Slashdot Mirror
Why You Shouldn't Use Texts For Two-Factor Authentication (theverge.com)
An anonymous reader quotes a report from The Verge: A demonstration video posted by Positive Technologies (and first reported by Forbes) shows how easy it is to hack into a bitcoin wallet by intercepting text messages in transit. The group targeted a Coinbase account protected by two-factor authentication, which was registered to a Gmail account also protected by two-factor. By exploiting known flaws in the cell network, the group was able to intercept all text messages sent to the number for a set period of time. That was enough to reset the password to the Gmail account and then take control of the Coinbase wallet. All the group needed was the name, surname and phone number of the targeted Bitcoin user. These were security researchers rather than criminals, so they didn't actually steal anyone's bitcoin, although that would have been an easy step to take. At a glance, this looks like a Coinbase vulnerability, but the real weakness is in the cellular system itself. Positive Technologies was able to hijack the text messages using its own research tool, which exploits weaknesses in the cellular network to intercept text messages in transit. Known as the SS7 network, that network is shared by every telecom to manage calls and texts between phone numbers. There are a number of known SS7 vulnerabilities, and while access to the SS7 network is theoretically restricted to telecom companies, hijacking services are frequently available on criminal marketplaces. The report notes of several ways you can protect yourself from this sort of attack: "On some services, you can revoke the option for SMS two-factor and account recovery entirely, which you should do as soon as you've got a more secure app-based method established. Google, for instance, will let you manage two-factor and account recovery here and here; just set up Authenticator or a recovery code, then go to the SMS option for each and click 'Remove Phone.'"
End to end encryption easily solves this and other problems related to government spying.
First of all, these are not cellular network "vulnerabilities." These are "features." And these "tools" are not Proof-of-Concepts for finding weaknesses in the networks. They are "products" that are sold to government for the purpose of spying on YOU and ME.
My bank uses text messages to verify transactions. Would that be vulnerable in some way as well?
Please login to access my lawn
Only LUDDITES use text messages for two-factor authentication. Modern app appers app authentication apps for authentication through apps.
Apps!
blah hacking blah hacked blah yadda blah hackers blah blah hack blah blah yadda blah.
Thank you theverge. That was most useful.
I'm not sure giving that info to Google is any better than having it stolen by hackers. When it comes to peoples public/private info, google is SAVAGE.
"Dont be evil" how fucking ironic..
For a moment I was worried that I'll have to use binary or hex for two-factor authentication rather then plain "texts".
Why do we keep seeing this being reported incorrectly by security "professionals"? Using SMS has always been two STEP, not two factor. You need to use the correct words describing a system if you are going to rag on that system.
This is just a rehashed article from over a year ago. Same exact examples are referenced. That SS7 site on tor has been reported a few times now as being fraudulent. The bitcoin wallet on there had like 2 transactions into it. This is a serious threat for sure but they are grossly overestimating the effects of this in the wild. It's not exactly 'easy to attack SS7' for the non telecom enthusiast. If it was, people would be selling the service and telecom would've moved on by now.
Same is true for fancy RSA 2FA tokens. Intercept texts, reset google/email passwords, revoke and reissue 2FA token in any form factor you want.
Conflating broke ass secondary communications channels with 2FA, Film at 11.
Refudiate?
If you're paranoid or actually at risk of being hacked, buy a burner phone and use that for your 2 step authentication.
Nobody can social engineer or cell tower hack your number because they don't know it.
You need smarter monkeys for that, apparently.
So... still better than password-only. That's probably good enough for my purposes.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
It is just an excuse to harvest your phonenumber.
I'm tired of securing my shit all the time. It changes everyday.
There is always a way in. For Apples face ID that states there is a 1 in a million chance of breaking it. That means they are probably over 6,000 people in the world that could get into your phone with their face alone. And being that close relatives and people with similar generics often live closer by, so some of these 6,000 people may be rather close.
