Slashdot Mirror
Scammers Work Around Two-Factor Authentication With Social Engineering
mask.of.sanity writes "Thieves have made off with $45k after they intercepted a victim's two factor online banking codes used to verify large transactions. The scammers got the Australian executive's mobile number from his daughter, and work place details from his willing secretary. Armed with this data, they bluffed Vodafone which ported his phone number, meaning the criminals could verify the bank's two factor verification codes generated during their spending spree and the victim never knew a thing."
Including that his phone didn't work any more?
Was he traveling out of country or what? That must have been one fast shopping spree.
Sig Battery depleted. Reverting to safe mode.
This just goes to show that you should always have additional protections in place for protecting accounts (in this case, a mobile number) that can be used to control, secure, or otherwise materially modify other important accounts.
They didn't steal anything real.
I don't believe in imaginary property.
"George Craig .. was told that his .. mobile phone .. was used as a tool in the attack .. the criminals sent an SMS to Craig purporting to be from Vodafone. The message said that Vodafone was experiencing network difficulties and that he would likely experience problems with reception for the next 24 hours" link
Magically hacking everything is so much more interesting.
I guess this is why, we have SMS auth, your banking login/pw and a per-contract physical card with a grid coordinate numeric system.
The physical card could be duped assuming one would know the algorithm to generate such information and what coord the website is taking for that particular transaction, but that seems too be too much hassle as we have not had any such case reported thus far.
So the banks say it's not their problem, it's the fault of mobile operators for making numbers portable. Yet the banks were offered access to the national mobile database so they could check if a number was recently ported, but declined to use the information. Meanwhile the fraudsters are getting away with their winnings...
Two factor means 2 pieces of id (what you have, what you know). How'd they get his password (what you know)? Or did the bank decide that one new-technology-Out-Of-Their-Control-factor (what you have) is enough? Cell phone second factor is all cool (and cheap), but it's out of your control. Something like a secure token is much more controllable but unfortunately, more costly.
While some are better than others, no form of security is absolutely 100% perfect in every way. In case you hadn't noticed. News at 11.
This is nothing but social engineering and lax security resulting in very minimal loss for the bank. It would cost more banks to address the issue than simply pay off damages.
You'd never hear about real cases, where perps create reverse lookup tables, clone cards and clean banks for millions, because that would really make you, the consumer, doubt security of financial institutions.
To operate with that bank on-line, you need an Internet acc number (which is different to a normal account number), and at least a password. Additional secret question knowledge is required for 2 answers to set up a new transfer. Then, and only then is the SMS verification code needed. He must of been very slack to have made all that info available to the scammers.
Congrats to the bank to have picked it up. It's not the $45000 'raising a red flag' either. Once they rang me for confirmation because I sent a donation to a German software foundation - it was only $20.
Don't be apathetic. Procrastinate!
This wasn't a failure of "two-factor authentication" this was a failure of the bank to have actually require two factors. It seems that the bank was relying on one of the two factors to be a "something you have" factor, which was the client's mobile phone, when in reality it was just another "something you know" factor. The "something you know" being just the phone number itself.
This fraud should not have occurred if the victim had been more vigilant about his online security. The crooks would, in addition to obtaining an sms token, have to also obtain a valid userid and password. Clearly, if they were able to get both of these details using social engineering or a keylogging trojan then the victim must be a careless and clueless idiot. He admits tio using an insecure machine for his online banking and is surprised at the outcome ? This is another good reason why a trusted and secure OS like Linux makes more sense for online banking.
CitiBusiness Online
I'm in the process of moving everything here as they have the best security I've seen of any bank. Their customers laugh at this article.
NetCode is a form of two-factor authentication that issues Commonwealth Bank’s online banking users with SMS messages before allowing them to transfer large amounts of money to unfamiliar accounts. When a new, large or unorthodox transaction is attempted online, the bank sends a verification code to the account holder’s mobile number. The code is then typed back into the online banking section as an additional authentication measure.
Doesn't Steam use Netcode when you use a different browser than it's expecting? What about Google?
Everyone is focusing on just the (in)security of the second factor, the telephone number, but what's missing from this story is that the scammers obviously also got their hands on much more information from this person first: they knew his bank login details (account name, password), and they knew his daughter's identity and managed to contact her.
The solution for SMS as my bank implements it, is that SMS is never sent to a forwarded number. That's arranged between the bank and the carriers or so, I don't know the technical details, but SMS is sent only to the original number. That's already a safeguard against arranging numbers to be forwarded, which other commenters note is quite easy to accomplish.
Anyway it is the classic story of when something goes wrong, it's usually not a single issue that went wrong. It's almost always an array of factors that have to come together "just right" to make it work. While it may be a good idea to review the security of the SMS as second factor, one should also look at how the criminals got their hands on the first factor and the rest of the information.
This is funny, it's like the old phrack magazine from the 80s where you have kids pretending to be the telco working on the line asking for the root password to complete a job. Nostalgia ain't what it used to be ...
The purpose of existence is to make money.
The 20-20 hindsight is strong in this one.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Number portability should be for moving between providers while retaining the same number (to save having to give the new number to all contacts).
When I have moved a number to a new (PAYG) handset (keeping the same provider), the process required me to quote the IMEI of both handsets as well as answering security questions. For a contract phone (which one would assume is what a business owner would have), surely the only time the number should need moving a new handset is when the handset is changed as part of the contract - in which case it should not be possible to move the number simply by making a phone call.
they intercepted a victim's two factor online banking codes
Surely the victim here was the bank. They are the ones who gave away money to people who weren't entitled to it. They were the ones who allowed a weak form of authentication to be accepted. They are the ones who will bear the eventual loss.
