5 ms·

Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.

computerfriend 3y ago
SMS is better than nothing, but I personally know several people who had their accounts compromised because their SMS 2FA codes were intercepted. It's not possible to do this with TOTP.
- mooreds 3y ago
  How were they intercepted? Was it a sim takeover, where the attacker took over the phone number? Or intercepting the code over the air, since SMS has no encryption?
  - computerfriend 3y ago
    The latter.
    - YetAnotherNick 3y ago
      How can I someone see other's messages? Surely someone has step by step guide if it is that easy. Are you sure it was interception without SIM takeover?
      - TheNewsIsHere 3y ago
        It's not that you can do this just from any old device by flipping a built-in switch, but it's not that different from observing plaintext traffic over an Ethernet network with the right software. There are various ways to nab an SMS. Some are similar to SIM swap attacks in that they rely on social engineering or human or process fallibility to execute [1] [2], and others can grab messages right right out of the air, so to speak [3] [4]. This is in part because one of the foundational protocols that underlie modern cellular networks was never designed with modern security in mind. It's called SS7, and it's been extensively documented as a concern to the security of cellular based communications [5] [6] [7] [8]. Lot's of references because this is an area that has long fascinated me, and I have many bookmarks. There are also some recent papers on this behind paywalls (e.g., [9]). In between the lines and lightly touched on in some reporting is a nuanced point that I think plays a larger part - one issue is that overhauling these older foundational technologies isn't just a matter of commercial and standards changes but also moving the goal posts on where lawful interception happens in the stack, how it happens, and the technologies that support that. For example in the U.S., law enforcement agencies can acquire devices that impersonate cellular infrastructure in order to force communications to go through law enforcement controlled equipment (called IMSI catchers). If we were to revamp cellular networks with a view toward security in the way we probably should, it's reasonable that devices like that wouldn't be feasible without being operated by the telephone companies that own the networks, and that would probably become some amount of red tape that law enforcement doesn't like. [1] https://arstechnica.com/information-technology/2021/03/16-attack-let-hacker-intercept-a-t-mobile-users-text-messages/ https://arstechnica.com/information-technology/2021/03/16-at... [2] https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s... [3] https://www.firstpoint-mg.com/blog/ss7-attack-guide/ https://www.firstpoint-mg.com/blog/ss7-attack-guide/ [4] https://www.youtube.com/watch?v=RXBvO8TWGsw https://www.youtube.com/watch?v=RXBvO8TWGsw [5] https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-mobile-phone-vulnerability-snooping-texts-calls https://www.theguardian.com/technology/2016/apr/19/ss7-hack-... [6] https://arstechnica.com/information-technology/2018/05/nefarious-actors-may-have-abused-routing-protocol-to-spy-on-us-phone-users/ https://arstechnica.com/information-technology/2018/05/nefar... [7] https://arstechnica.com/features/2019/04/fully-compromised-comms-how-industry-influence-at-the-fcc-risks-our-digital-security/ https://arstechnica.com/features/2019/04/fully-compromised-c... [8] https://www.zdnet.com/article/5g-networks-could-be-vulnerable-to-exploit-due-to-mishmash-of-old-technologies/ https://www.zdnet.com/article/5g-networks-could-be-vulnerabl... [9] https://link.springer.com/article/10.1007/s11235-023-01018-0 https://link.springer.com/article/10.1007/s11235-023-01018-0 edit: formatting
        YetAnotherNick 3y ago
        Again, I want the tool through which I can see other people's messages, or at least a video of some hacker doing that. e.g. I can observe plaintext message over ethernet by using some splitter and wireshark.
- achandlerwhite 3y ago
  So they had weak passwords? Or were their accounts recovered/reset via SMS which is prevalent but not 2nd factor login.
vmfunction 3y ago
there are tons of articles here in HN that have shown that SIM swamp (at least in US) is much easier then trying to brute force (or using quantum computer) to break TOTP encryption. One of main reason for SMS is also meta data collection of your number.
- YetAnotherNick 3y ago
  Give some examples then. I can't find any article.
rad_gruchalski 3y ago
You haven’t looked for any proof: search for sim cloning.
- YetAnotherNick 3y ago
  In the first link: > In SIM cloning attack, the fraudster gains access to the victims physical SIM card and.. Same thing could be done with TOTP.
  - rad_gruchalski 3y ago
    It’s not the same. The explanation you quote is wrong. This is the correct one: > SIM cloning is the procedure through which a genuine SIM card is reproduced. When the cloning is accomplished, the cloned SIM card’s classifying information is transported onto a separate, secondary SIM card. The secondary card can then be used in a different phone while consuming all the calls and related charges credited to the original SIM card. https://fraud.net/d/sim-cloning/ https://fraud.net/d/sim-cloning/ There is no need to have physical access.
vbezhenar 3y ago
You can use social engineering (or corrupted workers) to issue SIM card for other people and receive SMS. This method is widely used to steal money from bank accounts in my country. Telegram accounts also known to be stolen this way. Of course you should be located in the same country. But it's a risk nonetheless.
Hamuko 3y ago
https://www.theverge.com/2019/8/31/20841448/jack-dorsey-twitter-hacked-account-sim-swapping https://www.theverge.com/2019/8/31/20841448/jack-dorsey-twit... https://www.axios.com/2024/01/22/sec-hack-twitter-x-sim-swap https://www.axios.com/2024/01/22/sec-hack-twitter-x-sim-swap
Terretta 3y ago
> no one has shown any concrete proof that SMS could be hacked more easily On the contrary, here is an empirical study demonstrating 100% of the 5 major carriers in US used insecure authentication challenges that can easily be subverted by attackers: https://www.issms2fasecure.com https://www.issms2fasecure.com

