46 ms·

SMS phishing is way too easy

637 points by ricardbejarano 4y ago

orliesaurus 4y ago
Request for proposal: SPF, DMARC, DKIM authenticity authentication but for SMS
bricemo 4y ago
Very sad to see the United States as “No” and “No” listed next to the protections page linked
- O__________O 4y ago
  Link you’re referring to is: https://support.sms.to/support/solutions/articles/43000562659-international-sender-id-regulations-and-requirements-list-of-countries- https://support.sms.to/support/solutions/articles/4300056265...
- njovin 4y ago
  My understanding is that US carriers don't support Sender ID at all, so having the caller ID/sender ID spoofed is not common (and maybe not possible?) on major US carriers. Whenever I get phishing SMS they always come from a random 10-digit phone number so it's pretty clear they're scams. Reputable companies send these types of messages with short-codes, which are a 5 or 6-digit numbers that is very expensive and require thorough vetting by the carriers.
  - kazz 4y ago
    They're not _that_ expensive (usually $500-$1k/mo) and I wouldn't really characterize the vetting as "thorough". Don't get me wrong, carriers have been making strides to lower the amount of spam that's sent through the air (A2P requirements, toll-free number verification requirements, etc), but a determined scammer can still exploit SMS/MMS pretty easily.
    - njovin 4y ago
      I've provisioned several shortcodes. There's a 12-week approval process (every carrier has to independently review & approve) and if you get flagged/reported for spam they will come after you for it. IMO this makes it prohibitively difficult & time-consuming for a bad actor to use effectively.
      - kazz 4y ago
        I think the processes are getting better each day, but it was only a couple of years ago that you could share a shortcode. My main point is that even with all of the safeguards it's still a ridiculously easy system to exploit. Most people will trust a toll-free number just as much as a shortcode, and since tons of legitimate companies use toll-free numbers for messaging it just blurs the line of what a "reputable" number looks like. Even SendGrid, which is owned by Twilio, uses toll-free numbers for their 2FA messages instead of shortcodes.
      - toast0 4y ago
        It also makes it difficult and time-consuming for a good actor to use effectively. As far as I could tell (although I retired in 2019, so might be out of date), you can't use one short code through multiple aggregators, so if you want the benefits of multiple routes, you've got to have multiple shortcodes or live with sending from regular phone numbers.
  - judge2020 4y ago
    Regarding caller ID, stir/shaken is being used in some situations and I know AT&T supports it within their own network (call history will have a checkmark to indicate it was verified).
  - saltminer 4y ago
    > Whenever I get phishing SMS they always come from a random 10-digit phone number so it's pretty clear they're scams Sadly, Novant Health (a hospital system) uses a regular 10-digit number for their patient portal 2FA. When I was in college, accessing sensitive info like your SSN and W2s in Banner also had 2FA via a 10-digit number. (This was an entirely separate system from the login 2FA provider, Duo, which uses shortcodes in addition to U2F tokens and their app.)
- ASalazarMX 4y ago
  Meanwhile countries like Congo, Bangladesh, Cambodia, etc. have Yes | Yes. We need some of that third world SMS protections.
  - toast0 4y ago
    I mean, we're protected from SMS from spoofed alphanumeric sender ids. What more do you want? Probably no nation has protection from spoofed numeric sender ids, but based on the sms phishing attempts I get, that's not a big deal. Apparently people will tap on links from their bank from any number anyway.
lxgr 4y ago
I wish we would just stop using phone numbers as the primary user identifier and SMS as the primary communication channel, period. The amount of cruft involved in SMS delivery is unbelievable, and phone numbers are neither particularly stable, nor particularly well protected against takeovers.
- byteflip 4y ago
  As someone who’s moving overseas shortly, changing/removing your number is a nightmare. It really is the primary UID. So many things use it for 2FA. In a lot of cases you HAVE to list a phone number. I ported my number to Google Voice as a decent alternative, but you kinda have to know what you’re doing ahead of time. My gf who moved first did not and deeply regrets it.
  - iLoveOncall 4y ago
    Wait until you move to your new country and discover that you need a local bank account to get a local phone number, but you need a local phone number to open a bank account.
    - GekkePrutser 4y ago
      Yes Ireland has this too. It's frustrating. They don't have a population registry so proof of address is a 'utility bill'. But to sign up for utilities you need a bank account which requires proof of address. Well you get it. Also relying on something from a commercial entity that's so easy to fake is weird.
      - ghaff 4y ago
        It's sometimes the case in the US as well. When I got my RealID driver's license I had to show some sort of utility bill as a proof of address--which, as you say, could be pretty easily faked.
        kevin_thibedeau 4y ago
deleted 4y ago
[deleted]
baxtr 4y ago
I have two phone numbers. One is for 2-way authentication, the other I give out freely on any website that requires a phone number (and to all my friends). It's basically the same setup I use with emails. Not entirely sure if it's safer that way. But so far I get SMS spam only on the "burner" number.
- semitones 4y ago
  Funny how friends, life, and everything other than 2-way auth is on the "burner" :)
- jimmywetnips 4y ago
  It's so fucking annoying. I was wondering if there exists some kind of service that I can install a browser plugin with and all it does is provide me a number to receive bullshit sms codes on, then I can quickly copy and paste quickly without having to used a phone
  - franga2000 4y ago
    That just shifts the trust to another company. There used to be a desktop app that did this with Twilio, which is more trustworty, but I don't remember what it was called or if it's still around.
    - deleted 4y ago
      [deleted]
  - amenghra 4y ago
    Use Google Voice as your 2nd number.
    - user_7832 4y ago
      I don't think Google voice (or privacy.com which I think also has this service) offer outside the US/in EU :(
silvestrov 4y ago
Another possible solution: Government enacts a law that telecom companies MUST ensure that SenderID is valid for the company that sends the SMS.
- feet 4y ago
  Yea but that would require that the government actually regulate something g which they haven't done since what, the 70s?
  - winrid 4y ago
    Well they just regulated women's bodies today...
    - feet 4y ago
      Oh no you see, that was deregulation! Now the states get the choice to regulate women's bodies Ugh But yea, trigger laws enacted have now regulated women's bodies in something like 15-20 States or something? It's disgusting
- onelesd 4y ago
  Telecoms lobby against this because they generate big revenues servicing SMS spammers whom end-users aren't able to effectively block since the ID is trivially spoofed.
  - remix2000 4y ago
    I wouldn't be surprised if telecoms themselves were the ones coordinating some SMS scam operations. This may sound tinfoilish, but we're talking about the same telecoms that were once caught red-handed tricking people into calling back foreign numbers...
  - newsclues 4y ago
    Ding ding ding! It’s profitable on multiple levels to allow this, so corporations ensure the political class doesn’t enact legislation for consumers.
mikece 4y ago
And yet almost every bank requires it for 2FA and only a precious few offer TOTP or some other reasonable and secure form of 2FA.
- sha256sum 4y ago
  FWIW, I have 4 "banking" accounts, 3 of which are major American banks and one is a local credit union. The latter is the ONLY one to offer 2FA via TOTP while the major banks only allow SMS or email 2FA.
  - hinkley 4y ago
    I'm still a little salty about Blizzard handing out free TOTP fobs at conventions and implementing an iOS app to do it, years or even a decade before financial institutions offered anything. It's a fucking game, protecting against gold farmers. How about protecting my non-virtual gold?
    - naniwaduni 4y ago
      I mean, they could do that because, with few hard legal obligations to you, their own internal assessment that implementing TOTP has a good chance of cutting support load and probably won't cause too many problems is Good Enough to move forward with it. Banks have to price in the risk that, if something does go wrong, they could have regulators on their back. And uh, have poor incentive structure wrt being perfectly allowed to do everything by the book and slipping responsibility if the book is just wrong.
- Gunax 4y ago
