah 6y agoI have a very solid understanding of how SMS works under the covers, and the Krebs article is actually much better than the original, since it adds more of the specific details of how changing SMS routing is different than number portability as well as some of the behind the scenes players.
- tyingq 6y agoInteresting. I knew about SIM swaps, but this "off-net text enablement" is new to me. I did know about text-enabled VoiP numbers, but assumed you had to own the DID first. Coupled with the notes about reseller programs with blanket authorizations, it does sound like SMS is truly useless for 2FA.
- apexalpha 6y agoHaving 2fa with SMS is still better than no 2fa at all. Sure, TOPT would be far better, but reading this article I'm more concerned with how easy it is to get access to someone's SMS/VoiceMail than anything else.
- payne92 6y agoSecurity is relative, NOT absolute. Involving SMS in the authentication process raises the bar significantly for script kiddie attacks using password databases. It also forces a larger and more detailed forensic trail for any attack.
- 33Backpack33 6y agoNot when script kiddies already have free tools like this https://vimeo.com/308709275 https://vimeo.com/308709275
- bosswipe 6y agoThis attack is enabled by VoIP, which is also responsible for callerID spoofing which has led to the tormenting of millions of people daily with phone spam. The gains from VoIP have absolutely not been worth the loss of trust in what was a reliable communication network. I continue to be unimpressed with "deregulation and free markets", in practice it usually means sharks feasting on confused consumers.