4 ms·

SIM swappers hijacking phone numbers in eSIM attacks

29 points by leotravis10 3y ago

LorenDB 3y ago
I've said it before, and I'll say it again: federal law should at least mandate that SMS 2FA cannot be a required option. With services like Paypal allowing you to reset your entire account authentication just by receiving an SMS message, I expect disastrous results. Alternately, we could just ban SMS 2FA outright. It may be an unpopular opinion, but I'm sticking to my guns on this one. https://lorendb.dev/posts/lets-ban-sms-2fa/ https://lorendb.dev/posts/lets-ban-sms-2fa/
- hn_throwaway_99 3y ago
  I read your blog post. The primary issue is that it doesn't fairly acknowledge problems with SMS 2FA alternatives: 1. First off, SMS 2FA is certainly better that _no_ 2FA. The primary breach vector is credential stuffing, and SMS 2FA is much better than just using a password in that scenario. Importantly, I'm referring to cases where 2FA is the second factor - cases where you can reset everything with just a passcode (usually forgot password scenarios) isn't really 2FA. 2. Thus, the primary alternatives are TOTP and Passkeys. If your service needs to support a wide variety of technically savvy (or not) users, and ages, I would say these are not really viable, at least not yet. I've seen many, many people struggle with setting up TOTP and using passkeys/hardware keys. My opinion is that SMS 2FA is much better than nothing, as long as it's an actual second factor.
  - LorenDB 3y ago
    Thanks for the feedback! I agree that I don't do a perfect job of fairly representing the issue; I may rewrite that post to more clearly communicate that SMS is better than nothing at all.
    - hughesjj 3y ago
      Please do. You just know someone not "in the know" will get shown this and come to the wrong decision without that disclaimer. I'm not religious per say but I do believe in Murphy. Heck, update with this use case as an example and (re?)post the blog to HN/etc
  - bluesign 3y ago
    I think problem with 'SMS 2FA is much better than nothing, as long as it's an actual second factor.' statement is: even though it is totally correct, at least passes some responsibility to 3rd party. ( phone operators etc ) So it becomes easy choice for companies, this leads to non-savvy to stay non-savvy.
  - basch 3y ago
    The problem is, how can i trust 2fa will STAY the second factor? If one signs up for a service, enables 2fa, and down the road the product design changes to sms to login or sms to reset password, it should disable 2fa until you agree to the new system. sms backdoor should be a completely separate setting than 2fa, but companies dont treat it that way. the sms/magiclink to login has won. the answer to stuffing is to mandate services cross reference their account lists against open leaked lists. thats best practice, and not enough sites are banning known passwords. sms backdoor is WORSE than "nothing" when nothing equals a unique non reused key.
- gregmac 3y ago
  > A bit more on the account recovery: given a valid email address, PayPal will happily send you a text to verify a password reset, and Amazon lets you reset your password with just a phone number. This means that as long as you know that somebody has an Amazon account that may be linked to their phone number, a simple SIM swapping attack or even snooping on local text messages can easily give you full access to somebody’s Amazon account. The trouble is not SMS being used for 2FA, but rather that using it as the password reset mechanism effectively means it's now the single authentication factor. This is really bad because SMS (due to SIM swapping) is significantly worse than regular passwords. When SMS is actually a second factor it's still actually an improvement over no 2FA for most users, because now in addition to just stealing your password the attacker has to SIM swap you or find some other means to get the 2FA code. Your proposed fixes (TOTP, Passkeys) are arguably no better if they are also used as single factor password resets. I think the problem is really for password recovery you need N+1 authentication mechanisms -- in other words for 2FA login, you need a 3rd password recovery mechanism so you can still do a 2FA password recovery in case one of the first two factors is unusable. Few sites do this right.
Terr_ 3y ago
To lift out the key part: > [A]ttackers breach a user's mobile account with stolen, brute-forced, or leaked credentials and initiate porting the victim's number to another device on their own. I think this underscores the horrible over-use of inferior 2FA that uses SMS (or for that matter, e-mail accounts) as the second piece. At least let me opt-into a decently secure system like a time-code app on my phone, dangit. (P.S.: As some commenters have noted, this crucially means disabling the insecure option.)
- sublinear 3y ago
  I have Google Authenticator as my 2FA for my mobile carrier. That's security theater if the fallback is still SMS or if a customer support call does not require a link to log in. I have not had a good enough reason to test this and risk the huge inconvenience if it all goes wrong.
- nottorp 3y ago
  Every time my hardware token thingy needs replacing, my bank tries to push me into using sms instead. I politely ask if they would like me to close my accounts and they somehow produce a new token. However, who thought esims were a good idea again?
  - gambiting 3y ago
    Esims are a great idea, the problem wouldn't exist if there was a mandatory delay in migrating. Like 3 days from request to the card being generated, with daily reminders that this is about to happen.
    - Terr_ 3y ago
      How about this: Before enabling a replacement eSIM for a new phone, an SMS or two are sent to the old phone to notify and authorize the movement. 1. If the old phone SMSes back a confirmation, things proceed immediately. This makes upgrades, trade-ins, and certain replacements (where the old phone is somewhat functional) nice and fast. 2. If the old phone SMSes back a denial, disable everything temporarily and get customer-service into the loop. This is justified because it suggests either the online phone-account has been hacked or else the old phone has been stolen. 3. If there is no response from the old phone... well, I'm not sure, but at least the first two routes have siphoned off some important fraction of cases.
deleted 3y ago
[deleted]
ChrisArchitect 3y ago
Related: Former telecom manager admits to doing SIM swaps for $1k https://news.ycombinator.com/item?id=39717097 https://news.ycombinator.com/item?id=39717097

