4 ms·
This argument seems strange to me.. how many attacks are by someone literally armed with a customer list from a financial institution? The "casting a wide net"
by JamisonM 5y ago
This argument seems strange to me.. how many attacks are by someone literally armed with a customer list from a financial institution? The "casting a wide net" seems directly opposed to the effort involved in a SMS intercept attack which requires significant resources. I don't see a practical circumstance where this is a reasonable risk I guess. I just don't know. I would love an article-length explainer out there somewhere I guess, I just haven't seen one.
- toast0 5y agoA targetted SMS interception attack looks like something something SS7 or SIM swap/social engineering, but a wide net attack looks like pwn the telco and get ssh access to an SMS gateway (or logs, or a database with content), or an aggregator, or a middleman SMS provider between aggregator(s) and carriers, or posing as a legit (or grey route) middleman and getting in routing and then snooping on stuff. Or just a highly priviledge position at a carrier or sms aggregator. If your wide net lets you see 2FA codes, sometimes you can do stuff.
- JamisonM 5y agoI guess that's the thing I don't get.. you need to pwn a bank and then pwn a telco.. it feels like if it were a probable scenario all these issues with SS7 would be long fixed, so it must be an improbable scenario? My recollection is that we had that once incident in Germany with 02, but never really heard how much was lost and it was the result of a bad policy at 02 that they fixed and was particular to 02.
- toast0 5y agoIf you pwn the telco, and the bank has poor password recovery policiss, you might be able to just recover the password. Or maybe password reuse, etc. I assume if you pwn a bank, you don't really need 2fa codes, but I dunno