Hacker News Reader

Comment by lxgr | Hacker News Reader

Every time I hear about yet another SIM swapping attack, I feel confirmed in my decision to use Google Voice for SMS-2FA as much as possible (only for services that don't support an actually secure method, of course).

Except for one certain bank that won't even accept my "real [cell] phone number" for identity verification purposes, because "it's not verifiable" (probably because it's not with the big three cell providers).

The state of "two-factor authentication" (a.k.a. something you're phished for and something you're social-engineered out of) and "identity verification" (a.k.a. "have a $80/month phone plan with these three companies or get lost”) in this country makes me really sad.

View on HN

On their tech support page [1], Google Fi is said to be resistant/immune to SIM swap attacks because the attacker needs physical access to your device and Google account. Yet earlier this year [2], the Google Fi hack said to have exposed Fi users to SIM swapping. Can anyone shed light on how this can happen without someone having your phone?

[1]: https://support.google.com/fi/answer/9834243?hl=en [2]: https://www.reddit.com/r/cybersecurity/comments/10rqtt2/goog...

Implementation flaws like that are always possible, but my concern is that in so many cases, SIM swaps are ridiculously easy by design (or more accurately, by absence) of the phone provider's security procedures.

Issue is that FCC mandates a port out within 4 hours and stores don't make $$ while doing these so their goal is to get you out of the door ASAP so they can focus on the revenue. So that's why + bribe factor

could you explain this? 4 hour starting from when? what checks the FCC demand/allow?

> Can anyone shed light on how this can happen without someone having your phone?

I do not know specific details of this particular incident but I would like to emphasize the fact that Google Fi, at least in the US, is a virtual network on top of the T-mobile's physical one. There is some extra level of security via obscurity that makes simple social engineering attacks harder but fundamentally it is still T-mobile underneath.

Think of it. You lost your phone and went to store and store employee or CS over the phone is able to issue you a SIM. Now the same employee takes bribe and give it to the hackers who use it to steal your fund

It's pretty wild how baked into modern life insecure 2fa is. Especially with the prevalence of sim swapping. I more or less model most auth as trivially insecure at this point.

You think about someone like Vitalik of all people, if he can't keep his account secure...average person has their work cut out for them.

Private key auth systems have security challenges of their own (losing access forever when you lose your key) but I wish they were an option in place of the current regime.

In the 90s you could bypass security locally on a machine by clicking cancel and it would just log you in. Feels like today it's only slightly more complicated and costs a bit of money to access twitter, email, bank accounts etc.

Seemingly little to no interest in resolving this state of affairs beyond obscure and increasingly less legal crypto based systems.

That’s what happens when we designate phone providers as the single point of identity verification without creating any incentives for them to actually fulfill that role.

One of my banks basically only accepts what they call “phone number verification” to clear a false fraud alert on my cards (or generally talk to them about anything regarding my account).

What that means is (at least I’m fairly sure) that the agent on the phone will ask me for any phone number, they ask the carrier for the name on that line and compare it with mine, and if it’s a match, they send an OTP to that number.

This is even worse than SMS-OTP, since a fraudster doesn’t even need to change my number on file with my bank – opening a phone line in my name with any of the big three carriers is enough!

> It's pretty wild how baked into modern life insecure 2fa is.

And a solution to this is very simple. Make telcos legally liable for losses due to SIM-swap attacks and before the ink is dry on such a law, Telcos will ban using phone numbers for authentication in their TOS. The banks and alike will be forced to come up with another, hopefully, better auth system.

Not sure why you're being downvoted; I think this is pretty reasonable idea.

Of course, there's zero chance of this happening in the US, given telcos would lobby heavily against it. But as a thought experiment, I think that's exactly what should happen: telcos should be held liable for their piss-poor security practices against SIM swapping.

And you never know what's going to come up from EU from a regulatory perspective.

I didn't down vote GP and I agree with both of you, but I think a reason for down votes could be because it's quite authoritarian.

Security comes with cost and inconvenience. Like would you pay $50 everytime you've to swap a SIM ?

If it was used as prepayment for services, this is not half bad idea. But for targeted attacks to people like Vitalik that's well within budget.

sure, how frequently do you swap?

His..twitter account.

Not his private wallet.

NIST recommends against email or VoIP "phones" for the second factor, because then it's not what you know and what you have, but just two things you know, so no 2FA. As far as I understand, it does not recommend against SIM-based 2FA anymore, though considers it RESTRICTED.

"Methods that do not prove possession of a specific device, such as voice-over-IP (VOIP) or email, SHALL NOT be used for out-of-band authentication."

(5.1.3.1 of SP 800-63B https://pages.nist.gov/800-63-3/sp800-63b.html)

"Currently, authenticators leveraging the public switched telephone network, including phone- and Short Message Service (SMS)-based one-time passwords (OTPs) are restricted. Other authenticator types may be added as additional threats emerge. Note that, among other requirements, even when using phone- and SMS-based OTPs, the agency also has to verify that the OTP is being directed to a phone and not an IP address, such as with VoIP, as these accounts are not typically protected with multi-factor authentication."

"NIST SP 800-63B does not allow the use of email as a channel for single or multi-factor authentication processes."

(A-B01 and A-B11 in the FAQ https://pages.nist.gov/800-63-FAQ/)

> Note that, among other requirements, even when using phone- and SMS-based OTPs, the agency also has to verify that the OTP is being directed to a phone and not an IP address, such as with VoIP, as these accounts are not typically protected with multi-factor authentication."

Unbelievable. My email address is protected with multi-factor authentication (and given the popularity of Gmail, I'd wager that this isn't all that uncommon!); my main phone line isn't.