29 points by leotravis10 3y ago

I've said it before, and I'll say it again: federal law should at least mandate that SMS 2FA cannot be a required option. With services like Paypal allowing you to reset your entire account authentication just by receiving an SMS message, I expect disastrous results. Alternately, we could just ban SMS 2FA outright. It may be an unpopular opinion, but I'm sticking to my guns on this one. https://lorendb.dev/posts/lets-ban-sms-2fa/ https://lorendb.dev/posts/lets-ban-sms-2fa/

hn_throwaway_99 3y ago
I read your blog post. The primary issue is that it doesn't fairly acknowledge problems with SMS 2FA alternatives: 1. First off, SMS 2FA is certainly better that _no_ 2FA. The primary breach vector is credential stuffing, and SMS 2FA is much better than just using a password in that scenario. Importantly, I'm referring to cases where 2FA is the second factor - cases where you can reset everything with just a passcode (usually forgot password scenarios) isn't really 2FA. 2. Thus, the primary alternatives are TOTP and Passkeys. If your service needs to support a wide variety of technically savvy (or not) users, and ages, I would say these are not really viable, at least not yet. I've seen many, many people struggle with setting up TOTP and using passkeys/hardware keys. My opinion is that SMS 2FA is much better than nothing, as long as it's an actual second factor.
- LorenDB 3y ago
  Thanks for the feedback! I agree that I don't do a perfect job of fairly representing the issue; I may rewrite that post to more clearly communicate that SMS is better than nothing at all.
  - hughesjj 3y ago
    Please do. You just know someone not "in the know" will get shown this and come to the wrong decision without that disclaimer. I'm not religious per say but I do believe in Murphy. Heck, update with this use case as an example and (re?)post the blog to HN/etc
- bluesign 3y ago
  I think problem with 'SMS 2FA is much better than nothing, as long as it's an actual second factor.' statement is: even though it is totally correct, at least passes some responsibility to 3rd party. ( phone operators etc ) So it becomes easy choice for companies, this leads to non-savvy to stay non-savvy.
- basch 3y ago
  The problem is, how can i trust 2fa will STAY the second factor? If one signs up for a service, enables 2fa, and down the road the product design changes to sms to login or sms to reset password, it should disable 2fa until you agree to the new system. sms backdoor should be a completely separate setting than 2fa, but companies dont treat it that way. the sms/magiclink to login has won. the answer to stuffing is to mandate services cross reference their account lists against open leaked lists. thats best practice, and not enough sites are banning known passwords. sms backdoor is WORSE than "nothing" when nothing equals a unique non reused key.
gregmac 3y ago
> A bit more on the account recovery: given a valid email address, PayPal will happily send you a text to verify a password reset, and Amazon lets you reset your password with just a phone number. This means that as long as you know that somebody has an Amazon account that may be linked to their phone number, a simple SIM swapping attack or even snooping on local text messages can easily give you full access to somebody’s Amazon account. The trouble is not SMS being used for 2FA, but rather that using it as the password reset mechanism effectively means it's now the single authentication factor. This is really bad because SMS (due to SIM swapping) is significantly worse than regular passwords. When SMS is actually a second factor it's still actually an improvement over no 2FA for most users, because now in addition to just stealing your password the attacker has to SIM swap you or find some other means to get the 2FA code. Your proposed fixes (TOTP, Passkeys) are arguably no better if they are also used as single factor password resets. I think the problem is really for password recovery you need N+1 authentication mechanisms -- in other words for 2FA login, you need a 3rd password recovery mechanism so you can still do a 2FA password recovery in case one of the first two factors is unusable. Few sites do this right.

Terr_ 3y ago

To lift out the key part: > [A]ttackers breach a user's mobile account with stolen, brute-forced, or leaked credentials and initiate porting the victim's number to another device on their own. I think this underscores the horrible over-use of inferior 2FA that uses SMS (or for that matter, e-mail accounts) as the second piece. At least let me opt-into a decently secure system like a time-code app on my phone, dangit. (P.S.: As some commenters have noted, this crucially means disabling the insecure option.)

sublinear 3y ago
I have Google Authenticator as my 2FA for my mobile carrier. That's security theater if the fallback is still SMS or if a customer support call does not require a link to log in. I have not had a good enough reason to test this and risk the huge inconvenience if it all goes wrong.
nottorp 3y ago
Every time my hardware token thingy needs replacing, my bank tries to push me into using sms instead. I politely ask if they would like me to close my accounts and they somehow produce a new token. However, who thought esims were a good idea again?
- gambiting 3y ago
  Esims are a great idea, the problem wouldn't exist if there was a mandatory delay in migrating. Like 3 days from request to the card being generated, with daily reminders that this is about to happen.
  - Terr_ 3y ago
    How about this: Before enabling a replacement eSIM for a new phone, an SMS or two are sent to the old phone to notify and authorize the movement. 1. If the old phone SMSes back a confirmation, things proceed immediately. This makes upgrades, trade-ins, and certain replacements (where the old phone is somewhat functional) nice and fast. 2. If the old phone SMSes back a denial, disable everything temporarily and get customer-service into the loop. This is justified because it suggests either the online phone-account has been hacked or else the old phone has been stolen. 3. If there is no response from the old phone... well, I'm not sure, but at least the first two routes have siphoned off some important fraction of cases.

deleted 3y ago

[deleted]

ChrisArchitect 3y ago

Related: Former telecom manager admits to doing SIM swaps for $1k https://news.ycombinator.com/item?id=39717097 https://news.ycombinator.com/item?id=39717097