  Videogames are oddly the most secure of all. I don't know why (maybe criminals are more likely to go for your WoW account assuming the legal consequences are less) but I would advise all companies to examine how Blizzard, Valve, and others handle account security.
  - grogenaut 4y ago
rockbruno 4y ago
It's even worse when you think of how phone companies often recycle dead phone numbers. I remember in Brazil you would often hear of people accidentally stealing someone else's account in apps where login == phone number due do this. It's an awful verification system all over.
- herbst 4y ago
  My contract does state nowhere that I own or have any right to the number they gave me. Even thought I never saw that happen nothing is stopping them from just giving my number some else. It's so stupid to depend on something like this
- kayodelycaon 4y ago
  This is why I have a password on my Telegram account.
- LocalH 4y ago
  I changed phone numbers with Verizon to make use of a phone deal (wouldn’t let me apply it to an existing line) and they had reassigned my number within 60 days of switching it off.
O__________O 4y ago
Stop using SMS for 2FA. Not familiar with SMS Sender ID Verification, but after quick Google, I was unable to find any signs that it counters SMS spoofing. SMS as a 2FA channel is broken. There are so many vulnerabilities that it just makes no sense to use; for example: corrupt telco employees, SS7, sim card cloning, sim swap, spoofing, governments, etc. Beyond that, if you’re located or traveling internationally, it’s a nightmare to deal with. NIST has not recommended SMS based 2FA since 2016: https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...
- moffkalast 4y ago
  That may be so, but the alternative approach something like Google/KeePass/whatever Authenticator which has the issue of not being bound to your number (unlike SMSs) so if your phone gets destroyed you can't simply get a new phone and sim from the operator and continue as usual, you're completely fucked instead.
  - vladvasiliu 4y ago
    Depending on the authenticator used, you are absolutely not fucked. It even works while waiting for your new phone / sim (had this happened to me on a Saturday night in France. Nothing's open Sundays). There's Authy that does backups and you can even run it on a computer (even Linux!). 1Password can store OTPs, too, and is also backed up. There are probably a bunch of others and I'd expect KeePass to be able to do backups. Plus, you're usually able to get the OTP seed which you can store on your own. This usually shows up as "can't scan this code?" or similar when registering. I'm now traveling overseas, and have a local SIM in my phone. I have an older iPhone, so no dual-SIM for me. If I had to receive an SMS I guess it would still be better than my older Galaxy S5 which required a reboot, but it'd still be a pain to have to switch SIMs. If I lost my Phone but still had my laptop, I'd be AOK with my current OTP setup. Except for a few sites which don't allow me to have anything else besides an SMS, but luckily they're not critical.
    - moffkalast 4y ago
theginger 4y ago
As far as I am aware there is no reasonable way for carriers to verify sender IDs or to communicate a verified status with an SMS message. So you would end up labelling all messages as not verified, which might provide some clarity for a short time until it just becomes noise that gets ignored.
- ranger_danger 4y ago
  Voice calls have the same issue. Most leased lines and VoIP providers let you set your own P-Asserted-Identity header which can be used to spoof caller ID to anything you want.
krylon 4y ago
Huh. I received a text message a couple of weeks ago, informing me the "gift" that I had "bought" had been delivered to the "location agreed upon" by me, and to please visit this really suspicious looking URL for details. The Internet, for better or worse, has taught me a healthy amount of skepticism, plus I definitely had not bought any gifts (how is it a gift if I buy it myself?). But I can see how it is easy to fall for these scams if you aren't used to looking for them.
- jandrese 4y ago
  Halfway through reading this article I got a SMS from a New York City number saying: Your package delivery details are incorrect and we cannot deliver. https://usppagestrport.com/2vlv Obvious phishing attack, but you know some people are going to fall for it.
  - krylon 4y ago
    Many years ago, an IT security person I was talking to referred to humans as "the one security-critical component that cannot be updated". It's a bit cynical, but not entirely incorrect.
jakear 4y ago
Bottom line up front: When sending tokens via SMS, you must include a "do not share this token with anyone besides X.com" text. Otherwise account takeovers become trivial. The article's attack is relatively benign - the user simply goes to a website. Sure they may end up putting info in that website, but probably not. Plus existing systems for malicious website filtering can kick in to prevent this. The more concerning attack is the social engineering one where a third party says something like "let me 'verify' your identity, I'll send you a number tell me what it is" then triggers an identity verification request on the domain (this can be done either manually or part of a sign up flow for some honeypot service). Now the target needs only relay 6 digits to someone they already "trust" and are in a conversation with, versus in the article's example they needed to put their full account info into an unknown website.
- gzer0 4y ago
  https://www.bejarano.io/sms-phishing/ https://www.bejarano.io/sms-phishing/ HN discussion (8 days ago): https://news.ycombinator.com/item?id=31862994 https://news.ycombinator.com/item?id=31862994 I think a lot of people on this thread are forgetting just how easy it is to spoof SMS. - SMS has a field called sender ID, which is set by the sender, requires no identity verification, and can be any arbitrary short string. - This allows anyone to send messages to any number, identifying themselves as whoever they want to impersonate. - And since there’s no sender phone number in the message, your phone can’t tell real and fake messages apart. - And so it groups them into the same conversation
- vegetablepotpie 4y ago
  There are valid use cases to ignore the text message security advice. When I set up an account with my bank, I got an SMS security code that I had to read out to my banker to proceed with the account. The SMS did say not to share the code with anyone, I knew he was signing into the banks system, and I deduced that the system bankers use must be the same system normal users use, so this made sense to me. But an unsophisticated user would not know this, and would become to trusting of the helpful stranger asking for the SMS code despite the message text. There are institutions out there that are training your users to ignore your security advice.
kwhitefoot 4y ago
How do the examples in the article cause any problem. You only get sent a code when you request it. And you type it into a website that you are familiar with.
- ranger_danger 4y ago
  Not everyone is that smart.
- elboru 4y ago
  What about the FedEx one? I cannot count the number of times I’ve seen companies or even government offices using complicated and scammy-like URL names. It’s difficult to know if URLs are legit or not. HTTPS used to be a good enough indication of legit URLs, but not anymore. You could also think on googling the company. But those ads that look like real search results are well known to include scam websites! I’m a developer and I find it difficult to distinguish some URLs. Now imagine how difficult it can be for grandpa or really any person out there that doesn’t know about these kind of scams.
rr888 4y ago
I really dont want a phone number any more, I dont need one for any friends of family contact. Really the only reason is for 2fa which is ironic as it seems the weakest link.
- permo-w 4y ago
  I don't even want a (smart)phone anymore. The lack of control you have over your user experience, especially on Apple devices, is horrendous. you can't even really jailbreak apple devices anymore. on your PC you can reprogram anything, navigate around or fully prevent most malicious time-wasting practices (infinite feeds, reels, adverts) that you're near enough at the mercy of on a phone. the way I see it, smartphones are made for idiots Ideally I'd carry round a phone-sized PC running Linux with mobile capabilities, but as it is I settle for my laptop and a brick phone. I appreciate that android would be better - and is in fact a computer running linux the size of a phone, but it's not really the same.
- Klasiaster 4y ago
  Can't agree more! For 2FA there are much better options, like TOTPs which are more secure against phishing and account takeover (because they don't allow outside parties to trigger a verification request on your device). Let's see how the Bluetooth-based web auth proposal turns out to be implemented by big tech.
advisedwang 4y ago