Humans actually make worse assumptions when granting access to security. They can often be conned into thinking you are someone who you are not rather quickly. Being most effective hacks are social hacks where someone actively gives the bad guy access to their computers.
Using text as part of the two factor authentication isn't as bad as most. Being that most security problems don't come from someone hacking into your account, but getting in the backdoor and getting your info that way. So the two factor with the text is probably good enough for rather secure methods to protect your account for sites that they wouldn't bother targeting just you. Just because if they stole a password table they wouldn't spend the time trying to hack the text response if they have a million more passwords to try.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I have never used SMS or anything whatsoever that relies on my cellphone. Cellphones are not permanent. It would be like relying on a specific IP address. Doesn't matter if you have it right now, there is little to no guarantee you will have access to it in the future. Much less guarantee than the old land-lines.
I've permanently lost cellphone access simply from dropping my phone in the ocean and having no way to recover the account (it was pre-paid and this was before they would swap your account with a new sim; hell maybe you still can't if you're pre-paid). If I had accounts tied to that number (SMS or otherwise) then they would be DONE. Especially if they used actual 2FA, I would be 100% screwed. Fuck that!
People using SMS for security are hoping that it is difficult to impossible to potentially tie together the data, but of course it's not foolproof. Texts and be easily intercepted and put together if data from the other side can be acquired. It was made for convenience. Simple as that. which is why we have other apps and methods of encrypting sms or equivalent (Whatsapp for example although in theory there are ways to attack that too but is harder, can't remember details). Even GMS seems a bit weak to me and in India, there is apparently no encryption at all. Cell phone technology was designed with a focus on security, but convenience and easy of use. in other words, easy to consume. The price of convenience in my experience has always been security.
"Imagination is more important than knowledge" - Einstein
"If transmissions were being monitored during battle, no uncoded messages were to be transmitted on an open channel."
And yet even though they were aware enough to draft a regulation, their mobile communicators didn't come with a secure messaging system either.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
I happen to have a YubiKey from YubiCo but there are probably other vendors. The cheap version is just USB-A. The expensive version has NFC so you can use it with most modern smartphones to authenticate. It works with Google, which is probably what you care most about. Facebook also supports it, although it's not as important. I haven't used it in months; it only matters if you're on a "new" device and leaves you alone otherwise. Incidentally, Facebook will also encrypt your password-recovery requests with your public PGP key. I know at least one person who turned that feature on. (me).
Just don't give out your phone number. Google has no reason to know my phone number. I don't have to disable 'two factor authentication by text message' if they don't have my phone number.
great, you found a problem thats been around since 2008, but has anyone come up with a solution other than removing 2FA?
do people not realize that security is supposed to be done in layers? Just by adding 2FA you have increased the cost of an attack, therefore making sure that the potential hackers will need to make sure that the reward will be worth more than the cost of the attack. By removing 2FA you have made the cost of the attack cheaper.
What happened to news for nerds, this sounds like news for normal people, aka fear mongering about technology. "remove 2FA so that its easier for hackers to get into your account" fuck off
It is just an excuse to harvest your phonenumber.
For what purpose?
To sell it to Rachel from Cardholder Services, I expect.
Personally, I think you're nuts. I've been around the security business for the last 20 years, working for and consulting with many organizations that have set up 2FA for their users... and I have never, once, heard anyone suggest that it is useful for phone number harvesting.
Moreover, knowing peoples' phone numbers really isn't all that useful.
All information about a consumer is useful information, if you have enough of it. You may not know yet when it will be useful, or what it will be useful for, but if you're a big info corporation harvesting info, you want to harvest all the info you can: it will be useful someday, and once people understand how giving that info to you was a bad bad idea, they will stop giving it to you-- so you want to get it now, before they realize it.
http://www.geoffreylandis.com
We all lost during the primaries, regardless of who you voted for.... Maybe before that.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
It is just an excuse to harvest your phonenumber.
