Hacker News Reader

Comment by CGMthrowaway | Hacker News Reader

They use vulns in the outdated SS7 system to trick networks into revealing a numbers location (1), and intercept SMS including the verification codes sent by apps like WhatsApp - allowing them to hijack accounts and monitor messages and calls directly (2). This method works remotely and doesn’t require antennas

The SMS are intercepted because thru SS7 by tricking the network into thinking the target phone is roaming (3).

(1)https://www.lighthousereports.com/methodology/surveillance-s...

(2)https://www.motherjones.com/politics/2025/10/firstwap-altami...

(3)https://www.fyno.io/blog/is-it-easy-to-intercept-sms-a-compl...

View on HN

> intercept SMS including the verification codes sent by apps like WhatsApp

For anyone worried, this approach:

1) Breaks the existing phone from receiving WhatsApp messages, so you can notice that behavior

2) Can be prevented by setting up a WhatsApp pin in your settings

Probably these were addressed way too late. Developers are the last to know their backdoors surprisingly.

Not just vulns. It is possible to simply purchase access or become a provider in the SS7 system (<$20-50k USD). SMS is basically a completely open system at this point. Cybersecurity companies do it all the time for pentesting. So do "Cybersecurity companies".

Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative.

Did you really think the US Gov was OK with facebook running the biggest "encrypted" SMS system on earth. LOL of course they already had access to all the messages.

Hijacking WhatsApp SMS authentication codes can be prevented by just adding a PIN to your account. Doing this attack also doesn't grant you access to someone's old WhatsApp messages, and contacts with "security notices" enabled will see that your device has changed. It's quite different than big gov just having access to all your WhatsApp messages. (But there might be other ways they can do this, but just SMS sniffing doesn't get you there)

> Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative.

In my country banking applications are tied to your phone via IMEI, SIM and other hardware dependent information available.

Forget getting banking details and use another device without the user knowing, either.

If someone clones your SIM or gets a replacement in behalf of you, your all banking access is blocked until you enable them one by one with your ID card or other means.

One of the banks can use FaceID as a secondary factor, too.

So, other methods are possible. It's an "implementation detail" at this point.

Reply on news.ycombinator.com