Securing SMS sender ID may prevent you trusting a URL from a text, but that's not enough. We can't prevent people from ever clicking on a phony URL, so we need to ensure even if you hit a phishing page that you can't have credentials stolen. SMS and TOTP can't do this, even with if they are secured, because phishing pages can forward the credential. The only solid way to prevent phishing is non-forwardable credentials, ie FIDO/U2F. We need to make this easier and more ubiquitous.
permo-w 4y ago
in the same vein, email providers need to stop unverified email senders setting their own identifiers. if it's not from an email I've interacted with before, show me the email address itself and nothing else. there's really no good reason for the automatic contactification of email addresses. if I want someone's emails to be marked as being from John Smith, I will do that myself. if amazon or x known company is sending me an email, I do not care, identify the sender as the email address it was sent from.
cwoolfe 4y ago
"add number two to your backlog if you work on iOS or Android" I would...but as an iOS and Android developer, how do I know if it's a non-verified sender ID? The reason browsers can warn on these things is because of public key infrastructure, but that doesn't exist SMS phone numbers. Am I missing something?
- daneel_w 4y ago
  No, you're not missing anything. The author of the article just suffers from a naive and simplistic misunderstanding of the SMPP protocol and the mobile grid.
  - ricardbejarano 4y ago
    Hello, author here. What I ask is for iOS and Android to have the "this message was not verified" warning, as shown in the last screenshot, whenever the sender ID is displayed without any form of verification (such as, the aforementioned country-specific sender ID registries). If browsers show "not secure" unless verified by SSL, apps should show "not verified" unless verified _somehow_. The "how" may or may not be possible at this moment, but in any case, warn by default. Is that naive?
    - daneel_w 4y ago
      Yes. The _somehow_ is unfathomably more complex for SMS than it is for certificates. These two ecosystems don't even begin to compare the slightest, whether from technical perspective or from regulatory perspective. Warning by default would be completely pointless until there's a way to also achieve the opposite; a verification and "approval". It would just do more harm, and it would upend a tremendous number of legitimate businesses and use cases.
- bckygldstn 4y ago
  I believe the author means if you work at Apple or Google. So working ON iOS or Android, rather than working ON [top of] iOS or Android.
projektfu 4y ago
Clickable links also enabled people to lose control of their WhatsApp accounts. The message was legit but the request was not. If they had sent a code, the attacker would have to convince people to give it to them. With the link, a lot of users assumed they needed to click to keep using Whatsapp. Not sure what Facebook was thinking but it was a pretty bad move.
smitop 4y ago
Android supports "verified SMS" wherein the sender proves their identity to Google, tells Google the hashes of messages they send, and Google can tell recipients if the message hash is legit or not: https://developers.google.com/business-communications/verified-sms/guides/learn https://developers.google.com/business-communications/verifi...
- MauranKilom 4y ago
  Note that for short messages, hashes are unlikely to effectively conceal the content. English text has about 1 bit of information per character, and auto-sent messages are going to contain even less information. Not that google is likely to have a particular interest in that one-time code you receive via SMS, but it could almost surely brute-force the hash in a fraction of a second if it did.
  - iratewizard 4y ago
    The easier it is to brute force an sms message hash, the less sensitive the information is. Generally.
    - yencabulator 4y ago
      6-digit numerical codes are pretty easy to brute-force, and some of the most sensitive things transported over SMS.
  - batch12 4y ago
    I read this as hashing the content for verification, not hashing for concealment.
  - brettproctor 4y ago
    I figured it was unlikely google would make such a mistake, so I looked at the docs. They use public key cryptography to generate a private shared secret that is hashed alongside the message. This prevents the brute force hash attack. https://developers.google.com/business-communications/verified-sms/guides/learn#life https://developers.google.com/business-communications/verifi...
acd 4y ago
I got a phone number prepaid cash card, got someone else previous mobile phone number. Get snapchat 2fa code which is not mine. Dont trust SMS for 2FA.
megous 4y ago
Call ID is the same. Some trunks come with ability to set any number you like, without any verification. You just provide the number you like in a SIP INVITE message header, and that's it.
- ricardbejarano 4y ago
  Didn't know that, jeez. Imagine what that could look like with voice AI getting better and better.
danschumann 4y ago
This is another reason why using password managers is good. I let it auto fill, so if I got redirected to a bad domain, it wouldn't autofill, and I'd double-check the domain.
- aero-glide2 4y ago
  Was very annoying when protonmail.com became mail.proton.me
  - remram 4y ago
    very annoying?
  - yourad_io 4y ago
    Edit the hostname in the saved login on your browser or password manager Time taken: 20s Annoyance saved: very
kome 4y ago
that's why i never used 2FAs using SMS: they are crap.
turrini 4y ago
Maybe implement a two-way verification, for example: In the app/website: "You will receive an SMS with two 6-digit numbers, one to certify that we sent it to you and another to type bellow. Our chosen number is 887-987, type the another one" In the SMS: "Two-way verification. Check if it's us with number 887-987 and confirm with number 543-621"
- alexcosan 4y ago
  This could work - similar to what happens in some bluetooth pairing flows. But you could still send a text message with a phishing link under the same Sender ID and fool someone into opening it. You'd really need to know that the specific sender would never a) send you a link, or b) send you anything without the "two-way verification" flow you suggested. I don't think any of those options are realistic at a certain scale.
- 37 4y ago
  Maybe I'm missing something, but why would this work? Isn't it just 12 digits going to one phone number instead of 6? (also thinking about this is bringing me back to SYN-ACK from the old days)
  - degenerate 4y ago
    The user chooses the second 6 numbers. For dumb users this won't add any security, but for smart users this ring alarm bells. I like it, at least, for now. It's better than the current situation.
- remuskaos 4y ago
  I think one common way to "bypass" 2FA is to have the carrier send you (the attacker) a second SIM card. If I'm not misremembering, the text message is then delivered to both cards, the original holder and the attacker. So sending two numbers would not defend against this type of 2FA bypass.
  - Melatonic 4y ago
    If that happens though you are screwed no matter what they do. The above does sound like a big improvement though and is sort of like what Google does when you turn on advanced protection and it occasionally will ask you to match the number on your computer screen to the one on your phone
smokey_circles 4y ago
Phone numbers and email: the primary identifiers that were never meant to be used as such. No idea what a good alternative is though. Preferably something federated though
- jkepler 4y ago
  Are you familiar with https://identity.foundation/ https://identity.foundation/ ? Its a group of companies and developers working on decentralizing identity.
0xbeefeed 4y ago
A lot of people in this thread saying SMS is bad for 2FA. It’s not. Just because you can send spoof the sender field doesn’t mean you can spoof being a receiver. Only the valid number will ever receive the 2FA code.
- conductr 4y ago
  But who can read the messages that go to the valid number? How can unwanted people gain that access?
- jkepler 4y ago
  SMS is bad for 2FA not because it can be spoofed, bit because of SIM-swapping attacks that let the attacker trivially take your 2FA codes from you---gaining access to your protected accounts while you're locked out. NIST recommended against using SMS for this reason in summer 2016.
longrod 4y ago
Phones were here way before 2FA and Internet. The technology is poorly designed for modern attack vectors but it's so widespread it's crazy. Every single person out there has a phone number - one of the primary reasons it is still offered as a 2FA option. Not to mention how widespread the coverage is. There are many places around the world where you have cell connectivity but no Internet. In short, you can't get rid of it short of throwing away the SIM. Is it possible to have SMS v2 that's safer like we went from 2G to 5G?
- ajross 4y ago
