6 ms·

Carrier injecting ads into SMS '2FA' texts

69 points by exabrial 5y ago

exabrial 5y ago
I hope Apple, Google, et all will step using SMS as required 2FA, or regulation comes down the pipeline to eliminate this practice.
- amichal 5y ago
  NIST attempted to indicate SMS was not usable for 2FA sometime in 2016. Since other methods were not common yet (and maybe because banks had just barely gotten SMS 2FA deployed?) they were pressured to "soften" their recommendation. Their followup blog post https://www.nist.gov/blogs/cybersecurity-insights/questionsand-buzz-surrounding-draft-nist-special-publication-800-63-3 https://www.nist.gov/blogs/cybersecurity-insights/questionsa... Edit: https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB 5.1.3.3 Authentication using the Public Switched Telephone Network Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10. If out-of-band verification is to be made using the PSTN, the verifier SHALL verify that the pre-registered telephone number being used is associated with a specific physical device. Changing the pre-registered telephone number is considered to be the binding of a new authenticator and SHALL only occur as described in Section 6.1.2. Verifiers SHOULD consider risk indicators such as device swap, SIM change, number porting, or other abnormal behavior before using the PSTN to deliver an out-of-band authentication secret.
  - atatatat 5y ago
    Good to know even they're toothless, now..
    - deleted 5y ago
      [deleted]
    - meepmorp 5y ago
      NIST isn't a regulatory agency, so they aren't meant to have "teeth."
  - rocqua 5y ago
    That blog post was really interesting. I'm going to save it for future reference.
- bagacrap 5y ago
  not only does Google not require 2fa, it offers multiple other methods of 2fa besides sms
- lotsofpulp 5y ago
  Google does not require SMS 2FA. Not sure if Apple does, they prefer to use other devices logged into iCloud as 2FA.
tyz10 5y ago
The purpose of most 2FA schemes is not to secure things, but to get a unique identifier of the user. The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. Of course, since cloud providers constantly have security holes and leak databases, perhaps 2FA is for covering up their bad practices, too.
- ascagnel_ 5y ago
  2FA is more to protect users from phishing attempts than for securing a database, at least in my view. If you fall for a phishing attempt, it means your attacker will need to take the extra step of breaching/replicating your 2FA setup, and the service provider can note the login attempts and notify you (giving you a chance to change your password, rendering the result of the initial attack unusable). 2FA is not for securing a database -- salted+hashed passwords do that.
  - perryizgr8 5y ago
    > 2FA is more to protect users from phishing attempts Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. So I feel 2FA is worse than useless for preventing phishing attempts.
    - ascagnel_ 5y ago
      I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset. Independent of a login, they should be totally useless. - If someone is phishing via a phone call, I'd expect that they already have the password in-hand, either because the bank themselves have been breached or because your grandmother was re-using the username/password combination on another website that got breached (a situation that should be taken into account as a common case when designing login systems nowadays). Again, 2FA isn't to _prevent_ a phishing attempt, it's to throw up additional barriers to someone attempting to phish. 2FA is also great for situations where someone else has been breached, since an attacker can't then immediately take a re-used password and shove it into a third-party system to get access.
metalliqaz 5y ago
Previously on HN: https://news.ycombinator.com/item?id=27679433 https://news.ycombinator.com/item?id=27679433
matheusmoreira 5y ago
Is there some kind of limit to how obnoxious advertisers can become?
- dylan604 5y ago
  I would suggest watching Black Mirror to see that the answer is no
  - matheusmoreira 5y ago
    One million merits is my favorite black mirror episode.
    - tialaramex 5y ago
      I'm not sure it's permissible to have a favourite Black Mirror episode which isn't San Junipero.
- tialaramex 5y ago
