5 ms·

> had to perform a "SIM swap" type attack on the users. source? I kind of doubt that's something coinbase would call a flaw in their system?

by detaro 5y ago

vngzs 5y ago
In the linked PDF, Coinbase does not claim to have knowledge of a vulnerability in their system (edit: though it does note "the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process," I interpreted that as "we supported SMS account recovery at all" which is inherently broken [0]). The requisite two-factor bypass is detailed in the linked pdf: > Even with the information described above, additional authentication is required in order to access your Coinbase account. However, in this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account. My guess is, because funds were stolen from users' accounts, the CA breach notification laws apply and this needed to be disclosed as such. However, that doesn't necessarily mean that Coinbase was technically "breached," only that customer accounts were compromised. If the attacker controls your personal email associated with Coinbase, accompanying passwords, and phone number, and you use SMS 2FA, then your funds were stolen. Otherwise, they were safe. That's my reading of the article. [0]: https://krebsonsecurity.com/2019/08/who-owns-your-wireless-service-crooks-do/ https://krebsonsecurity.com/2019/08/who-owns-your-wireless-s...
- deleted 5y ago
  [deleted]
- detaro 5y ago
  They also say "we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process". What did they update if it wasn't due to a weakness on their side? EDIT: on reading some of their docs, recovery is supposed to be followed by the user submitting ID documents etc before they get full access back - maybe that's the part they didn't do before or that could somehow be circumvented? (which is a flaw, but still requires intercepting the SMS to use?)
  - vngzs 5y ago
    I bet that control of email address + SMS 2FA was sufficient, alone, to recover the Coinbase account password. Lots of systems permit this kind of recovery, and while I may tell a technical crowd "if you use SMS for 2FA, that's on you" less technical users may not have the requisite background to understand the security tradeoff they make in doing so. The "flaw," in my reading of it, was to support SMS-based account recovery at all. But I'm not necessarily right here, and open to alternatives.
have_faith 5y ago
It doesn't matter who techinically is at fault Coinbase wants to stay ahead of the potential bad press and people pulling all their funds from the platform. Probably just figured this was cheaper.
- detaro 5y ago
  I'm in no way arguing that they shouldn't notify people/replace money/..., I just wonder where the confidence for the claim that it was just SIM swapping comes from.
nemacol 5y ago
And they would have had to do ~6000 SIM swaps? that seems like too many for a short period of time. Maybe?
- vngzs 5y ago
  There is some speculation in another comment that their SMS verification server may have actually had a technical flaw, and the issue was not a lack of separate identity verification on SMS [0]. However, around the time of the breach date (March - May 2021), there were a number of "B2B" services that offered a "type in any SMS number and you will get all text messages to that number," type feature intended for customer support teams to use for shared SMS access. Those systems often had privileged access to telcos and were regularly exploited by attackers to break 2FA without even a SIM swap [1]. With those tools, stealing all SMS to a number required only intent, not conversations with telco support personnel. [0]: https://news.ycombinator.com/item?id=28720280 https://news.ycombinator.com/item?id=28720280 [1]: https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s...
  - nemacol 5y ago
    Interesting. thank you for the links.
sam0x17 5y ago
These days in infosec circles simply having SMS-based 2FA enabled is now considered a no-no because of the notoriously bad (and inconsistent) security measures at large mobile carriers.
nabakin 5y ago
Looking at his other comments, he's speculating. The document talks about obtaining an SMS verification token, they say "we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process", and have not removed SMS as an authentication option. I see no reason to think this vulnerability was a SIM swap. Him stating it as if it's a fact in his original comment is very misleading.

> had to perform a "SIM swap" type attack on the users. source? I kind of doubt that's something coinbase would call a flaw in their system?

by detaro 5y ago

> had to perform a "SIM swap" type attack on the users. source? I kind of doubt that's something coinbase would call a flaw in their system?

vngzs 5y ago

In the linked PDF, Coinbase does not claim to have knowledge of a vulnerability in their system (edit: though it does note "the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process," I interpreted that as "we supported SMS account recovery at all" which is inherently broken [0]). The requisite two-factor bypass is detailed in the linked pdf: > Even with the information described above, additional authentication is required in order to access your Coinbase account. However, in this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account. My guess is, because funds were stolen from users' accounts, the CA breach notification laws apply and this needed to be disclosed as such. However, that doesn't necessarily mean that Coinbase was technically "breached," only that customer accounts were compromised. If the attacker controls your personal email associated with Coinbase, accompanying passwords, and phone number, and you use SMS 2FA, then your funds were stolen. Otherwise, they were safe. That's my reading of the article. [0]: https://krebsonsecurity.com/2019/08/who-owns-your-wireless-service-crooks-do/ https://krebsonsecurity.com/2019/08/who-owns-your-wireless-s...

deleted 5y ago
[deleted]
detaro 5y ago
They also say "we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process". What did they update if it wasn't due to a weakness on their side? EDIT: on reading some of their docs, recovery is supposed to be followed by the user submitting ID documents etc before they get full access back - maybe that's the part they didn't do before or that could somehow be circumvented? (which is a flaw, but still requires intercepting the SMS to use?)
- vngzs 5y ago
  I bet that control of email address + SMS 2FA was sufficient, alone, to recover the Coinbase account password. Lots of systems permit this kind of recovery, and while I may tell a technical crowd "if you use SMS for 2FA, that's on you" less technical users may not have the requisite background to understand the security tradeoff they make in doing so. The "flaw," in my reading of it, was to support SMS-based account recovery at all. But I'm not necessarily right here, and open to alternatives.

have_faith 5y ago

It doesn't matter who techinically is at fault Coinbase wants to stay ahead of the potential bad press and people pulling all their funds from the platform. Probably just figured this was cheaper.

detaro 5y ago
I'm in no way arguing that they shouldn't notify people/replace money/..., I just wonder where the confidence for the claim that it was just SIM swapping comes from.

nemacol 5y ago

And they would have had to do ~6000 SIM swaps? that seems like too many for a short period of time. Maybe?

vngzs 5y ago
There is some speculation in another comment that their SMS verification server may have actually had a technical flaw, and the issue was not a lack of separate identity verification on SMS [0]. However, around the time of the breach date (March - May 2021), there were a number of "B2B" services that offered a "type in any SMS number and you will get all text messages to that number," type feature intended for customer support teams to use for shared SMS access. Those systems often had privileged access to telcos and were regularly exploited by attackers to break 2FA without even a SIM swap [1]. With those tools, stealing all SMS to a number required only intent, not conversations with telco support personnel. [0]: https://news.ycombinator.com/item?id=28720280 https://news.ycombinator.com/item?id=28720280 [1]: https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s...
- nemacol 5y ago
  Interesting. thank you for the links.

sam0x17 5y ago

These days in infosec circles simply having SMS-based 2FA enabled is now considered a no-no because of the notoriously bad (and inconsistent) security measures at large mobile carriers.

nabakin 5y ago

Looking at his other comments, he's speculating. The document talks about obtaining an SMS verification token, they say "we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process", and have not removed SMS as an authentication option. I see no reason to think this vulnerability was a SIM swap. Him stating it as if it's a fact in his original comment is very misleading.