  > Is it possible to have SMS v2 that's safer like we went from 2G to 5G? No, because https://xkcd.com/927/ https://xkcd.com/927/ The world is filled with strongly authenticated messaging solutions. There's an excellent one available from literally every major tech company. Technology is not the problem here.
z3t4 4y ago
Could build your own protocol ontop of SMS. Double opt-in, encrypted and signed. See for example MMS.
ranger_danger 4y ago
Where does it say how the actual phishing message itself is easy to send? I see no explanation there. How does one send a message with a different SenderID?
- ricardbejarano 4y ago
  Author here. Thanks for reading. I didn't want to explain that in the article because I don't think it adds value. I suggest you read up on the SMS protocol, basically anyone on the network, if able to inject any arbitrary packet into it, can. If you don't even want to buy equipment or even code, take a look at AWS SNS or (i believe) Twilio too.
  - ranger_danger 4y ago
    Neither SNS nor Twilio support arbitrary Sender ID's for US destinations, that's why I was asking... I wasn't aware that anyone actually allowed this anymore. Companies that used to allow sending fake messages without authorization, like Sakari and Beetexting, no longer do. CTIA even made a statement that "no carrier has been able to replicate" this kind of attack, according to a VICE article.
blobbers 4y ago
Super interesting. I've been getting increasingly intense phishing stuff related to citi bank credentials (my account was hacked verify my credentials on shady citi site) as well as AT&T bill being paid (collect my prize for paying my bill). They haven't managed to hijack an actual sender though, and their domain names still look slightly shady because they're things like citi01. They AT&T one is html wrapped so I can't even click the link without seeing what it is (and don't want to because maybe there is some exploit that launches an app that does something? Am I too paranoid?)
- chrismarlow9 4y ago
  Not too paranoid. Don't click anything.
  - punnerud 4y ago
    If you did not initially request it, don’t jump on it
- user_7832 4y ago
  Don't click on the link itself from any device that has personal data, but I wonder if there's any exploits/cybersecurity fellow out here who'd like to check the link to see what it has.
- hhh 4y ago
  Many scammers with AT&T now connect you to real AT&T tech support but just listen in.
sgoto 4y ago
The first SMS from github is origin bound, it cannot be used for phishing: https://wicg.github.io/sms-one-time-codes/ https://wicg.github.io/sms-one-time-codes/
- maxwellg 4y ago
  Origin-bound codes & Web OTP codes [1] are interesting initiatives, but platform adoption has been poor. For example, it still isn't possible to use Web OTP in Chrome on MacOS from a Chrome Web app on iOS. The communication isn't there yet. And for what it's worth - origin bound OTP codes aren't _strongly_ bound - there isn't anything physically stopping someone from typing that short 6 digit code into a phishing site. Compare with a Magic Link token - you're much less likely to take `https://example.com?token=some-long-uuid https://example.com?token=some-long-uuid` and manually enter that code somewhere else. [1]: https://wicg.github.io/web-otp/ https://wicg.github.io/web-otp/
Gunax 4y ago
The more I read about phones and texting, the more I realize that they were never intended to be used as security verification. It just was not one of the design goals. My understanding of caller id is that anyone can put anything there--it was made decades ago to serve as convenience--not to verify. Likewise with the sender id in SMS. It's a good lesson on how protocols are hijacked. Someone thought it was a good idea to send text messages. Another person decided to leverage it for security. Ét voila, we have a security apparatus that isn't very secure.
- pwg 4y ago
  > it [caller id] was made decades ago to serve as convenience It was made decades ago as a profit center when the telephone network was a monopoly company operating an isolated network. Because only the monopoly phone company operated and had access to the isolated telephone network, there was no need for any authentication or verification because all caller ID data came from "themselves" and they were not going to start trying to scam themselves. It (caller id) was a profit center because when it first rolled out it cost somewhere in the range of $20 to $30 per month. The phone company was already tracking which number called which other number for billing purposes, and they found a way to monetize that tracking by allowing the call receiver a tiny sliver of visibility into their billing tracking data, all for a nice sum per month. It rolled out circa 1985 or so and factoring for inflation that $20/month fee at the time was the equivalent today of paying $54.33/month. All for data that was effectively free to the phone company because they were already tracking it for long distance billing purposes and/or for local toll purposes if one was on a "local toll plan" instead of an "unlimited" plan.
grantla 4y ago
SMS really just needs to die, and we'll all be better off.
tuyenhx 4y ago
This has been a problem for Bank in Viet Nam for a year. They faked Bank’s message, and send the link with the same UI of the bank. Many people got hacked. I got a few messages like this. The only thing I could do was informing my friend (none-tech) to avoid these things.
dools 4y ago
Banning sending URLs via SMS is a terrible idea, there are too many valid use cases. Potentially disabling URLs from alphanumeric senders is a good idea, but it’s also very easy to get virtual numbers for sending SMS spam. I think a good balance would be making URLs not clickable for any number that is not in your contacts which also makes it difficult to copy and paste for an average user. The onus is then on providers to make sure anyone they may send links to saves the number as a contact and that they always use the same number, and have that number on their website. So when you register for delivery notifications a message goes out saying you should save the contact number. If all Fedex notifications come from the same number the user only needs to do this once.
- whitexn--g28h 4y ago
  Anyone can send use from fedex’s sender id and your phone will put it right in that saved contacts conversation. Both SMS and phone calls need to be upgraded to use secure identity protocols.
  - dools 4y ago
    They can only do it if they have access to an SMS service that lets them arbitrarily set the sender ID which they can’t do if they’re just connecting via a retail gateway without first authorising the number.
  - gnicholas 4y ago
    Yeah I never realized that a sender could spoof the number in a way that would make my phone insert it into an existing conversation. I had assumed (foolishly, it would seem!) that getting a message in a thread means it is from the same sender as the previous messages. I guess this is one reason Apple has verified iMessages when you talk to them. The background is a different color, I think, to signify their verified status.
    - blowski 4y ago
      Blue means it was sent via iMessage, green means it's an SMS. If my wife sends me an SMS, it will be green. The colour doesn't signify verification.
jimmont 4y ago
The remedy for this lies with Apple and Google to compete over. They’re naturally incentivized in various ways. Mozilla too but Mozilla can’t seem to figure out what to do until it’s passed by, even when the opportunity is still there. Imagine paying it forward to not have calls and text and voicemails related to your expiring warranty, reliable messages, etc. I don’t think even slack can touch this. Otherwise they would have already. Allow me to point out the planet has been networked for over 100 years and this is the best our lawmakers and tech companies can muster. It’s as though everyone has lost sight of doing something practical (for money).
alpb 4y ago
>> Companies should stop sending URLs over SMS. Doesn't make any sense. Companies can stop sending, but that doesn't prevent scammers from sending it. If anything, Apple or Google can run an in-device ML model to understand if a link is scammy/phishy vs genuine. They do it all the time on your browser.
- Nursie 4y ago
  > Doesn't make any sense. Companies can stop sending, but that doesn't prevent scammers from sending it. It makes a lot of sense. Just like "we will never ask for this code over the phone", it becomes a rule "we will never send a URL in an SMS", and people learn not to click any of them.
- treve 4y ago
  My bank repeats in every message that they will never send me a URL in an email. It's taken a bit but they have conditioned me to be suspicious. Similarly, when I get a call I now ask them how I can call back. I don't think this is outlandish if companies are consistent with this.
uvu 4y ago
My Oneplus phone automatically detect the spam and move them to trash. I am sure there is an easy way to identify.
ogn3rd 4y ago
Same issue since caller ID. Force the ANI as the BTN.

