4 ms·

Great implementation of the wrong solution. The problem isn't that SIM security is weak but it's that we're using SIM/eSIM for identification and authorization

by mikece 4y ago

Great implementation of the wrong solution. The problem isn't that SIM security is weak but it's that we're using SIM/eSIM for identification and authorization in the first place. When we stop using SIM for authentication the need to guard against SIM Swap attacks goes away as well.

jgrahamc 4y ago
That's one line in the announcement and is not the core of what we announced. This eSIM provide a data connection that goes directly to Cloudflare.
- deleted 4y ago
  [deleted]
- ayewo 4y ago
  How does this data connection work in practice? Sounds like you have to become an MVNO, no?
  - Nextgrid 4y ago
    They will essentially be an MVNO, yes. It doesn't address security much though - the carrier's infrastructure still needs to be trusted and there is no end-to-end encryption between the mobile device and Cloudflare (you'd still need an on-device VPN for that - this is a limitation of the mobile protocols; the network is considered trusted and is given access to the traffic). The eSIMs that Cloudflare uses also need to be properly segregated away so that the carrier's customer support people can't reissue those SIMs, which they can technically do as they are still considered the issuer and their system is in control of the issuing process.
- vinay_ys 4y ago
  This blog post doesn't read like rest of Cloudflare posts. It is very beating around the bush and doesn't get to the point at all. Please consider updating the blog for clarity and brevity.
- Nextgrid 4y ago
  But the data connection is not end-to-end encrypted to CF. The SIM authenticates you to the mobile network which is free to tamper with your traffic. Considering the "security" of the equipment in there, as well as the incentives of the people working there and the general level of skill and development practices in there, I wouldn't trust it at all. The only way this would be secure is if the SIM/eSIM is able to embed an actual client certificate which the mobile device can then use to initiate a VPN connection to Cloudflare, but this would also require the eSIM to not be able to be tampered with by the issuing carrier, otherwise they could potentially push an update to extract the keys or have it sign malicious requests in the background.
  - gz5 4y ago
    This ^. Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access to your data plane keys. So no MNO access and E2E encrypted session from the process space of the app client to the process space of the app server (or peer). Examples of this alternative here: https://github.com/openziti-test-kitchen/go-http https://github.com/openziti-test-kitchen/go-http
yevpats 4y ago
This. SIM is not secure and will never be. just use yubikeys and/or other compatible webauthen and you will finish this non-ending cat and mouse race of phishing/anti phishing solutions.
- georgyo 4y ago
  A physical SIM card is a smartcard, and in many ways is exactly like a yubikey. A yubikey even presents as a USB smartcard. The attacks on SIM cards are not on the SIM itself, but by the carrier binding your identity to a different card. A function they must perform at least sometimes! If you lost your yubikey, I'm sure you want your replacement to be able to activate your cell phone.
- xaduha 4y ago
  > SIM is not secure and will never be. That's just nonsense. You need to explain what you mean by that, because otherwise you sound like someone who doesn't know what they are talking about. If you mean SIM swap attack, then that's basically 'social engineering' with a help of identity theft targeting providers and has nothing to do with SIM cards themselves.
staticassertion 4y ago
I think two things can be true: 1. Phones are an important attack vector to consider 2. We should be using strong 2FA ala FIDO2 Given that phones can act as FIDO2, I think that only strengthens (1). Even if a phone isn't used for 2FA, it still is likely to have access to company resources - Slack, Email, non 2fa text messages, etc.
Maxburn 4y ago
I never understood the thinking behind banning VoIP. I understand the ease that attackers can make and use new numbers but if I'm using a VoIP number to receive 2FA SMS wouldn't it be more secure to have that tied to a VoIP number that can't be SIM swapped and potentially is secured with 2FA itself?
- nightpool 4y ago
  It's because most companies that use SMS "2FA" don't use it for your security, they use it for their security—phone numbers are a costly resource, and every phone number an attacker spends to launch a spam attack is a phone number they'll never be able to use again. VoIP numbers flip that logic on its head by making it much cheaper to provision and allocate phone numbers. This also slightly protects user accounts because it makes it harder for attackers to "overwrite" a hijacked user account with their own bogus phone number during takeover, but that's a secondary goal—the main goal is spam reduction
  - Maxburn 4y ago
    I get it, but it's still sad. Lots of places reject my Google Voice number, just because it's VoIP. I've had that number for ten years and the account it is under is protected by a popular security key. But that Prepaid SIM I have for a month and might ditch any time, no problem, everyone takes that.
    - ForHackernews 4y ago
      You can port other numbers to Google voice, which helps I think.
      - sitzkrieg 4y ago
        not really, they will be identified as voip then
        Maxburn 4y ago
lkbm 4y ago
I would love to use a proper authenticator app or security key for everything important, but the reality we live in is that many financial institutions still only support phone-based 2FA. If CloudFlare ould force them all to add support for proper 2FA, that would be fantastic, but I don't think that's an option. If they can make SIMs more secure in the meantime, that's a win, and a very important one. Improve the things you have control over rather than just bemoaning the things you don't.
- filoleg 4y ago
  > the reality we live in is that many financial institutions still only support phone-based 2FA I believe that's exactly the point the grandparent comment was addressing when they said "we stop using SIM for authentication". The "we" wasn't necessarily referring users, but to services and providers currently using SIM 2FA in their products.
  - lkbm 4y ago
    Sure, but Cloudflare can't make that happen, so instead Cloudflare is doing what they can.
    - filoleg 4y ago
      I totally agree with you. I am not blaming Cloudflare here, they are trying to create workarounds and patch holes around the lack of proper 2FA from those services and providers. But the real goal is imo those services and providers implementing proper 2FA.
- Abishek_Muthian 4y ago
  > but the reality we live in is that many financial institutions still only support phone-based 2FA. True and even highly sensitive Govt. services authentication for citizens in some large countries depends upon SMS based 2FA, Although the CF article is focused on corporate infrastructure security and I doubt if any of the 'Fortune 1000' companies mentioned actually still use SMS 2FA; CF is trying to block the phishing URL from being resolved and SIM-swap. Meanwhile as a concerned individual, Since SMS 2FA is not dying soon I would wish at least some mechanism is brought forth to prevent the underpaid, overworked personnel at the carrier from being able to access that 2FA SMS and aiding in SIM-swapping.
dathinab 4y ago
This is not mainly about SIM security as far as I understood. It's more about employees visiting phishing sites on their phone. Or their phone getting hacked exposing mail correspondence, or 2FA getting hacked etc. In the way it's presented it's still the wrong solution IMHO. If security matters and the work requires a phone do not allow BYOD. Provide a phone. For such a phone this might be an okay solution, not for a private phone. If a phone isn't strictly required remove phones completely and strictly out of the loop. This is beneficial both for security in more ways then this sim service provides and for the mental health of your employee. Make it clear that even if they are called because of an work emergency they are contractual bound not to process it on the phone but instead switch to a employer provided device no mater who calls and which situation it is. PS: Also fire any manager or even the CTO who tries to pressure employees into not keeping the rule, make it an automatic firing through a contract clause.
kelnos 4y ago
The "when" there is the tricky bit. When are we going to stop using SIMs for authentication? That relies on a whole lot of unrelated parties individually deciding to do something better. Absent government regulation (which will take a decade to implement anyway)... good luck with that.

