4 ms·

Indeed! And if you have access to SS7, you can do it without the middle-man $15 service! These systems are really designed for use in a world where only trust

by g_p 6y ago

Indeed! And if you have access to SS7, you can do it without the middle-man $15 service! These systems are really designed for use in a world where only trusted actors have any access to the system! That's clearly not true with all these third parties exposing functionality to the general public! [1] https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet...

thaumasiotes 6y ago
> And if you have access to SS7, you can do it without the middle-man $15 service! This doesn't really seem to make things any worse. Surely it's easier to have $15 than it is to have access to SS7.
- MayeulC 6y ago
  Right, but $15 a piece makes it only worth it for targeted attacks. Even if it's harder or more expensive to get access to SS7, it might become economical to attempt MITM on a larger target base once you do.
- myself248 6y ago
  Yeah, but say you want to hijack a million accounts. It's easier to have access to SS7 than $15 million.
  - thaumasiotes 6y ago
    What's the threat model there?
    - nine_k 6y ago
      Installing a backdoor to a a piece of equipment that handles SS7, for instance?
      - thaumasiotes 6y ago
        No, what is the threat model for the agent who wants to hijack text messages to a million random phones? Why are they doing it?
        hansvm 6y ago
        Off the top of my head: - Major players are using phone numbers to de-dup people. Use your million phone numbers to bypass such verifications and aggregate more power than intended. You could sell the accounts directly or monetize them individually (e.g., social media like farms, turning cloud free trials into dogecoin, ...). - Way too many services believe that if you control a phone/email you must be the account holder. Banks, 401k managers, and other critical pieces of infrastructure are more than happy to harvest your phone number for "added security" and proceed to weaken the security on your account by allowing anyone with control of that phone number to hijack the account. - Unique phone numbers are valuable in their own right. Individual numbers have max message rates and other garbage, but with an army of phone numbers you can, e.g., send out the same scam message to most phone numbers, see who bites, and use that to build a curated list of a hopefully much smaller set of numbers to target with real people. - If you have any extra information like a plausible contact graph you can use that to impersonate people for viral marketing or something (kind of like how the Marco Polo app texted your entire contact list without your permission). I'm pretty sure permissions are way more locked down than they were when apps used to just use your phone directly, but if you control the phone number and have that contact info then you could pull off a similar marketing trick still today. - Just snooping on the information is probably valuable. I'm struggling to imagine how you'd monetize it directly (some kind of insider trading?), but 1M person-hours worth of intercepted texts can't be worth <=$0 I don't think.
        thaumasiotes 6y ago
        > Banks, 401k managers, and other critical pieces of infrastructure are more than happy to harvest your phone number for "added security" and proceed to weaken the security on your account by allowing anyone with control of that phone number to hijack the account. This is a targeted attack. > Individual numbers have max message rates and other garbage, but with an army of phone numbers you can, e.g., send out the same scam message to most phone numbers As I read this, it involves sending messages from random numbers, not reading messages that get sent to random numbers? > I'm struggling to imagine how you'd monetize it directly (some kind of insider trading?), but 1M person-hours worth of intercepted texts can't be worth <=$0 I don't think. Data can easily be worthless if it takes effort to process and doesn't produce much value. This is a common case; "if the data exists, it must be valuable" is not a particularly strong argument. Insider trading doesn't really work, since by hypothesis you have no idea who the people are whose messages you're reading. (If you know, then you're performing a targeted attack.) There's no "inside" as far as you're concerned.
    - tinus_hn 6y ago
      You could become employed at the company, or break in or compromise one of the employees, to get access to the messages from valuable targets
gsich 6y ago
And how to get that?
- g_p 6y ago
  It's not a publicly facing service that's on offer, but some smaller telcos and sketchy VoIP providers with legacy access often re-sell it. There's some good CCC talks on the subject if it's of interest.

by g_p 6y ago

thaumasiotes 6y ago

> And if you have access to SS7, you can do it without the middle-man $15 service! This doesn't really seem to make things any worse. Surely it's easier to have $15 than it is to have access to SS7.

MayeulC 6y ago
Right, but $15 a piece makes it only worth it for targeted attacks. Even if it's harder or more expensive to get access to SS7, it might become economical to attempt MITM on a larger target base once you do.
myself248 6y ago
Yeah, but say you want to hijack a million accounts. It's easier to have access to SS7 than $15 million.
- thaumasiotes 6y ago
  What's the threat model there?
  - nine_k 6y ago
    Installing a backdoor to a a piece of equipment that handles SS7, for instance?
    - thaumasiotes 6y ago
      No, what is the threat model for the agent who wants to hijack text messages to a million random phones? Why are they doing it?
      - hansvm 6y ago
        Off the top of my head: - Major players are using phone numbers to de-dup people. Use your million phone numbers to bypass such verifications and aggregate more power than intended. You could sell the accounts directly or monetize them individually (e.g., social media like farms, turning cloud free trials into dogecoin, ...). - Way too many services believe that if you control a phone/email you must be the account holder. Banks, 401k managers, and other critical pieces of infrastructure are more than happy to harvest your phone number for "added security" and proceed to weaken the security on your account by allowing anyone with control of that phone number to hijack the account. - Unique phone numbers are valuable in their own right. Individual numbers have max message rates and other garbage, but with an army of phone numbers you can, e.g., send out the same scam message to most phone numbers, see who bites, and use that to build a curated list of a hopefully much smaller set of numbers to target with real people. - If you have any extra information like a plausible contact graph you can use that to impersonate people for viral marketing or something (kind of like how the Marco Polo app texted your entire contact list without your permission). I'm pretty sure permissions are way more locked down than they were when apps used to just use your phone directly, but if you control the phone number and have that contact info then you could pull off a similar marketing trick still today. - Just snooping on the information is probably valuable. I'm struggling to imagine how you'd monetize it directly (some kind of insider trading?), but 1M person-hours worth of intercepted texts can't be worth <=$0 I don't think.
        thaumasiotes 6y ago
        > Banks, 401k managers, and other critical pieces of infrastructure are more than happy to harvest your phone number for "added security" and proceed to weaken the security on your account by allowing anyone with control of that phone number to hijack the account. This is a targeted attack. > Individual numbers have max message rates and other garbage, but with an army of phone numbers you can, e.g., send out the same scam message to most phone numbers As I read this, it involves sending messages from random numbers, not reading messages that get sent to random numbers? > I'm struggling to imagine how you'd monetize it directly (some kind of insider trading?), but 1M person-hours worth of intercepted texts can't be worth <=$0 I don't think. Data can easily be worthless if it takes effort to process and doesn't produce much value. This is a common case; "if the data exists, it must be valuable" is not a particularly strong argument. Insider trading doesn't really work, since by hypothesis you have no idea who the people are whose messages you're reading. (If you know, then you're performing a targeted attack.) There's no "inside" as far as you're concerned.
  - tinus_hn 6y ago
    You could become employed at the company, or break in or compromise one of the employees, to get access to the messages from valuable targets

gsich 6y ago

And how to get that?

g_p 6y ago
It's not a publicly facing service that's on offer, but some smaller telcos and sketchy VoIP providers with legacy access often re-sell it. There's some good CCC talks on the subject if it's of interest.