orliesaurus 4y ago

Request for proposal: SPF, DMARC, DKIM authenticity authentication but for SMS

bricemo 4y ago

Very sad to see the United States as “No” and “No” listed next to the protections page linked

O__________O 4y ago
Link you’re referring to is: https://support.sms.to/support/solutions/articles/43000562659-international-sender-id-regulations-and-requirements-list-of-countries- https://support.sms.to/support/solutions/articles/4300056265...
njovin 4y ago
My understanding is that US carriers don't support Sender ID at all, so having the caller ID/sender ID spoofed is not common (and maybe not possible?) on major US carriers. Whenever I get phishing SMS they always come from a random 10-digit phone number so it's pretty clear they're scams. Reputable companies send these types of messages with short-codes, which are a 5 or 6-digit numbers that is very expensive and require thorough vetting by the carriers.
- kazz 4y ago
  They're not _that_ expensive (usually $500-$1k/mo) and I wouldn't really characterize the vetting as "thorough". Don't get me wrong, carriers have been making strides to lower the amount of spam that's sent through the air (A2P requirements, toll-free number verification requirements, etc), but a determined scammer can still exploit SMS/MMS pretty easily.
  - njovin 4y ago
    I've provisioned several shortcodes. There's a 12-week approval process (every carrier has to independently review & approve) and if you get flagged/reported for spam they will come after you for it. IMO this makes it prohibitively difficult & time-consuming for a bad actor to use effectively.
    - kazz 4y ago
      I think the processes are getting better each day, but it was only a couple of years ago that you could share a shortcode. My main point is that even with all of the safeguards it's still a ridiculously easy system to exploit. Most people will trust a toll-free number just as much as a shortcode, and since tons of legitimate companies use toll-free numbers for messaging it just blurs the line of what a "reputable" number looks like. Even SendGrid, which is owned by Twilio, uses toll-free numbers for their 2FA messages instead of shortcodes.
    - toast0 4y ago
      It also makes it difficult and time-consuming for a good actor to use effectively. As far as I could tell (although I retired in 2019, so might be out of date), you can't use one short code through multiple aggregators, so if you want the benefits of multiple routes, you've got to have multiple shortcodes or live with sending from regular phone numbers.
- judge2020 4y ago
  Regarding caller ID, stir/shaken is being used in some situations and I know AT&T supports it within their own network (call history will have a checkmark to indicate it was verified).
- saltminer 4y ago
  > Whenever I get phishing SMS they always come from a random 10-digit phone number so it's pretty clear they're scams Sadly, Novant Health (a hospital system) uses a regular 10-digit number for their patient portal 2FA. When I was in college, accessing sensitive info like your SSN and W2s in Banner also had 2FA via a 10-digit number. (This was an entirely separate system from the login 2FA provider, Duo, which uses shortcodes in addition to U2F tokens and their app.)
ASalazarMX 4y ago
Meanwhile countries like Congo, Bangladesh, Cambodia, etc. have Yes | Yes. We need some of that third world SMS protections.
- toast0 4y ago
  I mean, we're protected from SMS from spoofed alphanumeric sender ids. What more do you want? Probably no nation has protection from spoofed numeric sender ids, but based on the sms phishing attempts I get, that's not a big deal. Apparently people will tap on links from their bank from any number anyway.

lxgr 4y ago

I wish we would just stop using phone numbers as the primary user identifier and SMS as the primary communication channel, period. The amount of cruft involved in SMS delivery is unbelievable, and phone numbers are neither particularly stable, nor particularly well protected against takeovers.

byteflip 4y ago
As someone who’s moving overseas shortly, changing/removing your number is a nightmare. It really is the primary UID. So many things use it for 2FA. In a lot of cases you HAVE to list a phone number. I ported my number to Google Voice as a decent alternative, but you kinda have to know what you’re doing ahead of time. My gf who moved first did not and deeply regrets it.
- iLoveOncall 4y ago
  Wait until you move to your new country and discover that you need a local bank account to get a local phone number, but you need a local phone number to open a bank account.
  - GekkePrutser 4y ago
    Yes Ireland has this too. It's frustrating. They don't have a population registry so proof of address is a 'utility bill'. But to sign up for utilities you need a bank account which requires proof of address. Well you get it. Also relying on something from a commercial entity that's so easy to fake is weird.
    - ghaff 4y ago
      It's sometimes the case in the US as well. When I got my RealID driver's license I had to show some sort of utility bill as a proof of address--which, as you say, could be pretty easily faked.
      - kevin_thibedeau 4y ago

deleted 4y ago

[deleted]

baxtr 4y ago

I have two phone numbers. One is for 2-way authentication, the other I give out freely on any website that requires a phone number (and to all my friends). It's basically the same setup I use with emails. Not entirely sure if it's safer that way. But so far I get SMS spam only on the "burner" number.

semitones 4y ago
Funny how friends, life, and everything other than 2-way auth is on the "burner" :)
jimmywetnips 4y ago
It's so fucking annoying. I was wondering if there exists some kind of service that I can install a browser plugin with and all it does is provide me a number to receive bullshit sms codes on, then I can quickly copy and paste quickly without having to used a phone
- franga2000 4y ago
  That just shifts the trust to another company. There used to be a desktop app that did this with Twilio, which is more trustworty, but I don't remember what it was called or if it's still around.
  - deleted 4y ago
    [deleted]
- amenghra 4y ago
  Use Google Voice as your 2nd number.
  - user_7832 4y ago
    I don't think Google voice (or privacy.com which I think also has this service) offer outside the US/in EU :(

silvestrov 4y ago

Another possible solution: Government enacts a law that telecom companies MUST ensure that SenderID is valid for the company that sends the SMS.

feet 4y ago
Yea but that would require that the government actually regulate something g which they haven't done since what, the 70s?
- winrid 4y ago
  Well they just regulated women's bodies today...
  - feet 4y ago
    Oh no you see, that was deregulation! Now the states get the choice to regulate women's bodies Ugh But yea, trigger laws enacted have now regulated women's bodies in something like 15-20 States or something? It's disgusting
onelesd 4y ago
Telecoms lobby against this because they generate big revenues servicing SMS spammers whom end-users aren't able to effectively block since the ID is trivially spoofed.
- remix2000 4y ago
  I wouldn't be surprised if telecoms themselves were the ones coordinating some SMS scam operations. This may sound tinfoilish, but we're talking about the same telecoms that were once caught red-handed tricking people into calling back foreign numbers...
- newsclues 4y ago
  Ding ding ding! It’s profitable on multiple levels to allow this, so corporations ensure the political class doesn’t enact legislation for consumers.

mikece 4y ago

And yet almost every bank requires it for 2FA and only a precious few offer TOTP or some other reasonable and secure form of 2FA.