  Effective regulators can deliver such limits. For example, Americans are used to obnoxious TV adverts for medicines they don't need and financial investments that are a bad idea, because their regulator says that is OK. In many countries neither of these would be allowed, the TV channel and the advertiser might be fined so they wouldn't even try. This needn't be too expensive if done right. The ASA in the UK (which regulates print advertising, billboards, that sort of thing) is not the government, it's funded by the advertising industry itself under the threat that the government might find it easier to just outlaw whole swathes of their industry if they get out of hand. So ASA "rulings" are like a slap on the wrist from your mother in two senses. They seem like a big deal if you didn't realise what you were doing is naughty, but also, if you're intentionally naughty enough because you know there aren't real consequences just a slap on the wrist, the next step may be you're off to jail instead. Some advertisers will deliberately do something that gets negative attention, knowing they'll get free secondary advertising from press coverage of a "ban" and the ASA is no big deal, but even if they stray over the lines it's pretty clear where those lines are.
- 5y ago
tyleo 5y ago
Google (who isn’t at fault) is named like 5 times in the Twitter thread. At a glance it as though they are to blame even though further reading shows they aren’t. Despite this, the carrier is kept anonymous? Strange.
- ajsnigrutin 5y ago
  Yep.. naming and shaming the carried should be the first thing in the article. They'll probably disable this feature, apologize, and act as if they did nothing wrong.
  - newnamenewface 5y ago
    The carrier hasn't been shared with the reporting website so far as I can tell.
    - gruez 5y ago
      Looks it has. >Google is investigating and looking into responsible (Australian) carrier. We’ve also reached out to the company for more details and to confirm that it’s not adding “SMS ADs” into the verification code process.
      - newnamenewface 5y ago
        Aw, my mistake, I missed that.
- bluesign 5y ago
  Google is to blame though. They are sending sms over a 3rd party which is probably using some shady service on that country for sms termination. They are avoiding carrier termination fee, basically being cheap. Google has power to by contract force third party to make deals directly with carriers. If I charge my clients on my website with some shady CC processor and they are scammed, everyone would blame me.
  - 5y ago
signal11 5y ago
SMS 2FA is an antipattern. Many people know this, but it's not percolated down to everyone just quite yet.
- tyleo 5y ago
  I don’t know. It is maybe not as secure as possible but it is certainly more secure than a password. I think it’s a baby step. I see other threads under the parent comment recommend banning SMS 2FA altogether. Surely this would be a step back. I suspect most people and companies would think, “well, I guess we won’t do 2FA anymore” rather than, “I guess we will use a proper Authenticator instead”.
  - meowster 5y ago
    > it is certainly more secure than a password. I disagree. I can safely store a long, complex, and unique password. I cannot prevent anyone from social engineering my cell phone service provider and doing a SIM swap.
    - johnasmith 5y ago
      2FA is a layer of security on top of your password. Nothing stops you from using a strong password stored in an encrypted place.
      - meowster 5y ago
        In all the cases I've seen, the password can be bypassed with a password reset using SMS, thus SMS becomes 1FA. What if someone stole my phone and I'm unable to instantly get a replacement? I don't want to be locked out of my account either.
  - signal11 5y ago
    You're just thinking of security -- and there are many valid concerns around using SMS-based cleartext messages as a 2nd factor. But additionally, a big issue is reliability of the 2FA mechanism. Especially when your service provider is overseas, or you're roaming, the SMSes may simply not arrive in time.
baybal2 5y ago
Google appends a very easily identifiable per-app random string, which was probably somebody's dream to farm 2FA codes. By making 2fa codes per-app identifiable, the situation was only made worse.
dmitryminkovsky 5y ago
> The advertisement — for a VPN — includes a quick message and short URL. ~ Amazing ~
hashtag-til 5y ago
Somebody else in the same twitter thread named the carrier as 'boost' (which I never heard about). https://twitter.com/saltajose/status/1410538739588292609 https://twitter.com/saltajose/status/1410538739588292609
- viro 5y ago
  if its boost moblie I can't say im very surprised. basically tracfone level trash
draw_down 5y ago
Now you know why iMessage exists.
smoldesu 5y ago
"I'm electing not to state the carrier for privacy reasons" Cool, so this entire brouhaha was for nothing? You just wanted to pistol-whip Google for something they had nothing to do with, and then you're refusing the publicly persecute the real bad actor?

