Slashdot Mirror
Known Flaws in Mobile Data Backbone Allow Hackers To Trick 2FA (vice.com)
A known security hole in the networking protocol used by cellphone providers around the world played a key role in a recent string of attacks that drained bank customer accounts, according to a report published Wednesday. From the article: For years, researchers, hackers, and even some politicians have warned about stark vulnerabilities in a mobile data network called SS7. These flaws allow attackers to listen to calls, intercept text messages, and pinpoint a device's location armed with just the target's phone number. Taking advantage of these issues has typically been reserved for governments or surveillance contractors. But on Wednesday, German newspaper The Suddeutsche Zeitung reported that financially-motivated hackers had used those flaws to help drain bank accounts. This is much bigger than a series of bank accounts though: it cements the fact that the SS7 network poses a threat to all of us, the general public. And it shows that companies and services across the world urgently need to move away from SMS-based authentication to protect customer accounts.
It's a problem with SMS as one of the factors.
That allows the attacker to direct a target's text messages to another device, and, in the case of the bank accounts, steal any codes needed to login or greenlight money transfers (after the hackers obtained victim passwords).
... "Everyone's accounts protected by text-based two-factor authentication, such as bank accounts, are potentially at risk until the FCC and telecom industry fix the devastating SS7 security flaw," Lieu said in a statement published Wednesday...
In the meantime, and maybe irrespective of whether SS7 problems are ever fixed, social media companies, banks, and other online services need to stop using SMS-based two-factor authentication. Last year the National Institute of Standards and Technology said it was no longer recommending solutions that used SMS.
Just saying lol. If they get rid of this feature they'll have to add a new door in for all of our jerkwad governments.
So someone would need to obtain:
1. My login to my bank account
2. My password to my bank account
3. My phone number (this is the easy one).
4. And work with a relatively sophisticated attack to spoof my device and obtain the 2FA token?
How did these people get cleaned out? Were they the same kind of people who wrote their pin numbers on the back of their credit cards?
Just wait until Google says this is the excuse to move the entire legacy SMS system to RCS without delay. Though that still would require changing the transport too, because RCS can use SS7.
Your phone is not a valid 2 factor endpoint. It is easy to MITM. There are many examples. Do not use email or phone as authenticated endpoints. They are not.
In order to take advantage of this "flaw" they have to connect to what is for all intents and purposes an isolated network... You have get one of the Carriers or SS7 access providers to give you that access. It's not done casually.
The "hack" is the equivalent of calling what Wells Fargo did (opening credit card accounts for people who hadn't signed up for them) a hack. The 2fa "hack" seems to have been carried out by someone with trusted access to the ss7 network.
This is already known, see DRAFT NIST Special Publication 800-63B Digital Identity Guidelines
https://pages.nist.gov/800-63-...
> Note: Out-of-band authentication using the PSTN (SMS or voice) is discouraged and is being considered for removal in future editions of this guideline.
-- I was raised on the command line, bitch
SS7 is going to KILL US ALL!
Have a nice day.
#DeleteChrome
WTF....
The bank's security design assumes the phone network does what they ask.
But these hackers seem to have no trouble getting it to do what they ask instead.
Which says the bank does not actually have 2 factor authentication.
do you even know what many-tentacled horror SS7 is?
What do you mean by "need to move away from" it, you one hundred percent managed piece of garbage? Why would those with access to it not use it to further their own interests? Are you going to stop them?
This is the same old bullshit that has been going on for months.
SS7 is a signalling protocol not a carrier (voice) run accoss a private network between telecoms.
Every proof of concept has been done with a providers access to their network. It cannot be accessed from outside a telcom and you cannot get to the data path from the internet.
And that it had anything to do with any banking attacks is bullshit, bullshit, and more bullshit.
SMS has never been confidential. Is not encripted in any leg of the trip. Can be decoded from the airwaves with suitable hardware (I've seen said hardware operate first hand, 2 FPGAs, 4 DSPs, and two rugged laptops were needed in 2001, I guess nowadays a macbook with AMD laptop graphics and a SDR will be enough ;-) ), can be altered via SS7 (as described in TFA), and even read easily by the operators of the telecom equipmentt, with no wizard level 100++ knowledge , or special tools:
An Example:
In the SMSCs of Aldiscon/Logica/LogicaCMG/Acision (callled Telepath), one can configure how many of the characters of the SMS to reatin in the CDRs. Minimum/Default 6, max 160 characters. from there, just use grep in the CDR files to get the text of all the SMSs of any user. When I found out from the head of VAS planning, I said that was unacceptable (I was the head of operations of VAS). but, given the cavalier approach to privacy there, I decided to let sleeping dogs lie...
(the CDR also contains info like the CellID where the message was sent, but that is another story)
I am certain that other SMSCs have similar "provisions".
By the way, calling SS7/CS7 "Mobile Data BackBone", is a misnomer at best, and embarrasing dumbness at worse. Is just out of band signaling for telecom equipment coordination. Superseeded by SIGTAN/SCTP/SS7OverIP...
*** Suerte a todos y Feliz dia!
TOTP is simple, easy to implement, and effective. There are plenty of FOSS implementations.
Saying SS7 is vulnerable is like saying BGP is vulnerable. It's a fools errand to believe it is even possible to build a global, inclusive non-tyrannical network that is also globally trusted. The best you can hope for is a mostly functional network.
On mobile it's effectively all plaintext all the time like it's 1993. Very disappointed POTS networks are still intact. We obviously don't have our shit together.
Good security requires every tel-co in the world to update their transport protocols at the same time, or at least, install protocol upgrade/downgrade translators as packets enter/exit their secured line. This collective laziness creates a "too big to jail" behemoth that citizens can't touch.
its MOBILE PHONE
http://www.differencebetween.com/difference-between-cell-phone-and-vs-mobile/
"It is true that the network is cellular but the phone is not, so the word cell phone is really a misnomer."
typical americans have no idea....
now to listen to them mispronounce Aluminium and Solder, and talk about a "World Series" whereby only they complete and no one in the actual world actually cares.
Nobody cares about 2FA.
Three most stupid part is that I will never give eBay my phone number, so I'll simply stop using 2FA, and if my account gets hacked it will be eBay that pays the price.
All anyone can do if they get into my account is buy stuff (refunded by credit card company, PayPal/seller eats the cost) or sell stuff (PayPal eats the cost).
Their desire to get my phone number puts them at risk.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Do not use email or phone as authenticated endpoints.
Well technically, with using correct End-To-End encryption, you could use any channel as 2FA.
E-mail could be usable if correctly encrypted with a trusted openPGP key pair (or if you have a trusted S/MIME authority).
But people won't bother fumbling arround with PGP nor even getting Mailveloppe to use with their webmail.
SMS could also be used with a correctly authetified OTR layer.
But there are about 2 software in the whole universe using OTR-over-SMS (TextSecure. And there should be another one somewhere).
So no serious enterprise is ever going to consider it.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Because the Bell System never thought they'd have to let EVERYONE use SS7., the child of CCISS. They thought hey, we're connected to other Bell/AT&T resources so we don't have to include any security.