sha256sum 4y ago
FWIW, I have 4 "banking" accounts, 3 of which are major American banks and one is a local credit union. The latter is the ONLY one to offer 2FA via TOTP while the major banks only allow SMS or email 2FA.
- hinkley 4y ago
  I'm still a little salty about Blizzard handing out free TOTP fobs at conventions and implementing an iOS app to do it, years or even a decade before financial institutions offered anything. It's a fucking game, protecting against gold farmers. How about protecting my non-virtual gold?
  - naniwaduni 4y ago
    I mean, they could do that because, with few hard legal obligations to you, their own internal assessment that implementing TOTP has a good chance of cutting support load and probably won't cause too many problems is Good Enough to move forward with it. Banks have to price in the risk that, if something does go wrong, they could have regulators on their back. And uh, have poor incentive structure wrt being perfectly allowed to do everything by the book and slipping responsibility if the book is just wrong.
Gunax 4y ago
Videogames are oddly the most secure of all. I don't know why (maybe criminals are more likely to go for your WoW account assuming the legal consequences are less) but I would advise all companies to examine how Blizzard, Valve, and others handle account security.
- grogenaut 4y ago

rockbruno 4y ago

It's even worse when you think of how phone companies often recycle dead phone numbers. I remember in Brazil you would often hear of people accidentally stealing someone else's account in apps where login == phone number due do this. It's an awful verification system all over.

herbst 4y ago
My contract does state nowhere that I own or have any right to the number they gave me. Even thought I never saw that happen nothing is stopping them from just giving my number some else. It's so stupid to depend on something like this
kayodelycaon 4y ago
This is why I have a password on my Telegram account.
LocalH 4y ago
I changed phone numbers with Verizon to make use of a phone deal (wouldn’t let me apply it to an existing line) and they had reassigned my number within 60 days of switching it off.

O__________O 4y ago

Stop using SMS for 2FA. Not familiar with SMS Sender ID Verification, but after quick Google, I was unable to find any signs that it counters SMS spoofing. SMS as a 2FA channel is broken. There are so many vulnerabilities that it just makes no sense to use; for example: corrupt telco employees, SS7, sim card cloning, sim swap, spoofing, governments, etc. Beyond that, if you’re located or traveling internationally, it’s a nightmare to deal with. NIST has not recommended SMS based 2FA since 2016: https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...

moffkalast 4y ago
That may be so, but the alternative approach something like Google/KeePass/whatever Authenticator which has the issue of not being bound to your number (unlike SMSs) so if your phone gets destroyed you can't simply get a new phone and sim from the operator and continue as usual, you're completely fucked instead.
- vladvasiliu 4y ago
  Depending on the authenticator used, you are absolutely not fucked. It even works while waiting for your new phone / sim (had this happened to me on a Saturday night in France. Nothing's open Sundays). There's Authy that does backups and you can even run it on a computer (even Linux!). 1Password can store OTPs, too, and is also backed up. There are probably a bunch of others and I'd expect KeePass to be able to do backups. Plus, you're usually able to get the OTP seed which you can store on your own. This usually shows up as "can't scan this code?" or similar when registering. I'm now traveling overseas, and have a local SIM in my phone. I have an older iPhone, so no dual-SIM for me. If I had to receive an SMS I guess it would still be better than my older Galaxy S5 which required a reboot, but it'd still be a pain to have to switch SIMs. If I lost my Phone but still had my laptop, I'd be AOK with my current OTP setup. Except for a few sites which don't allow me to have anything else besides an SMS, but luckily they're not critical.
  - moffkalast 4y ago

theginger 4y ago

As far as I am aware there is no reasonable way for carriers to verify sender IDs or to communicate a verified status with an SMS message. So you would end up labelling all messages as not verified, which might provide some clarity for a short time until it just becomes noise that gets ignored.

ranger_danger 4y ago
Voice calls have the same issue. Most leased lines and VoIP providers let you set your own P-Asserted-Identity header which can be used to spoof caller ID to anything you want.

krylon 4y ago

Huh. I received a text message a couple of weeks ago, informing me the "gift" that I had "bought" had been delivered to the "location agreed upon" by me, and to please visit this really suspicious looking URL for details. The Internet, for better or worse, has taught me a healthy amount of skepticism, plus I definitely had not bought any gifts (how is it a gift if I buy it myself?). But I can see how it is easy to fall for these scams if you aren't used to looking for them.

jandrese 4y ago
Halfway through reading this article I got a SMS from a New York City number saying: Your package delivery details are incorrect and we cannot deliver. https://usppagestrport.com/2vlv Obvious phishing attack, but you know some people are going to fall for it.
- krylon 4y ago
  Many years ago, an IT security person I was talking to referred to humans as "the one security-critical component that cannot be updated". It's a bit cynical, but not entirely incorrect.

jakear 4y ago

Bottom line up front: When sending tokens via SMS, you must include a "do not share this token with anyone besides X.com" text. Otherwise account takeovers become trivial. The article's attack is relatively benign - the user simply goes to a website. Sure they may end up putting info in that website, but probably not. Plus existing systems for malicious website filtering can kick in to prevent this. The more concerning attack is the social engineering one where a third party says something like "let me 'verify' your identity, I'll send you a number tell me what it is" then triggers an identity verification request on the domain (this can be done either manually or part of a sign up flow for some honeypot service). Now the target needs only relay 6 digits to someone they already "trust" and are in a conversation with, versus in the article's example they needed to put their full account info into an unknown website.

gzer0 4y ago
https://www.bejarano.io/sms-phishing/ https://www.bejarano.io/sms-phishing/ HN discussion (8 days ago): https://news.ycombinator.com/item?id=31862994 https://news.ycombinator.com/item?id=31862994 I think a lot of people on this thread are forgetting just how easy it is to spoof SMS. - SMS has a field called sender ID, which is set by the sender, requires no identity verification, and can be any arbitrary short string. - This allows anyone to send messages to any number, identifying themselves as whoever they want to impersonate. - And since there’s no sender phone number in the message, your phone can’t tell real and fake messages apart. - And so it groups them into the same conversation
vegetablepotpie 4y ago
There are valid use cases to ignore the text message security advice. When I set up an account with my bank, I got an SMS security code that I had to read out to my banker to proceed with the account. The SMS did say not to share the code with anyone, I knew he was signing into the banks system, and I deduced that the system bankers use must be the same system normal users use, so this made sense to me. But an unsophisticated user would not know this, and would become to trusting of the helpful stranger asking for the SMS code despite the message text. There are institutions out there that are training your users to ignore your security advice.

kwhitefoot 4y ago

How do the examples in the article cause any problem. You only get sent a code when you request it. And you type it into a website that you are familiar with.

ranger_danger 4y ago
Not everyone is that smart.
elboru 4y ago
What about the FedEx one? I cannot count the number of times I’ve seen companies or even government offices using complicated and scammy-like URL names. It’s difficult to know if URLs are legit or not. HTTPS used to be a good enough indication of legit URLs, but not anymore. You could also think on googling the company. But those ads that look like real search results are well known to include scam websites! I’m a developer and I find it difficult to distinguish some URLs. Now imagine how difficult it can be for grandpa or really any person out there that doesn’t know about these kind of scams.

rr888 4y ago

I really dont want a phone number any more, I dont need one for any friends of family contact. Really the only reason is for 2fa which is ironic as it seems the weakest link.

permo-w 4y ago
I don't even want a (smart)phone anymore. The lack of control you have over your user experience, especially on Apple devices, is horrendous. you can't even really jailbreak apple devices anymore. on your PC you can reprogram anything, navigate around or fully prevent most malicious time-wasting practices (infinite feeds, reels, adverts) that you're near enough at the mercy of on a phone. the way I see it, smartphones are made for idiots Ideally I'd carry round a phone-sized PC running Linux with mobile capabilities, but as it is I settle for my laptop and a brick phone. I appreciate that android would be better - and is in fact a computer running linux the size of a phone, but it's not really the same.
Klasiaster 4y ago
Can't agree more! For 2FA there are much better options, like TOTPs which are more secure against phishing and account takeover (because they don't allow outside parties to trigger a verification request on your device). Let's see how the Bluetooth-based web auth proposal turns out to be implemented by big tech.