69 points by exabrial 5y ago

I hope Apple, Google, et all will step using SMS as required 2FA, or regulation comes down the pipeline to eliminate this practice.

amichal 5y ago
NIST attempted to indicate SMS was not usable for 2FA sometime in 2016. Since other methods were not common yet (and maybe because banks had just barely gotten SMS 2FA deployed?) they were pressured to "soften" their recommendation. Their followup blog post https://www.nist.gov/blogs/cybersecurity-insights/questionsand-buzz-surrounding-draft-nist-special-publication-800-63-3 https://www.nist.gov/blogs/cybersecurity-insights/questionsa... Edit: https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB 5.1.3.3 Authentication using the Public Switched Telephone Network Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10. If out-of-band verification is to be made using the PSTN, the verifier SHALL verify that the pre-registered telephone number being used is associated with a specific physical device. Changing the pre-registered telephone number is considered to be the binding of a new authenticator and SHALL only occur as described in Section 6.1.2. Verifiers SHOULD consider risk indicators such as device swap, SIM change, number porting, or other abnormal behavior before using the PSTN to deliver an out-of-band authentication secret.
- atatatat 5y ago
  Good to know even they're toothless, now..
  - deleted 5y ago
    [deleted]
  - meepmorp 5y ago
    NIST isn't a regulatory agency, so they aren't meant to have "teeth."
- rocqua 5y ago
  That blog post was really interesting. I'm going to save it for future reference.
bagacrap 5y ago
not only does Google not require 2fa, it offers multiple other methods of 2fa besides sms
lotsofpulp 5y ago
Google does not require SMS 2FA. Not sure if Apple does, they prefer to use other devices logged into iCloud as 2FA.

tyz10 5y ago

The purpose of most 2FA schemes is not to secure things, but to get a unique identifier of the user. The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. Of course, since cloud providers constantly have security holes and leak databases, perhaps 2FA is for covering up their bad practices, too.

ascagnel_ 5y ago
2FA is more to protect users from phishing attempts than for securing a database, at least in my view. If you fall for a phishing attempt, it means your attacker will need to take the extra step of breaching/replicating your 2FA setup, and the service provider can note the login attempts and notify you (giving you a chance to change your password, rendering the result of the initial attack unusable). 2FA is not for securing a database -- salted+hashed passwords do that.
- perryizgr8 5y ago
  > 2FA is more to protect users from phishing attempts Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. So I feel 2FA is worse than useless for preventing phishing attempts.
  - ascagnel_ 5y ago
    I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset. Independent of a login, they should be totally useless. - If someone is phishing via a phone call, I'd expect that they already have the password in-hand, either because the bank themselves have been breached or because your grandmother was re-using the username/password combination on another website that got breached (a situation that should be taken into account as a common case when designing login systems nowadays). Again, 2FA isn't to _prevent_ a phishing attempt, it's to throw up additional barriers to someone attempting to phish. 2FA is also great for situations where someone else has been breached, since an attacker can't then immediately take a re-used password and shove it into a third-party system to get access.

metalliqaz 5y ago

Previously on HN: https://news.ycombinator.com/item?id=27679433 https://news.ycombinator.com/item?id=27679433

matheusmoreira 5y ago

Is there some kind of limit to how obnoxious advertisers can become?

dylan604 5y ago
I would suggest watching Black Mirror to see that the answer is no
- matheusmoreira 5y ago
  One million merits is my favorite black mirror episode.
  - tialaramex 5y ago
    I'm not sure it's permissible to have a favourite Black Mirror episode which isn't San Junipero.
tialaramex 5y ago
Effective regulators can deliver such limits. For example, Americans are used to obnoxious TV adverts for medicines they don't need and financial investments that are a bad idea, because their regulator says that is OK. In many countries neither of these would be allowed, the TV channel and the advertiser might be fined so they wouldn't even try. This needn't be too expensive if done right. The ASA in the UK (which regulates print advertising, billboards, that sort of thing) is not the government, it's funded by the advertising industry itself under the threat that the government might find it easier to just outlaw whole swathes of their industry if they get out of hand. So ASA "rulings" are like a slap on the wrist from your mother in two senses. They seem like a big deal if you didn't realise what you were doing is naughty, but also, if you're intentionally naughty enough because you know there aren't real consequences just a slap on the wrist, the next step may be you're off to jail instead. Some advertisers will deliberately do something that gets negative attention, knowing they'll get free secondary advertising from press coverage of a "ban" and the ASA is no big deal, but even if they stray over the lines it's pretty clear where those lines are.
5y ago