by mikece 4y ago

jgrahamc 4y ago

That's one line in the announcement and is not the core of what we announced. This eSIM provide a data connection that goes directly to Cloudflare.

deleted 4y ago
[deleted]
ayewo 4y ago
How does this data connection work in practice? Sounds like you have to become an MVNO, no?
- Nextgrid 4y ago
  They will essentially be an MVNO, yes. It doesn't address security much though - the carrier's infrastructure still needs to be trusted and there is no end-to-end encryption between the mobile device and Cloudflare (you'd still need an on-device VPN for that - this is a limitation of the mobile protocols; the network is considered trusted and is given access to the traffic). The eSIMs that Cloudflare uses also need to be properly segregated away so that the carrier's customer support people can't reissue those SIMs, which they can technically do as they are still considered the issuer and their system is in control of the issuing process.
vinay_ys 4y ago
This blog post doesn't read like rest of Cloudflare posts. It is very beating around the bush and doesn't get to the point at all. Please consider updating the blog for clarity and brevity.
Nextgrid 4y ago
But the data connection is not end-to-end encrypted to CF. The SIM authenticates you to the mobile network which is free to tamper with your traffic. Considering the "security" of the equipment in there, as well as the incentives of the people working there and the general level of skill and development practices in there, I wouldn't trust it at all. The only way this would be secure is if the SIM/eSIM is able to embed an actual client certificate which the mobile device can then use to initiate a VPN connection to Cloudflare, but this would also require the eSIM to not be able to be tampered with by the issuing carrier, otherwise they could potentially push an update to extract the keys or have it sign malicious requests in the background.
- gz5 4y ago
  This ^. Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access to your data plane keys. So no MNO access and E2E encrypted session from the process space of the app client to the process space of the app server (or peer). Examples of this alternative here: https://github.com/openziti-test-kitchen/go-http https://github.com/openziti-test-kitchen/go-http

yevpats 4y ago

This. SIM is not secure and will never be. just use yubikeys and/or other compatible webauthen and you will finish this non-ending cat and mouse race of phishing/anti phishing solutions.

