Slashdot Mirror
Criminals Are Tapping Into the Phone Network Backbone to Empty Bank Accounts (vice.com)
Sophisticated hackers have long exploited flaws in SS7, a protocol used by telecom companies to coordinate how they route texts and calls around the world. Those who exploit SS7 can potentially track phones across the other side of the planet, and intercept text messages and phone calls without hacking the phone itself. From a report: This activity was typically only within reach of intelligence agencies or surveillance contractors, but now Motherboard has confirmed that this capability is much more widely available in the hands of financially-driven cybercriminal groups, who are using it to empty bank accounts. So-called SS7 attacks against banks are, although still relatively rare, much more prevalent than previously reported. Motherboard has identified a specific bank -- the UK's Metro Bank -- that fell victim to such an attack. The news highlights the gaping holes in the world's telecommunications infrastructure that the telco industry has known about for years despite ongoing attacks from criminals. The National Cyber Security Centre (NCSC), the defensive arm of the UK's signals intelligence agency GCHQ, confirmed that SS7 is being used to intercept codes used for banking.
"We are aware of a known telecommunications vulnerability being exploited to target bank accounts by intercepting SMS text messages used as 2-Factor Authentication (2FA)," The NCSC told Motherboard in a statement. "Some of our clients in the banking industry or other financial services; they see more and more SS7- based [requests],â Karsten Nohl, a researcher from Security Research Labs who has worked on SS7 for years, told Motherboard in a phone call. "All of a sudden you have someone's text messages."
"We are aware of a known telecommunications vulnerability being exploited to target bank accounts by intercepting SMS text messages used as 2-Factor Authentication (2FA)," The NCSC told Motherboard in a statement. "Some of our clients in the banking industry or other financial services; they see more and more SS7- based [requests],â Karsten Nohl, a researcher from Security Research Labs who has worked on SS7 for years, told Motherboard in a phone call. "All of a sudden you have someone's text messages."
This has been known for a long time, even NIST has deprecated SMS as a second factor. iMessage, though, is safe.
They're not personally being held responsible for the losses and they're not going to lose business to the other phone company for providing crappy service.
The fucking president of the United States shouldn't be using a fucking iPhone.
So, was this supposed to be a backdoor accessible only to "the good guys"? And now the bad guys are using it?
I'm shocked! Shocked, I tell you!
Read before you pontificate, eh moron? https://www.washingtontimes.com/news/2018/oct/25/trumps-cellphone-misplaced-golf-cart-presidents-cl/
Really, you find the NY Times credible? They're the index case for Trump Derangement Syndrome.
Well, it's easy enough to solve this problem... Force the phone companies to have to log every "active" device registration under the accounts' IDs on the SS7 and make it available to the customer to solve this problem.
So, in real time and logged you can see every active monitoring/duplication/hacked mirror of the signals/events... Make it straightforward and *maybe* even require that the account is authenticated using the Identity of the location cellphone towers that the current phone is one, so in order to add a phone to a phone's SS7 event stream you'd have to actually be in the same tower ranges as the current phone...
It's not like this isn't possible... Security is only as smart as those who implement it and work through the use cases.
.
SMS should not be used for 2FA. Full stop.
...for the stories today: https://ask.slashdot.org/story...
"Don't meddle in the affairs of a patent dragon, for thou art tasty and good with ketchup." ~ohcrapitssteve
That's what happens when you're not using end-to-end encryption.
Rueters has extensive content detailing the immorality of American security contractors in supressing democracy and journalists in UAE.
Chickens will come home to roost.
First the FaceTime bug, now this. Is there *anything* they can't ruin?
Do NOT fucking use SMS for 2FA. Institutions using SMS for 2FA are part of the problem and deserve what they get.
Dammit, why do people still keep calling this stupid shit 2-factor authentication? It most assuredly isn't 2FA.
All it really happens is you send a virtual "OK" button to another source, and all the user has to do is just say yes. That is at best a slight layer of security by obscurity, but at worst a complete farce.
We've seen articles about how the telcos can be talked into handing over control of SIMs to attackers, who can then pretty much control all of the things you naively believe are 2FA.
An Entrust token where you need to physically have the token, and enter the code (hopefully in addition to your own secret PIN) is 2FA. Because it involves a challenge of something only you should know.
This shit gives banks the ability to say "well, you authorized it", and it gives companies like Facebook another number to correlate with you ... but it is not, and never has been 2-factor authentication.
I've refused to use any of these terrible schemes, because usually I don't trust the asking party with my cell #, and because it doesn't add any security whatsoever.
An SMS confirmation is meaningless in terms of real security. Companies act like it is, and people believe it, but it's simply not true.
Heh - co$t of living in N.Y. $tate beat 'em between highest taxes (supporting welfare largely) & utilities (national grid) both being afaik highest there are (Perhaps California & their PGE may rival it).
* Correct me IF I'm off/wrong OR you can show me charted data from a reputable source (it'd be appreciated)...
APK
P.S.=> Winter's KICKING MY ASS (no joke) & holding onto money? Might as well try hold onto air in your hand alone (can't wait for Spring - 9++ weeks tops - co$t$ go WAY down).. apk
That is the only logical conclusion.
The bastards who set up the online systems have only partially thought out security.
Comment removed based on user account deletion
Comment removed based on user account deletion
For a bank to implement any system costs $100s millions. Let alone the annoyance to their customers.
If they lose $1million to fraud then that is just a cost of doing business. And most money lost to fraud is eventually recovered.
What we need is phones with more features. Like every time they visit a web site they execute code on that website that can potentially take over the phone. Wait...
This is how it's supposed to work.
Phones are not secure. Do not expect your phone to be private or secure.
DO NOT BANK ON YOUR PHONE EVER!!!
Why all that effort just to break into empty bank accounts?
nt
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
Why does my twitter account have better security than my BANK?! Bank of America only supports SMS authentication, and that is only to a long list of every phone number associated with my account. I cannot restrict it to just one phone number such as a Google Voice phone set up just for security. I asked a rep about Two-Factor-Authentication and she said "I never heard of that, what is it?"
It is mind boggling. My money has less protection that my throw away forum accounts.
Also, shout out to Vanguard, who has a "I FORGOT MY AUTHENTICATION DEVICE" link on the login page that allows me to skip using Google Authenticator if it's 'inconvenient'.
- For the complete works of Shakespeare: cat
No. This went like SMTP. "Only other telephone companies who are allowed to tweak settings and know what they are doing can connect to the signaling network anyway, so we don't need any security here" (Signaling protocols are around since the firts phone call wasn't routed by an operator on a switchboard but routed digitally)
But then at one point every country was switching to digital call routing and now every small Lampukistanian telco is allowed to send routing commands that have world wide effects.
But even that wasn't THAT bad....
The shit really hit the fan when said Lampukistatian phone operator connected their internal (office) network to the Internet.
bickerdyke