Hacker News Reader

Comment by aviv | Hacker News Reader

In the US it is trivial to hijack any mobile number's SMS traffic. It takes less than a minute. SMS as 2FA should never ever be used by anyone.

View on HN

I see the advice not to use SMS for 2FA comes up a lot on HN, and understand the reasons why that is true. But I find that recommendation comes up short. What are the alternatives, and how can they be widely deployed for little cost?

Token based 2FA, either via something like google authenticator or a USB dongle like a Yubikey or RSA token.

The point is to prove that you have possession of both knowledge and a physical token (hence two factor). And while sms to phone makes it seem like you are proving possession of the phone, you’re actually proving that you have the phone that texts will route to. That last bit is movable and subject to shockingly little security, hence the issue.

Even 2FA that involves you receiving a call is more secure than 2FA that involves you getting a text, but of course that too should not be used, ever. It's just that SMS is that much worse. I wish I could share on HN the technique anyone anywhere can use to take over any mobile number's SMS traffic within a minute so we can discuss it at great detail, but obviously I know better and would never do it. Unfortunately this knowledge is not limited to myself and many people out there know this especially after being in telecom for a while.

How does it work? Why is it so easy?

Well there's a few issues.

The SS7 (https://en.wikipedia.org/wiki/Signalling_System_No._7) does not have any authentication so anything over the telephone networks can be easily MITM'd.

And at provider's stores they are too eager to please a "customer" so social engineering is very effective at swapping SIM cards out and hijacking your number.

It's easy because a) the signaling system in use is pathetically insecure, b) the wireless protocols are pathetically insecure.

SMS is not exactly the most secure protocol. But you do not need to use SMS for 2fa, that's a misconception.

Isn't it effectively plaintext?

I don't know too much about the SMS protocol. But I do know that most protocols do start out plaintext because programmers are lazy and optimistic.

That’s one part of the problem. The other part is that it’s actually quite easy to convince most cell phone carriers to change the SIM card associated with a given phone number. Once you’ve pulled that off hijacking the account is easy.

It's not exactly plaintext. Last time I saw it was using broken crypto (may have changed since then, but I doubt it), and it encrypts the data hop by hop, so that if you insert yourself as a hop, you'll just have decrypt (with your keys), read and encrypt it.

Search for SS7, it's a swiss cheese of vulnerabilities.

Reply on news.ycombinator.com