The person who's account was used did nothing wrong. He didn't disclose any confidential information and (from what I've read) complied with the terms of his account.
We need to get away from defining the victims of these crimes as being the person who's name is on the account that was used - the account that the bank wrongly withdrew money from and gave away to the scammers. Unless we start identifying the true victims as being the financial institutions who we entrust with our money, yet have weak and inappropriate security measures the time will come when they shift the expectation and liability, so that the customer will bear the loss for something that is neither their fault not within their control.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
You got to be kidding me! A openly available information as the first "factor"?? This is what you get for acting like information can be owned. Idiots!
I have proper two-factor authentication here. With a encrypted chip card, a special pinpad reader that is tamper-proof, and FinTS which allows that reader to connect with the bank directly, without even my own PC being able to tamper with it. It shows me the actual transaction the PC requested from the bank. Only when I stick in the card, enter the code, and press "OK", will my bank ever do anything transaction-wise!
If somebody wants my PIN, I just have to destroy the card, and he can have all he wants. It won't help him one bit.
If somebody steals my card, that won’t help him too. Also I will go to my bank and invalidate the card. So now even the PIN won't help him.
And the PIN is a *biiit* longer that the usual 4 numbers, so guessing it like with EC cards is not an option. It will take at least a multiple of the time it takes me to invalidate the thing. ^^
Why is it even legal to do it otherwise? And why the hell do you use a bank that doesn't do this?
(If there is no such bank in the US, that would be quite the market gap. Just advertise that you're the *only* bank with *actual* security, and put a page online showing why. [That way they can't sue you for saying you're not the only one.]
But honestly, don't you have the Deutsche Bank over there? That's a German bank (obviously). And here in Germany, they offer the exact setup I described above. They don't openly advertise it, but they offer it. So maybe they do in the US too.)
Everyone is focusing on just the (in)security of the second factor, the telephone number, but what's missing from this story is that the scammers obviously also got their hands on much more information from this person first: they knew his bank login details (account name, password), and they knew his daughter's identity and managed to contact her.
Commonwealth Bank for first time external transfers not only requires the traditional two factor authentication but also requires you to answer two secret questions. These are normally stock questions like the name of your pet, your mothers maiden name, etc.
To pull this off they likely knew quite a damn lot about him.
The downside to the bank in question is that all you need to raise your daily transfer limit is the SMS code, no additional questions.
Something you know, something you have, something you are - pick any two.
I thought it was something you forgot long ago, something you just had stolen, something you were before they beat the shit out of you and started cutting body parts off.
These posts express my own personal views, not those of my employer
I assume that's something you picked up from the movies. Any bank which stored a significant percentage of cash in a bank vault would be out of business pretty quick.
And the money in "your" bank account is the bank's money, not yours. You loaned it to them therefore it's their responsibility. If they happen to try to pass that responsibility back to you... Well, you'd have to be pretty dumb to sign that contract.
Your relationship with your bank is that of a creditor. The money is no longer yours, and the bank can pretty much do what it pleases with the money.
The responsibility for security lies with the bank.
HTH.
Deleted
People are quite outraged since this turns out to be default, even for not customers of the bank in question, but this is how a Dutch bank solved this: If you change provider, SIM card or phone number, you can't use your phone for tokens for at least 48 hours. All telco companies send *all* their changes to that bank, so they can compare it against their records of customers phone numbers. It's a gross invasion of privacy, but it does work against this form of weakness in this form of 2 factor authentication.
I was promised a flying car. Where is my flying car?
I'm sorry, reading the synopsis I just got the the phrase "willing secretary" and then my mind started to wander... What are we talking about again?
for 45k dollars? I would have gone for at least 10x more if you are going to that kind of trouble and breaking all those laws.
45k harvest from outside the country (nigeria, romania, etc) is a payday.. but not in-country, and subject to local jail
"Vodaphone employees tricked. Humans still weakest link in security chain. Film at 11."
Sounds like the bank goofed up their SMS authentication.
My bank does similar SMS authentication, but with additional
twist. The SMS message from my bank does not have an
authentication code, but an authentication code index. After
verifiyng that tranfer destination SEPA account number and
EURO amount are correct, I look up real authentication code
from bank printed authetication code card, and type that
code to my bank's web interface. The bank printed card is
credit card size when folded, and includes 300 one-time-use
index + authentication code pairs. I get a new card from my
bank office when those 300 index + code pairs are about to
run out.
Even if criminal hijacks a phone number, a SMS message
saying "type authentication code for index 277" does not
help him at all if he does not have my authetication code
card. Criminal would need all these: my web bank access ID,
password, SMS message (phone), and authetication code card.
Don't use easily-attainable information such as your phone number and place of work as security details. It's one reason why I hate it when websites force you to select from a pre-selected list of "security questions", such as "Where were you born?" or "What was your father's name?". That is not secure information.
To date, I've only come across one website that allows you to set both the question and the answer. And that was a government website. *shrugs*
When you port a mobile number (at least in the US), there is a period during which you can't receive SMS messages from SMS aggregators (the bulk messaging APIs banks and other companies use to send automated messages). After I ported my number from AT&T to Verizon, my BofA SMS messages stopped working. I called the bank and they instantly knew that it was because I had recently ported, so it must be a common problem. It took about two weeks for them to start working again.
So either this is different in Australia, or there's a big hole in this story.