advisedwang 4y ago

Securing SMS sender ID may prevent you trusting a URL from a text, but that's not enough. We can't prevent people from ever clicking on a phony URL, so we need to ensure even if you hit a phishing page that you can't have credentials stolen. SMS and TOTP can't do this, even with if they are secured, because phishing pages can forward the credential. The only solid way to prevent phishing is non-forwardable credentials, ie FIDO/U2F. We need to make this easier and more ubiquitous.

permo-w 4y ago

in the same vein, email providers need to stop unverified email senders setting their own identifiers. if it's not from an email I've interacted with before, show me the email address itself and nothing else. there's really no good reason for the automatic contactification of email addresses. if I want someone's emails to be marked as being from John Smith, I will do that myself. if amazon or x known company is sending me an email, I do not care, identify the sender as the email address it was sent from.

cwoolfe 4y ago

"add number two to your backlog if you work on iOS or Android" I would...but as an iOS and Android developer, how do I know if it's a non-verified sender ID? The reason browsers can warn on these things is because of public key infrastructure, but that doesn't exist SMS phone numbers. Am I missing something?

daneel_w 4y ago
No, you're not missing anything. The author of the article just suffers from a naive and simplistic misunderstanding of the SMPP protocol and the mobile grid.
- ricardbejarano 4y ago
  Hello, author here. What I ask is for iOS and Android to have the "this message was not verified" warning, as shown in the last screenshot, whenever the sender ID is displayed without any form of verification (such as, the aforementioned country-specific sender ID registries). If browsers show "not secure" unless verified by SSL, apps should show "not verified" unless verified _somehow_. The "how" may or may not be possible at this moment, but in any case, warn by default. Is that naive?
  - daneel_w 4y ago
    Yes. The _somehow_ is unfathomably more complex for SMS than it is for certificates. These two ecosystems don't even begin to compare the slightest, whether from technical perspective or from regulatory perspective. Warning by default would be completely pointless until there's a way to also achieve the opposite; a verification and "approval". It would just do more harm, and it would upend a tremendous number of legitimate businesses and use cases.
bckygldstn 4y ago
I believe the author means if you work at Apple or Google. So working ON iOS or Android, rather than working ON [top of] iOS or Android.

projektfu 4y ago

Clickable links also enabled people to lose control of their WhatsApp accounts. The message was legit but the request was not. If they had sent a code, the attacker would have to convince people to give it to them. With the link, a lot of users assumed they needed to click to keep using Whatsapp. Not sure what Facebook was thinking but it was a pretty bad move.

smitop 4y ago

Android supports "verified SMS" wherein the sender proves their identity to Google, tells Google the hashes of messages they send, and Google can tell recipients if the message hash is legit or not: https://developers.google.com/business-communications/verified-sms/guides/learn https://developers.google.com/business-communications/verifi...

MauranKilom 4y ago
Note that for short messages, hashes are unlikely to effectively conceal the content. English text has about 1 bit of information per character, and auto-sent messages are going to contain even less information. Not that google is likely to have a particular interest in that one-time code you receive via SMS, but it could almost surely brute-force the hash in a fraction of a second if it did.
- iratewizard 4y ago
  The easier it is to brute force an sms message hash, the less sensitive the information is. Generally.
  - yencabulator 4y ago
    6-digit numerical codes are pretty easy to brute-force, and some of the most sensitive things transported over SMS.
- batch12 4y ago
  I read this as hashing the content for verification, not hashing for concealment.
- brettproctor 4y ago
  I figured it was unlikely google would make such a mistake, so I looked at the docs. They use public key cryptography to generate a private shared secret that is hashed alongside the message. This prevents the brute force hash attack. https://developers.google.com/business-communications/verified-sms/guides/learn#life https://developers.google.com/business-communications/verifi...

acd 4y ago

I got a phone number prepaid cash card, got someone else previous mobile phone number. Get snapchat 2fa code which is not mine. Dont trust SMS for 2FA.

megous 4y ago

Call ID is the same. Some trunks come with ability to set any number you like, without any verification. You just provide the number you like in a SIP INVITE message header, and that's it.

ricardbejarano 4y ago
Didn't know that, jeez. Imagine what that could look like with voice AI getting better and better.

danschumann 4y ago

This is another reason why using password managers is good. I let it auto fill, so if I got redirected to a bad domain, it wouldn't autofill, and I'd double-check the domain.

aero-glide2 4y ago
Was very annoying when protonmail.com became mail.proton.me
- remram 4y ago
  very annoying?
- yourad_io 4y ago
  Edit the hostname in the saved login on your browser or password manager Time taken: 20s Annoyance saved: very

kome 4y ago

that's why i never used 2FAs using SMS: they are crap.

turrini 4y ago

Maybe implement a two-way verification, for example: In the app/website: "You will receive an SMS with two 6-digit numbers, one to certify that we sent it to you and another to type bellow. Our chosen number is 887-987, type the another one" In the SMS: "Two-way verification. Check if it's us with number 887-987 and confirm with number 543-621"

alexcosan 4y ago
This could work - similar to what happens in some bluetooth pairing flows. But you could still send a text message with a phishing link under the same Sender ID and fool someone into opening it. You'd really need to know that the specific sender would never a) send you a link, or b) send you anything without the "two-way verification" flow you suggested. I don't think any of those options are realistic at a certain scale.
37 4y ago
Maybe I'm missing something, but why would this work? Isn't it just 12 digits going to one phone number instead of 6? (also thinking about this is bringing me back to SYN-ACK from the old days)
- degenerate 4y ago
  The user chooses the second 6 numbers. For dumb users this won't add any security, but for smart users this ring alarm bells. I like it, at least, for now. It's better than the current situation.
remuskaos 4y ago
I think one common way to "bypass" 2FA is to have the carrier send you (the attacker) a second SIM card. If I'm not misremembering, the text message is then delivered to both cards, the original holder and the attacker. So sending two numbers would not defend against this type of 2FA bypass.
- Melatonic 4y ago
  If that happens though you are screwed no matter what they do. The above does sound like a big improvement though and is sort of like what Google does when you turn on advanced protection and it occasionally will ask you to match the number on your computer screen to the one on your phone

smokey_circles 4y ago

Phone numbers and email: the primary identifiers that were never meant to be used as such. No idea what a good alternative is though. Preferably something federated though

jkepler 4y ago
Are you familiar with https://identity.foundation/ https://identity.foundation/ ? Its a group of companies and developers working on decentralizing identity.