SMS is better than nothing, but I personally know several people who had their accounts compromised because their SMS 2FA codes were intercepted. It's not possible to do this with TOTP.

mooreds 3y ago
How were they intercepted? Was it a sim takeover, where the attacker took over the phone number? Or intercepting the code over the air, since SMS has no encryption?
- computerfriend 3y ago
  The latter.
  - YetAnotherNick 3y ago
    How can I someone see other's messages? Surely someone has step by step guide if it is that easy. Are you sure it was interception without SIM takeover?
    - TheNewsIsHere 3y ago
      It's not that you can do this just from any old device by flipping a built-in switch, but it's not that different from observing plaintext traffic over an Ethernet network with the right software. There are various ways to nab an SMS. Some are similar to SIM swap attacks in that they rely on social engineering or human or process fallibility to execute [1] [2], and others can grab messages right right out of the air, so to speak [3] [4]. This is in part because one of the foundational protocols that underlie modern cellular networks was never designed with modern security in mind. It's called SS7, and it's been extensively documented as a concern to the security of cellular based communications [5] [6] [7] [8]. Lot's of references because this is an area that has long fascinated me, and I have many bookmarks. There are also some recent papers on this behind paywalls (e.g., [9]). In between the lines and lightly touched on in some reporting is a nuanced point that I think plays a larger part - one issue is that overhauling these older foundational technologies isn't just a matter of commercial and standards changes but also moving the goal posts on where lawful interception happens in the stack, how it happens, and the technologies that support that. For example in the U.S., law enforcement agencies can acquire devices that impersonate cellular infrastructure in order to force communications to go through law enforcement controlled equipment (called IMSI catchers). If we were to revamp cellular networks with a view toward security in the way we probably should, it's reasonable that devices like that wouldn't be feasible without being operated by the telephone companies that own the networks, and that would probably become some amount of red tape that law enforcement doesn't like. [1] https://arstechnica.com/information-technology/2021/03/16-attack-let-hacker-intercept-a-t-mobile-users-text-messages/ https://arstechnica.com/information-technology/2021/03/16-at... [2] https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s... [3] https://www.firstpoint-mg.com/blog/ss7-attack-guide/ https://www.firstpoint-mg.com/blog/ss7-attack-guide/ [4] https://www.youtube.com/watch?v=RXBvO8TWGsw https://www.youtube.com/watch?v=RXBvO8TWGsw [5] https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-mobile-phone-vulnerability-snooping-texts-calls https://www.theguardian.com/technology/2016/apr/19/ss7-hack-... [6] https://arstechnica.com/information-technology/2018/05/nefarious-actors-may-have-abused-routing-protocol-to-spy-on-us-phone-users/ https://arstechnica.com/information-technology/2018/05/nefar... [7] https://arstechnica.com/features/2019/04/fully-compromised-comms-how-industry-influence-at-the-fcc-risks-our-digital-security/ https://arstechnica.com/features/2019/04/fully-compromised-c... [8] https://www.zdnet.com/article/5g-networks-could-be-vulnerable-to-exploit-due-to-mishmash-of-old-technologies/ https://www.zdnet.com/article/5g-networks-could-be-vulnerabl... [9] https://link.springer.com/article/10.1007/s11235-023-01018-0 https://link.springer.com/article/10.1007/s11235-023-01018-0 edit: formatting
      - YetAnotherNick 3y ago
        Again, I want the tool through which I can see other people's messages, or at least a video of some hacker doing that. e.g. I can observe plaintext message over ethernet by using some splitter and wireshark.
achandlerwhite 3y ago
So they had weak passwords? Or were their accounts recovered/reset via SMS which is prevalent but not 2nd factor login.

vmfunction 3y ago

there are tons of articles here in HN that have shown that SIM swamp (at least in US) is much easier then trying to brute force (or using quantum computer) to break TOTP encryption. One of main reason for SMS is also meta data collection of your number.

YetAnotherNick 3y ago
Give some examples then. I can't find any article.

rad_gruchalski 3y ago

You haven’t looked for any proof: search for sim cloning.

YetAnotherNick 3y ago
In the first link: > In SIM cloning attack, the fraudster gains access to the victims physical SIM card and.. Same thing could be done with TOTP.
- rad_gruchalski 3y ago
  It’s not the same. The explanation you quote is wrong. This is the correct one: > SIM cloning is the procedure through which a genuine SIM card is reproduced. When the cloning is accomplished, the cloned SIM card’s classifying information is transported onto a separate, secondary SIM card. The secondary card can then be used in a different phone while consuming all the calls and related charges credited to the original SIM card. https://fraud.net/d/sim-cloning/ https://fraud.net/d/sim-cloning/ There is no need to have physical access.

vbezhenar 3y ago

You can use social engineering (or corrupted workers) to issue SIM card for other people and receive SMS. This method is widely used to steal money from bank accounts in my country. Telegram accounts also known to be stolen this way. Of course you should be located in the same country. But it's a risk nonetheless.

Hamuko 3y ago

https://www.theverge.com/2019/8/31/20841448/jack-dorsey-twitter-hacked-account-sim-swapping https://www.theverge.com/2019/8/31/20841448/jack-dorsey-twit... https://www.axios.com/2024/01/22/sec-hack-twitter-x-sim-swap https://www.axios.com/2024/01/22/sec-hack-twitter-x-sim-swap

Terretta 3y ago

> no one has shown any concrete proof that SMS could be hacked more easily On the contrary, here is an empirical study demonstrating 100% of the 5 major carriers in US used insecure authentication challenges that can easily be subverted by attackers: https://www.issms2fasecure.com https://www.issms2fasecure.com