11 ms·

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh,

• only_as_i_fall 5y ago
  How does an sms hijacking attack typically work? I know sms isn't secure, but how does one go from having a password to bypassing the sms confirmation? Is it as easy as having the number and carrier?
  • cinntaile 5y ago
    Don't they just hijack your number with the help of the telecom company's helpdesk?
  • ImuMotive 5y ago
    It happened to me. Cellular carriers, in my case T-Mobile, didn't require any confirmation to port a number to a new phone/sim. Eventually some required the last 4 of your social security number to port a number, which we all know at this point are pretty much public anyway. T-Mobile now lets you set an arbitrary pin, which my parents promptly set to their DOB :facepalm: I haven't looked more into it, but as far as I know, sim swap/port attacks were hilariously simple to execute which is why I only use SMS verification when it's the only option.
    • deleted 5y ago
      [deleted]
    • Wowfunhappy 5y ago
      You might want to edit out what your parents set their pin to! (You can email hn@ycombinator.com if you're past the edit window.)
      • ImuMotive 5y ago
        Lol, I had made them change it as soon as they told me.
        • deleted 5y ago
          [deleted]
    • joshuaissac 5y ago
      Maybe what is needed is regulation that makes the service provider liable (with no option to disclaim it) for all damages suffered by the victim if the provider gives away their phone number to an attacker.
  • scrose 5y ago
    I accidentally ‘hijacked’ a number by typoing one number in my online request. I only found out after my wife pointed out my number was different after porting. It took a couple hours with the telco’s support agents, and practically no verification steps, to actually get my correct number back. Very sad state of affairs here.
• cinntaile 5y ago
  Google is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them your account is gone. No social engineering possible. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
  • pinum 5y ago
    “If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover your account. Google may take a few days to verify that it’s you and restore your access.” I trust that it would be (potentially much) harder than normal, but it still seems to be possible.
    • cinntaile 5y ago
      I was under the impression you were screwed in that case, thanks for pointing out that I was wrong. It's lot less secure than I thought.
      • withinboredom 5y ago
        IIRC, Google will stop the "several day process" if you log in at any time.
      • someguydave 5y ago
        Still sounds like a significant barrier to most phishing attacks.
        • cinntaile 5y ago
          A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real safety for political groups which Google kind of claims it does by using testimonies from politically vulnerable people to "advertise" the Advanced Protection Program. This is a tricky situation though since your adversaries could get your keys and your password and then they control your account without any chance of getting it back, so it's definitely a double edged sword.
• hn_throwaway_99 5y ago
  > Beating 2FA is almost always SMS hijacking That's most definitely not true, as someone who works in this space. Plain old phishing is much more common, where the hacker tricks a user into entering their code into a malicious website. To echo OP, this is why it's important to support non-phishable types of 2FA.
  • baxtr 5y ago
    Could you describe the types that are non-phishable?
    • fossuser 5y ago
      Yubikey is one - it requires the user touch a hardware device which signs something locally that I think is never sent? I don’t know enough of the implementation specifics, but it’s supposed to guard against this kind of thing.
      • klodolph 5y ago
        YubiKey uses U2F and FIDO2/WebAuthn. The YubiKey also does a lot of other things, depending on which YubiKey you have... but if you want 2FA on random websites, those are the most likely protocols (used for GitHub and the like). The basic U2F + FIDO2/WebAuthn is the least expensive model, around US$25. These days it works seamlessly on Chrome, Firefox, and Safari.
      • laggyluke 5y ago
        Yubikey is actually pretty "phishable", at least in the OTP mode. It will happily put the token into a phishing website (or literally anywhere else) as soon as you touch it. It's also good to know that Yubikey's OTP tokens don't expire based on time, but based on a hidden counter that gets incremented with every issued token. So if you've accidentally touched your Yubikey and leaked the token publicly, you just have to log out and then log back in using your Yubikey - that action will invalidate all tokens issued before this point.
        • 5y ago
• mushishi 5y ago
  How is it possible that some kind of imaginative script can be enough to get SMS sim swapped? Why aren't the operators requiring a strong identification via a passport or something like that? Maybe I'm really dumb but that just boggles my mind, whether or not there exist other types of alternatives to 2FA.
  • Destitute 5y ago
    There's not much you can confirm over the phone, except the account PIN and sometimes security hint. But an attacker can pretend to have forgotten it and press that the matter is urgent. If the attacker knows enough about the person, they might be able to convince an agent to make the swap so the agent can: 1) Get on with their day to maybe hit a support request quota 2) Make sure this person doesn't give them a bad customer satisfaction score
    • cinntaile 5y ago
      You could require verifying your identity using your electronic ID if you want to simswap by calling the helpdesk.
  • jdavis703 5y ago
    They could require this. Most of the big operators have physical stores where they could do an ID check. There should be an advanced protection mode where SIM swaps and other sensitive operations require physical authentication.
    • mushishi 5y ago
      Yes this, please!