tyleo 5y ago

Google (who isn’t at fault) is named like 5 times in the Twitter thread. At a glance it as though they are to blame even though further reading shows they aren’t. Despite this, the carrier is kept anonymous? Strange.

ajsnigrutin 5y ago
Yep.. naming and shaming the carried should be the first thing in the article. They'll probably disable this feature, apologize, and act as if they did nothing wrong.
- newnamenewface 5y ago
  The carrier hasn't been shared with the reporting website so far as I can tell.
  - gruez 5y ago
    Looks it has. >Google is investigating and looking into responsible (Australian) carrier. We’ve also reached out to the company for more details and to confirm that it’s not adding “SMS ADs” into the verification code process.
    - newnamenewface 5y ago
      Aw, my mistake, I missed that.
bluesign 5y ago
Google is to blame though. They are sending sms over a 3rd party which is probably using some shady service on that country for sms termination. They are avoiding carrier termination fee, basically being cheap. Google has power to by contract force third party to make deals directly with carriers. If I charge my clients on my website with some shady CC processor and they are scammed, everyone would blame me.
- 5y ago

signal11 5y ago

SMS 2FA is an antipattern. Many people know this, but it's not percolated down to everyone just quite yet.

tyleo 5y ago
I don’t know. It is maybe not as secure as possible but it is certainly more secure than a password. I think it’s a baby step. I see other threads under the parent comment recommend banning SMS 2FA altogether. Surely this would be a step back. I suspect most people and companies would think, “well, I guess we won’t do 2FA anymore” rather than, “I guess we will use a proper Authenticator instead”.
- meowster 5y ago
  > it is certainly more secure than a password. I disagree. I can safely store a long, complex, and unique password. I cannot prevent anyone from social engineering my cell phone service provider and doing a SIM swap.
  - johnasmith 5y ago
    2FA is a layer of security on top of your password. Nothing stops you from using a strong password stored in an encrypted place.
    - meowster 5y ago
      In all the cases I've seen, the password can be bypassed with a password reset using SMS, thus SMS becomes 1FA. What if someone stole my phone and I'm unable to instantly get a replacement? I don't want to be locked out of my account either.
- signal11 5y ago
  You're just thinking of security -- and there are many valid concerns around using SMS-based cleartext messages as a 2nd factor. But additionally, a big issue is reliability of the 2FA mechanism. Especially when your service provider is overseas, or you're roaming, the SMSes may simply not arrive in time.

baybal2 5y ago

Google appends a very easily identifiable per-app random string, which was probably somebody's dream to farm 2FA codes. By making 2fa codes per-app identifiable, the situation was only made worse.

dmitryminkovsky 5y ago

> The advertisement — for a VPN — includes a quick message and short URL. ~ Amazing ~

hashtag-til 5y ago

Somebody else in the same twitter thread named the carrier as 'boost' (which I never heard about). https://twitter.com/saltajose/status/1410538739588292609 https://twitter.com/saltajose/status/1410538739588292609

viro 5y ago
if its boost moblie I can't say im very surprised. basically tracfone level trash

draw_down 5y ago

Now you know why iMessage exists.

smoldesu 5y ago

"I'm electing not to state the carrier for privacy reasons" Cool, so this entire brouhaha was for nothing? You just wanted to pistol-whip Google for something they had nothing to do with, and then you're refusing the publicly persecute the real bad actor?