Interesting... I primarily use a virtual phone number because I don't want to give out my real phone number though; it's easier to cancel and replace a virtual one. (Although maybe not - at this point it's tied to so many services I would probably lose access to something permanently if I canceled it...)

NIST has been wrong previously.

Oh boy, the elliptic curve pseudorandom number generator debacle.

Be careful, I trace cryptocurrency for scam and hack victims and have personally seen GV transfers used in attacks.

The lack of a physical SIM does not give more safety. "SIM Swap" means "convincing a system or human to transfer a phone number." A GV number is just as easy to transfer as any other phone number.

I’d call that a number porting attack. A SIM swap to me is convincing the current provider to provision a new SIM for an existing line, which the attacker can then use to receive texts addressed to the victim.

Porting attacks are definitely possible against Google Voice, but these require confirming the port in the target account first, no?

And the Google Voice equivalent to a SIM swap would just be a compromise of the Google account itself. Definitely not impossible, and I know I’m tying my availability to a company not exactly known for being the best custodian for that – but I’ll take my chances with them over any phone provider.

Google will not share how threat actors are pulling it off but it definitely is happening. (see the Terpin v. AT&T lawsuit for why they might not be disclosing the vector)

There are "fingerprint" cookie marketplaces that sell tokens from malware-compromised computers and allow you to make HTTP requests from a victim's connection, this could be one approach. There are also scammer call centers that will call unsuspecting people pretending to be Google, Coinbase, AT&T, or whomever, and have them click buttons in user interfaces.

I've seen entire Google accounts deleted with no recourse due to this "suspicious activity" that victims had no control over. Computer says no, and it's near-impossible to get in touch with a human at Google.

(I agree with you on terminology but media reports tend to group number porting attacks in with "SIM swaps")

Is there a reason that would-be hackers are not preempted by requiring a specific device, pins, etc with no kill-switch or social engineering available (like, you lose your credentials, there's nothing we can do, its gone)? It sometimes feels like the system is deliberately designed so certain "legitimate" actors have a backdoor into any given system...

The only time where Google's absolute lack of customer service for end users might pay off

True – can't social-engineer a person if there's no person!

https://www.bleepingcomputer.com/news/security/google-fi-dat...

> A GV number is just as easy to transfer as any other phone number.

There is nobody to social engineer (it's Google, they hate customer service) and the system rejects all port-out requests until you unlock the number by paying a few dollars which requires breaking into the Google Account to begin with. It is absolutely not the same as compromising an employee of a carrier.

To be clear I'm describing Google Voice which is purely a VOIP service, not Google Fi which is a MVNO.

> Except for one certain bank that won't even accept my "real [cell] phone number" for identity verification purposes, because "it's not verifiable" (probably because it's not with the big three cell providers).

It’s common for organisations to blacklist VOIP-based numbers for 2FA. There’s more discussion about this, including some solutions, here:

https://news.ycombinator.com/item?id=36909505

Yes, a horrible antipattern that's spreading rapidly.

I really hope that security researchers will demonstrate that trusting phone providers as the gatekeepers of modern digital identity is a bad idea – otherwise, fraudsters (and consumer frustration, in case of getting locked out arbitrarily) will.

My phone provider recently switched to SMS-OTP as a mandatory (and so far their only) 2FA method, including for SIM replacements. I guess I'm just supposed to start my life over on a new number if I ever lose my SIM card...?

I try to avoid giving my cell number, precisely because it’s not secure, but also because it changes or I travel, and then I’m locked out of my own account.

It's not a real vacation if you don't get locked out of at least one bank account or credit card for the crime of accessing your balance from a foreign IP, with no way to recover :)

Works great for my buy-and-hold portfolio.

Same, but it works decidedly less than great for buying train or flight tickets while already abroad and on a travel SIM.

> It's not a real vacation if you don't get locked out of at least one bank account or credit card for the crime of accessing your balance from a foreign IP, with no way to recover :)

Laughs in Bitcoin

Also, Charles Schwab Investment checking account for the uninitiated saves me from this issue; NFC enabled now ensures my card will never get eaten in a random ATM now.

As someone who has been moving countries and subsequently changing phone numbers, every couple of years, SMS 2FA is such a pain.

It's hard to recall all services that have your phone number for migrating them, and even if you do, many won't accept a foreign number.

I've resorted to holding on to my old phone numbers by transferring them to prepaid SIMs.

Be careful with this, if you don’t use the prepaid sim for too long, it’ll get cancelled and you will lose access to all these accounts.

I've lost access to my near-twenty-year-old Google account this way.

I have the username, password and recovery email, but because I can't receive an SMS, I'm dead.

That’s horrific. My wife lost her Instagram account the same way. Really ruined part of our vacation in Paris. Looking back on it though, maybe that was worth it.

> probably because it's not with the big three cell providers

More likely because it's a VOIP number, which is easy to verify (Twilio's Lookup API will expose this info, and I'm sure there's other lower-level techniques)

my bank disallowed me from using my google voice. they said to reduce impersonation. but i said this now makes me vulnerable to sim swapping attacks and they had no response

Which bank?

Wells Fargo is one. You cannot unlock a card suspended for suspicious activity with the app. You must call the automated line and listen to the 5 most recent transactions. You can confirm you made them or deny you made them. If you deny, the card is immediately revoked, and a new card is issued. If you confirm, the suspension on your card is immediately removed.

Maybe the don't let you unlock on the app in case someone is in possession of your device? Via the automated line, you have to provide ID'ing information that someone with the device might not no still. Just trying to find some logic

> Just trying to find some logic

My suggestion as somebody working in an adjacent industry, to protect your own sanity, is to not attempt that.

Reply on news.ycombinator.com