georgyo 4y ago
A physical SIM card is a smartcard, and in many ways is exactly like a yubikey. A yubikey even presents as a USB smartcard. The attacks on SIM cards are not on the SIM itself, but by the carrier binding your identity to a different card. A function they must perform at least sometimes! If you lost your yubikey, I'm sure you want your replacement to be able to activate your cell phone.
xaduha 4y ago
> SIM is not secure and will never be. That's just nonsense. You need to explain what you mean by that, because otherwise you sound like someone who doesn't know what they are talking about. If you mean SIM swap attack, then that's basically 'social engineering' with a help of identity theft targeting providers and has nothing to do with SIM cards themselves.

staticassertion 4y ago

I think two things can be true: 1. Phones are an important attack vector to consider 2. We should be using strong 2FA ala FIDO2 Given that phones can act as FIDO2, I think that only strengthens (1). Even if a phone isn't used for 2FA, it still is likely to have access to company resources - Slack, Email, non 2fa text messages, etc.

Maxburn 4y ago

I never understood the thinking behind banning VoIP. I understand the ease that attackers can make and use new numbers but if I'm using a VoIP number to receive 2FA SMS wouldn't it be more secure to have that tied to a VoIP number that can't be SIM swapped and potentially is secured with 2FA itself?

nightpool 4y ago
It's because most companies that use SMS "2FA" don't use it for your security, they use it for their security—phone numbers are a costly resource, and every phone number an attacker spends to launch a spam attack is a phone number they'll never be able to use again. VoIP numbers flip that logic on its head by making it much cheaper to provision and allocate phone numbers. This also slightly protects user accounts because it makes it harder for attackers to "overwrite" a hijacked user account with their own bogus phone number during takeover, but that's a secondary goal—the main goal is spam reduction
- Maxburn 4y ago
  I get it, but it's still sad. Lots of places reject my Google Voice number, just because it's VoIP. I've had that number for ten years and the account it is under is protected by a popular security key. But that Prepaid SIM I have for a month and might ditch any time, no problem, everyone takes that.
  - ForHackernews 4y ago
    You can port other numbers to Google voice, which helps I think.
    - sitzkrieg 4y ago
      not really, they will be identified as voip then
      - Maxburn 4y ago

lkbm 4y ago

I would love to use a proper authenticator app or security key for everything important, but the reality we live in is that many financial institutions still only support phone-based 2FA. If CloudFlare ould force them all to add support for proper 2FA, that would be fantastic, but I don't think that's an option. If they can make SIMs more secure in the meantime, that's a win, and a very important one. Improve the things you have control over rather than just bemoaning the things you don't.

filoleg 4y ago
> the reality we live in is that many financial institutions still only support phone-based 2FA I believe that's exactly the point the grandparent comment was addressing when they said "we stop using SIM for authentication". The "we" wasn't necessarily referring users, but to services and providers currently using SIM 2FA in their products.
- lkbm 4y ago
  Sure, but Cloudflare can't make that happen, so instead Cloudflare is doing what they can.
  - filoleg 4y ago
    I totally agree with you. I am not blaming Cloudflare here, they are trying to create workarounds and patch holes around the lack of proper 2FA from those services and providers. But the real goal is imo those services and providers implementing proper 2FA.
Abishek_Muthian 4y ago
> but the reality we live in is that many financial institutions still only support phone-based 2FA. True and even highly sensitive Govt. services authentication for citizens in some large countries depends upon SMS based 2FA, Although the CF article is focused on corporate infrastructure security and I doubt if any of the 'Fortune 1000' companies mentioned actually still use SMS 2FA; CF is trying to block the phishing URL from being resolved and SIM-swap. Meanwhile as a concerned individual, Since SMS 2FA is not dying soon I would wish at least some mechanism is brought forth to prevent the underpaid, overworked personnel at the carrier from being able to access that 2FA SMS and aiding in SIM-swapping.

dathinab 4y ago

This is not mainly about SIM security as far as I understood. It's more about employees visiting phishing sites on their phone. Or their phone getting hacked exposing mail correspondence, or 2FA getting hacked etc. In the way it's presented it's still the wrong solution IMHO. If security matters and the work requires a phone do not allow BYOD. Provide a phone. For such a phone this might be an okay solution, not for a private phone. If a phone isn't strictly required remove phones completely and strictly out of the loop. This is beneficial both for security in more ways then this sim service provides and for the mental health of your employee. Make it clear that even if they are called because of an work emergency they are contractual bound not to process it on the phone but instead switch to a employer provided device no mater who calls and which situation it is. PS: Also fire any manager or even the CTO who tries to pressure employees into not keeping the rule, make it an automatic firing through a contract clause.

kelnos 4y ago

The "when" there is the tricky bit. When are we going to stop using SIMs for authentication? That relies on a whole lot of unrelated parties individually deciding to do something better. Absent government regulation (which will take a decade to implement anyway)... good luck with that.