Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just got off the phone with Fidelity, who manage the health benefits for the company where I work. Before talking to a person, I was prompted to enter my username and password on the numeric keypad: 2 for abc, 3 for def, ... (Their passwords are limited to letters and numbers)

It occurred to me that doing this severely lowers the set of possible passwords an attacker would have to run through. For example, an eight character password has only about 4^8 = 65536 possibilities once the sequence of keys is known. (Some keys map to 4 letters plus the numeral itself, so it's a bit more than that).

How easy would it be for an attacker to listen to the key sequence and then brute force the password from the sequence of touch-tone digits? My guess is that phone lines are not as secure as HTTPS.

share|improve this question
    
Is this the same password you would use on the website, or is it a phone only password - is there still some other checks after? –  Eric G May 21 at 22:49
    
@EricG This is the same password I would use on the website. After the operator connects, they also ask my name. –  bgschiller May 21 at 22:53
1  
Another concern is that this means they're keeping your password stored as text somewhere. –  N Jones May 22 at 2:53
    
Maybe the customer service can hear/record the DTMF tones, and derive which possible passwords you have (i.e: it needs to start with a "d", an "e" or an "f", ...). –  m1ke May 22 at 4:34
    
@NJones, They could have hashed the password twice (a phone hash and a website hash) when the account was first set up. –  Mark May 22 at 4:49

3 Answers 3

up vote 2 down vote accepted

Yes, it's possible - but not necessarily easy - for someone to listen in to your DTMF tones.

Land Line

This is the easiest to tap. In increasing order of difficulty...

  • Anyone in your house can pick up an extension and listen to what numbers you press.
  • Anyone with access to your house can install a digital recorder into a phone socket and then listen for the DTMF tones.
  • Anyone with access to your property could attach a device to your phone line to listen in on everything you say. Phone calls are not encrypted :-)
  • Anyone with detailed knowledge of your phone company could open your local cabinet and tap the connection there.

In short, typing in your password, credit card number, or any sensitive data, via a POTS landline is not a good idea.

Mobile Phone

Ok, let's assume that you've got a cellphone / mobile phone. It's a lot harder to tap - but not impossible.

  • Anyone nearby will be able to physically hear the tones you type in. Your phone's speaker will play the DTMF as you press the button. A digital recorder, a microphone pointed in your direction, and some software to pick out the tones is all that's needed.
  • The connection between you and your base-station is usually encrypted. However, there are known weaknesses in the encryption algorithms. A determined attacker could, theoretically, decrypt your communications either in real-time or after the event.
  • It is possible (although difficult) for an attacker to force your phone onto a fake basestation. At this point, the attacker can hear everything which you type in.

Are You A Target?

All of this really does depend on how high a value target you and your account are. I doubt that your health benefits are of particular interest to criminals.

That said, if your bank account contains billions of dollars, and you use the same password for banking as for benefits - some of these scenarios are more likely than others!

share|improve this answer

Brute-force the password from the tone pattern? Easy, assuming the website does not have any countermeasures to prevent brute-force attacks.

Listen to the key sequence? A good deal harder. Assuming you aren't entering the password in public, the attacker would need to tap the phone line at some point, which is quite difficult for anyone who isn't in law enforcement or employed by the phone company.

share|improve this answer
    
Thanks for your answer. I'm going to hold off on accepting for a few days because I'd like to see if anyone has more specifics about how difficult it would be to listen in on the key sequence. –  bgschiller May 22 at 16:03

As Mark mentions, the most difficult part of attacking your password in this way would be gaining access to capture the numbers entered during your phone call. If an attacker wants to tap your phone line (assuming non-mobile) they need physical access to your house or demarcation point outside your house. Depending on where you live it might not be difficult to access your demarcation point to install a tap, but it would require the attacker knowing where you live. Someone with telco access could also do this, but that's generally much more difficult hack.

They would then attach a device that records DTMF tones so they could later watch for a call to Fidelity followed by your passcode. Capturing the DTMF tones sent when you dial and converting them back to their numeric representation is pretty easy.

Alternatively, if you dial up Fidelity using a smart phone it might actually be better for the attacker. If they could trick you into installing a trojan on your phone this could monitor your calls and capture any digits sent. Of course the trojan could also capture your exact password if you log into the Fidelity web site using the phone's browser.

I've been told by another customer that you can log into the Fidelity web site with the same numeric password you use over the phone. If an attacker just wants into your account then no brute forcing would even be necessary.

Assuming the hacker did want your original password they would have to compile the possibilities. 1 and 0 only represent numbers, while 2 - 9 represent either a number or one of three to four letters. Since they'd want to distinguish between uppercase/lowercase letters that gives us 9 total character possibilities per key.

Worst case scenario (meaning no 1's or 0's were used, and all 7's and 9's) for an 8 character password would then be 9^8, or 43,046,721. It's unlikely a person would really use all 7's and 9's, so that number is likely to much lower. They might also prioritize that pool of possibilities with words or other common password formats guessed first to improve their odds finding it sooner.

share|improve this answer
    
I think your math for the number of passwords is off: a pass-number that is all 7s ("PQRS") or all 9s ("WXYZ") gives 4^8, or 65536, possible passwords. A pass-number that is uniformly distributed across digits would be 3^6*4^2, or 11664, possible passwords. A pass-number that avoids 7 and 9 corresponds to only 3^8, or 6561, possible passwords. –  Mark May 25 at 21:31
    
Mark, the 9th character comes from the number itself being a possibility. And remember that in my estimate the attacker was trying to find the exact case of the original password, not just the letter. –  PwdRsch May 26 at 0:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.