For what purpose?
To sell it to Rachel from Cardholder Services, I expect.
What organizations have 2FA that might do this? I'm not saying there aren't any, but I can't think of any.
Personally, I think you're nuts. I've been around the security business for the last 20 years, working for and consulting with many organizations that have set up 2FA for their users... and I have never, once, heard anyone suggest that it is useful for phone number harvesting. Moreover, knowing peoples' phone numbers really isn't all that useful.
All information about a consumer is useful information, if you have enough of it. You may not know yet when it will be useful, or what it will be useful for, but if you're a big info corporation harvesting info, you want to harvest all the info you can: it will be useful someday, and once people understand how giving that info to you was a bad bad idea, they will stop giving it to you-- so you want to get it now, before they realize it.
All information about a consumer is also a liability. Lots of organizations haven't figured this out yet, but I think pretty much all of them savvy enough to be implementing 2FA understand it.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
For some applications one wants multiple ways to verify identity. Any one of those ways can be hacked, so does that mean multi-"channel"-verification should be done away with altogether, leaving one stuck with weak single-channel verification? What are the alternatives? Humans knocking on doors and taking finger-prints? Even ignoring the cost of personal visits, finger-prints can be hacked also with with rubber facades and bribery. It sounds like the nothing-is-perfect-so-do-nothing argument. The fetal position is the most secure.
Table-ized A.I.
Just because it can be done, doesn't mean it has a real world practical use.
Unless a specific individual is being targeted and followed around, I don't see a practical way that this would be useful.
Is someone going to harvest all text messages in an area, hoping that someday someone will request a TFA code? The TFA code expires in minutes, would have to be there to act, not just harvesting information, collecting, and acting on it later.
Also, using a service like google voice to receive the text message (non forwarded) seems like a pretty easy, secure workaround.
It is just an excuse to harvest your phonenumber.
For what purpose?
To sell it to Rachel from Cardholder Services, I expect.
What organizations have 2FA that might do this? I'm not saying there aren't any, but I can't think of any.
I don't know where Rachel from Cardholder Services got my cell phone number, but she certainly got it from somewhere.
Basically, what you posted in this thread can be summarized "oh, just trust them with the information, they won't misuse it. And anyway, I can't think of how I would misuse it, so obviously some corporation couldn't think of a way either."
...All information about a consumer is also a liability. Lots of organizations haven't figured this out yet,
Right the first time: Lots of organizations haven't figured this out yet.
but I think pretty much all of them savvy enough to be implementing 2FA understand it.
The historical record does not back you up on this.
https://www.comparitech.com/blog/information-security/biggest-data-breaches-in-history/
http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
https://www.csoonline.com/article/2130877/data-breach/the-16-biggest-data-breaches-of-the-21st-century.htm
https://www.techworld.com/security/uks-most-infamous-data-breaches-3604586/
http://www.geoffreylandis.com
I changed the number to google voice number. I get the alert in email to my gmail account, and also a message to the phone. But not the default SMS application, but to some google+ messenger kind of thing. Frankly I thought they were dead. But they give me the alert.
Does this also use SMS and is vulnerable to SS7 security vulnerability?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Thats not the kind of 2FA I was expecting.
Anyway they claim to be able to intercept it in transit but I bet I would have used the code by thr time they extracted it from their extractor. Not to mention they would have to be ready at any time and know my email address. Meh.. it could happen but it wont stop me from using coinbase which I rarely use anyway.
No kidding, if this stuff was actually two-factor, you'd still need the password even if you could prove access to the phone's data.
Also, it wasn't a coin wallet they hacked, it was Gmail. Gmail is apparently where the vulnerability is.
Oh, not to mention it may not be a good idea to farm out the security of your bitcoin (ish) keys to some online third-party. I mean, yeah, we give money to banks instead of putting it under our mattresses, but they're FDIC insured and certified by the government (who can just print more if they steal it or, as we saw a few years back, mismanage it).