• loloquwowndueo 5y ago
  It’s probably worth faking having lost your 2FA and asking for it to be reset. If you find out they are this careless with 2FA-protected accounts, you should probably not rely on it too much. I manage an authentication and identity provider and if someone gets locked out of 2FA and can’t prove their identity via a previously-uploaded gpg key, they get locked out for good. I never honor requests to reset the device sent by email, no matter how much they beg or offer to prove identity by sending copies of official IDs - I don’t care who they are now, I care about them being the same person that set up the account and 2FA, which can only be proven via a valid 2FA device or a GPG signature.
  • ceejayoz 5y ago
    > It’s probably worth faking having lost your 2FA and asking for it to be reset. I'm not sure I trust that I'd be as good an attacker as a professional, and there's not a great way to replicate "hang up, call again" approaches likely to work with a big org.
  • jokethrowaway 5y ago
    It could be worth it to spend the 1.50$ on stripe to do identity verification with id documents for accounts of a certain size, so that they can present those documents again to regain access to their account. Re-enabling the account after a certain period of time without activity would also be a good measure (on top of the id verification).
    • xwolfi 5y ago
      And then lose the documents in a big hack so that everyone with a forum access can use your passport copy. yes.
      • scrollaway 5y ago
        The whole point of using Stripe for it would be not to have the documents in question. Kind of like you don't hear about companies using stripe losing their customers' card numbers.
• InitialLastName 5y ago
  Wouldn't that be obvious to the victim the moment their phone didn't work? Or will the carrier leave the old SIM activated?
  • withinboredom 5y ago
    IIRC, in the US, sometimes just give the old sim some random phone number (to keep you paying the bill) and don't cancel the line. In the EU, I'm pretty sure they cancel the old line.
• wunderwuzzi23 5y ago
  Old school phishing is the most common MFA bypass. Here is a description how it works: https://github.com/wunderwuzzi23/KoiPhish https://github.com/wunderwuzzi23/KoiPhish Unless you use Yubikeys (webauthn) etc these phishing attacks just continue to work. I do consultancy in this space at times and about 95+% of folks who enter their password will also enter their MFA token.
  • hackettma 5y ago
    Followed the link and the read me is bit spare on details. For the less technical this still would require the phishee to manually enter credentials which then can be relayed to the attacker. Correct? The article mentions this happened while the author was asleep — any thoughts on how that would work?
    • tialaramex 5y ago
      One thing that can happen is you get enduring credentials from the OTP sign-in, and they last despite other credentials simultaneously existing elsewhere. I only use Facebook trapped inside Facebook Container in one Firefox on one computer. But my understanding is that it's possible to sign in to Facebook from say a phone and a laptop at the same time, so the bad guys could get you to give them working credentials one day and persist those until you're asleep before using them. If you went to Facebook's security settings "Where you're logged in" and it lists two logins, one in "Paris" while you are in New York, you might realise there's a problem and force them out. But most people likely never look at that, why would they?
  • FabHK 5y ago
    I might be tempted to enter the TOTP, but my browser is unlikely to enter the password, and I definitely won't.
    • andybak 5y ago
      I think the fact that password managers can spot incorrect urls better than users is useful. However I've become numbed to this warning flag by those services that seem to have endless different urls that are all legitimate. (Microsoft being a particular offender here). I can imaging some variant of outlook.microsoft.developer.really.yes.com catching me unawares one day.
• ignoramous 5y ago
  > ...has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") Isn't this vishing? https://youtu.be/BEHl2lAuWCk https://youtu.be/BEHl2lAuWCk
  • xsmasher 5y ago
    No; phishing / vishing is contacting the customer to get login details. Contacting support and getting them to circumvent security is social engineering.
• UncleMeat 5y ago
  Another poster has mentioned it, but I will add weight. This is super ultra mega wrong. Phishing SMS and TOTP codes is way more common than SIM-swapping. Outrageously so. SIM-swapping does not scale. You need to call up a company each time you want to do it. Yes, it works. But you cannot sell a tool that just automates it. In comparison, there are many off-the-shelf phishing kits that fully automate SMS and TOTP 2FA theft.
• samstave 5y ago
  >Beating 2FA is almost always SMS hijacking How exactly does this get executed? I'm pretty technical, but I cant fathom exactly how this occurs; You hijack a cell tower, then have some system to listen to un-encrypted SMS traffic?? Plz ELI5
  • ev1 5y ago
    It's zero cost and zero effort to port someone's number out, or get a new SIM card issued for the existing account. I've worked with a bunch of streamers and YouTubers, and the threat model is such that people have shown up with professionally made printed fake IDs to attempt hijacking in an actual retail carrier store.
  • josephcsible 5y ago
    It's an attack on humans, not on technology. You trick their phone carrier's employees into thinking that you're them and that you lost your phone. Then you end up with a SIM card assigned to their phone number, so you receive all of their calls and texts instead of them.
• hulitu 5y ago
  There is also the ad which runs on the same webpage and reads what you type or your clipboard.