0xbeefeed 4y ago

A lot of people in this thread saying SMS is bad for 2FA. It’s not. Just because you can send spoof the sender field doesn’t mean you can spoof being a receiver. Only the valid number will ever receive the 2FA code.

conductr 4y ago
But who can read the messages that go to the valid number? How can unwanted people gain that access?
jkepler 4y ago
SMS is bad for 2FA not because it can be spoofed, bit because of SIM-swapping attacks that let the attacker trivially take your 2FA codes from you---gaining access to your protected accounts while you're locked out. NIST recommended against using SMS for this reason in summer 2016.

longrod 4y ago

Phones were here way before 2FA and Internet. The technology is poorly designed for modern attack vectors but it's so widespread it's crazy. Every single person out there has a phone number - one of the primary reasons it is still offered as a 2FA option. Not to mention how widespread the coverage is. There are many places around the world where you have cell connectivity but no Internet. In short, you can't get rid of it short of throwing away the SIM. Is it possible to have SMS v2 that's safer like we went from 2G to 5G?

ajross 4y ago
> Is it possible to have SMS v2 that's safer like we went from 2G to 5G? No, because https://xkcd.com/927/ https://xkcd.com/927/ The world is filled with strongly authenticated messaging solutions. There's an excellent one available from literally every major tech company. Technology is not the problem here.

z3t4 4y ago

Could build your own protocol ontop of SMS. Double opt-in, encrypted and signed. See for example MMS.

ranger_danger 4y ago

Where does it say how the actual phishing message itself is easy to send? I see no explanation there. How does one send a message with a different SenderID?

ricardbejarano 4y ago
Author here. Thanks for reading. I didn't want to explain that in the article because I don't think it adds value. I suggest you read up on the SMS protocol, basically anyone on the network, if able to inject any arbitrary packet into it, can. If you don't even want to buy equipment or even code, take a look at AWS SNS or (i believe) Twilio too.
- ranger_danger 4y ago
  Neither SNS nor Twilio support arbitrary Sender ID's for US destinations, that's why I was asking... I wasn't aware that anyone actually allowed this anymore. Companies that used to allow sending fake messages without authorization, like Sakari and Beetexting, no longer do. CTIA even made a statement that "no carrier has been able to replicate" this kind of attack, according to a VICE article.

blobbers 4y ago

Super interesting. I've been getting increasingly intense phishing stuff related to citi bank credentials (my account was hacked verify my credentials on shady citi site) as well as AT&T bill being paid (collect my prize for paying my bill). They haven't managed to hijack an actual sender though, and their domain names still look slightly shady because they're things like citi01. They AT&T one is html wrapped so I can't even click the link without seeing what it is (and don't want to because maybe there is some exploit that launches an app that does something? Am I too paranoid?)

chrismarlow9 4y ago
Not too paranoid. Don't click anything.
- punnerud 4y ago
  If you did not initially request it, don’t jump on it
user_7832 4y ago
Don't click on the link itself from any device that has personal data, but I wonder if there's any exploits/cybersecurity fellow out here who'd like to check the link to see what it has.
hhh 4y ago
Many scammers with AT&T now connect you to real AT&T tech support but just listen in.

sgoto 4y ago

The first SMS from github is origin bound, it cannot be used for phishing: https://wicg.github.io/sms-one-time-codes/ https://wicg.github.io/sms-one-time-codes/

maxwellg 4y ago
Origin-bound codes & Web OTP codes [1] are interesting initiatives, but platform adoption has been poor. For example, it still isn't possible to use Web OTP in Chrome on MacOS from a Chrome Web app on iOS. The communication isn't there yet. And for what it's worth - origin bound OTP codes aren't _strongly_ bound - there isn't anything physically stopping someone from typing that short 6 digit code into a phishing site. Compare with a Magic Link token - you're much less likely to take `https://example.com?token=some-long-uuid https://example.com?token=some-long-uuid` and manually enter that code somewhere else. [1]: https://wicg.github.io/web-otp/ https://wicg.github.io/web-otp/

Gunax 4y ago

The more I read about phones and texting, the more I realize that they were never intended to be used as security verification. It just was not one of the design goals. My understanding of caller id is that anyone can put anything there--it was made decades ago to serve as convenience--not to verify. Likewise with the sender id in SMS. It's a good lesson on how protocols are hijacked. Someone thought it was a good idea to send text messages. Another person decided to leverage it for security. Ét voila, we have a security apparatus that isn't very secure.

pwg 4y ago
> it [caller id] was made decades ago to serve as convenience It was made decades ago as a profit center when the telephone network was a monopoly company operating an isolated network. Because only the monopoly phone company operated and had access to the isolated telephone network, there was no need for any authentication or verification because all caller ID data came from "themselves" and they were not going to start trying to scam themselves. It (caller id) was a profit center because when it first rolled out it cost somewhere in the range of $20 to $30 per month. The phone company was already tracking which number called which other number for billing purposes, and they found a way to monetize that tracking by allowing the call receiver a tiny sliver of visibility into their billing tracking data, all for a nice sum per month. It rolled out circa 1985 or so and factoring for inflation that $20/month fee at the time was the equivalent today of paying $54.33/month. All for data that was effectively free to the phone company because they were already tracking it for long distance billing purposes and/or for local toll purposes if one was on a "local toll plan" instead of an "unlimited" plan.

grantla 4y ago

SMS really just needs to die, and we'll all be better off.

tuyenhx 4y ago

This has been a problem for Bank in Viet Nam for a year. They faked Bank’s message, and send the link with the same UI of the bank. Many people got hacked. I got a few messages like this. The only thing I could do was informing my friend (none-tech) to avoid these things.

dools 4y ago

Banning sending URLs via SMS is a terrible idea, there are too many valid use cases. Potentially disabling URLs from alphanumeric senders is a good idea, but it’s also very easy to get virtual numbers for sending SMS spam. I think a good balance would be making URLs not clickable for any number that is not in your contacts which also makes it difficult to copy and paste for an average user. The onus is then on providers to make sure anyone they may send links to saves the number as a contact and that they always use the same number, and have that number on their website. So when you register for delivery notifications a message goes out saying you should save the contact number. If all Fedex notifications come from the same number the user only needs to do this once.

whitexn--g28h 4y ago
Anyone can send use from fedex’s sender id and your phone will put it right in that saved contacts conversation. Both SMS and phone calls need to be upgraded to use secure identity protocols.
- dools 4y ago
  They can only do it if they have access to an SMS service that lets them arbitrarily set the sender ID which they can’t do if they’re just connecting via a retail gateway without first authorising the number.
- gnicholas 4y ago
  Yeah I never realized that a sender could spoof the number in a way that would make my phone insert it into an existing conversation. I had assumed (foolishly, it would seem!) that getting a message in a thread means it is from the same sender as the previous messages. I guess this is one reason Apple has verified iMessages when you talk to them. The background is a different color, I think, to signify their verified status.
  - blowski 4y ago
    Blue means it was sent via iMessage, green means it's an SMS. If my wife sends me an SMS, it will be green. The colour doesn't signify verification.

jimmont 4y ago

The remedy for this lies with Apple and Google to compete over. They’re naturally incentivized in various ways. Mozilla too but Mozilla can’t seem to figure out what to do until it’s passed by, even when the opportunity is still there. Imagine paying it forward to not have calls and text and voicemails related to your expiring warranty, reliable messages, etc. I don’t think even slack can touch this. Otherwise they would have already. Allow me to point out the planet has been networked for over 100 years and this is the best our lawmakers and tech companies can muster. It’s as though everyone has lost sight of doing something practical (for money).

alpb 4y ago

>> Companies should stop sending URLs over SMS. Doesn't make any sense. Companies can stop sending, but that doesn't prevent scammers from sending it. If anything, Apple or Google can run an in-device ML model to understand if a link is scammy/phishy vs genuine. They do it all the time on your browser.

Nursie 4y ago
> Doesn't make any sense. Companies can stop sending, but that doesn't prevent scammers from sending it. It makes a lot of sense. Just like "we will never ask for this code over the phone", it becomes a rule "we will never send a URL in an SMS", and people learn not to click any of them.
treve 4y ago
My bank repeats in every message that they will never send me a URL in an email. It's taken a bit but they have conditioned me to be suspicious. Similarly, when I get a call I now ask them how I can call back. I don't think this is outlandish if companies are consistent with this.

uvu 4y ago

My Oneplus phone automatically detect the spam and move them to trash. I am sure there is an easy way to identify.

ogn3rd 4y ago

Same issue since caller ID. Force the ANI as the BTN.