The video shows just the unlock process plus a (possibly fake) web page with SS7 printed in big letters. Looks much like a PR stunt These guys of Positive Technologies might want to read at least Wikipedia about SS7. Even if old protocol, it still has common things with OSI 7 layers. You can compare SS7as a sort of IP; the layers above like MAP are used in mobiles and there is no xml encoded for humans to read but XER/BER. In all networks I know there is no SS7 but all is SCTP. An attack of grabbing SMS text will only work if you are inside the operator's network, which has certainly vulnerabilities especially with peoples PCs that vpn into the core network. But if you are in that position you will probably be interested in many other aspects than just recovering some bitcoins. BTW I work for a mobile operator; these system trigger alarms when you login and commit a configuration. The you would need to understand a bit of things like AXE or DX200 nodes just to print something. This was just for some free PR by the authors.
The thing is: Using texts is a lot better than nothing.
The other thing: Using texts is practical. I just had my phone die, with all sorts of authenticator apps on it: for Google, for my credit cards, for my bank, etc.. To get those all replaced is an absolute PITA. Whereas anything using texts was automatically moved to my new phone, just by moving the SIM card.
Security has to be practical, or people won't use it. Texts are very practical. Instead of encouraging people to do something else, why not improve texts? Just as an example, how about if texts were encrypted ("Signal" or some similar protocol)?
Enjoy life! This is not a dress rehearsal.
It is just an excuse to harvest your phonenumber.
For what purpose?
To sell it to Rachel from Cardholder Services, I expect.
What organizations have 2FA that might do this? I'm not saying there aren't any, but I can't think of any.
I don't know where Rachel from Cardholder Services got my cell phone number, but she certainly got it from somewhere.
What makes you think it's from some 2FA? Seriously, what organizations do you give your number to for 2FA? Your bank. Your email provider (e.g. Google). Can you think of one that not suffer more by being discovered to sell those numbers than they would gain?
The historical record does not back you up on this.
Red herring. Those links are about data breaches, not sales. The claim here is that organizations offering 2FA ask for your number specifically to misuse it.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
All information about a consumer is also a liability.
Tell that to Equifax... If what you say is even slightly true they should be out of business 10 times over.
Dollars to donuts in 2 years it'll be business as usual.
All information about a consumer is also a liability.
Tell that to Equifax.
Well, in their case information about consumers is their entire business. Which means they should be crazy paranoid about security, because it literally is their entire reason for existence, to securely gather and disseminate -- but only when and where it's proper -- highly-personal information.
Dollars to donuts in 2 years it'll be business as usual.
Yeah...
I'm generally pretty laissez-faire, but this is an area that I think we need regulation. There should be specific, and severe, penalties for data breaches. And even more severe penalties for hiding data breaches. Keeping large amounts of data about individuals needs to be recognized as a dangerous thing to do, something to be done only when absolutely necessary, and only with extreme attention to security.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
It is just an excuse to harvest your phonenumber.
For what purpose?
To sell it to Rachel from Cardholder Services, I expect.
What organizations have 2FA that might do this? I'm not saying there aren't any, but I can't think of any.
I was talking more about "free" services than corporate authentication. There are many of them that would like you to give them your phonenumber, it used to be for password recovery, but now they claim it is for extra security. Steam pesters me all the time, I tried installing the mobile app to see if that was enough, but no, they want my phonenumber, even though it is less secure than my email, I can only imagine it is for selling on.
Red herring.
Your entire post is a red herring. You're basically saying "I don't think they'd do anything bad because we can trust giant corporations."
You haven't put forth any reason to think that, you just do.
I don't. The entire history of the web tells us that you can't trust corporations with personal information.
And, I really don't care whether they gave my number to Rachel at Card Services (and everybody else in the world) because of a data breach or because they sold it. That's a distinction without any difference to me.
http://www.geoffreylandis.com