1

All my 2 factor authentication used to come from Google sms, but recently I've had the following numbers come up on my phone. I realise that to do this the person would need to have my phone number. I checked and this seems to be a number in canada. I did have a strange phone call from canada about a week ago but not sure if this is connected. Does anyone know if this is just my jumpiness or if this a legit attack. If it is, how can I prevent?

enter image description here

  • Are they valid 2fa codes? – Matthew Jan 3 '17 at 19:26
  • This doesn't look legit to me. The CO on each number is different, which doesn't make a lot of sense for the official number—they would use a shortcode or numbers within the same CO as their official number. The way the text message is phrased is also pretty suspicious: why would they send you such a cryptically worded message? – demize Jan 3 '17 at 20:11
  • Another point: they do have a Toronto office, but it appears to have a number in the 416 area code rather than in 647. – demize Jan 3 '17 at 20:13
  • it timed out in the tor session so not sure if this is just because it couldnt load for some reason or because this is not legit. When I tried again, the sms returned to the normal google sms origin – user637251 Jan 3 '17 at 20:24
  • 1
    More worrisome, I think, is that two different numbers sent you the same code, at different timestamps. – NA AE Jan 5 '17 at 0:38
1

These appear to be valid Canadian numbers but are not Google numbers so not legit. Also not likely to actually be from the numbers listed. Far too easy to spoof caller ID's I'm afraid.

Scammers don't need your number, most operators have a range and auto-dialers can call huge numbers of phones in a short space of time.

Unfortunately there is little you can do though it may be worth reporting to your carrier, your local telecoms regulator and your local law enforcement organisation specialising in cyber crime if you have one (Action Fraud in the UK for example). Although you won't normally get much response, occasionally, when a large number of reports are received, something may be done about it.

  • The odd thing is that they seem to be redirecting me to my legit gmail after login. So it might be they're just after collecting my username and password and perhaps spying on my session by getting my ip? Why else would someone do this? – user637251 Jan 3 '17 at 21:05
  • 3
    Your response indicates that you followed some instructions (clicked on a link?) and logged in? If so, I strongly recommend you immediately reset the password and change it anywhere else you might have reused it. – Julian Knight Jan 3 '17 at 21:10
  • Hi, I changed to another phone number but it reverted back to the first one. I did call google but got the wrong department. He tried to assure me all was ok. I told him I was sceptical. I'm being redirected to my email but how are they doing that then if it's a fake number? – user637251 Jan 4 '17 at 5:42
  • Hi again, just an update. I've spoken with the isp and then to google support. They asked me to raise it in the their forum. i'll keep it open here too as I think it might help others. I'll see what response I get and will post here once I have an answer. – user637251 Jan 4 '17 at 10:56
  • That shouldn't happen if you've removed the old number in your Google profile. – Julian Knight Jan 4 '17 at 10:57
1

You seem to be getting sms from different numbers which is scary. In India my mobile no. Is registered to multiple email ID but everytime I recieve a sms it is from a constant number. Each Sms from google has arrived on same number

Change your password soon & possibly use google authenticator application. You might not be in attack with Man In Middle because I have seen gmail throwing me an error of untrusted connection when i had tried to filter my web content using openDNS (google uses https). But it can be a attack of phishing which later on redirects you to your google account.

  • Thanks for the advice @Surendra Patil . I'm looking at those options, definitely, but I really would like a definitive answer from google and see whether they can do something to prevent this. I've already changed my password once. Then tried to change phone numbers and got a timeout. Waited and tried again on tor and got to change numbers. On new number it is all ok and comes up as google each time. However, this is really scary stuff and I think google needs to know about it and maybe try to put in some remediation. Maybe you're right and the only option is an app service for now... – user637251 Jan 4 '17 at 13:43
  • 1
    These def not legit numbers. I called one of the people and spoke to her briefly. I believe this is an iPhone security issue. This is not just a random SMS for phishing. They are correct codes and only happens on one phone so when I tested with another phone it was fine. It also happened with another app that uses 2 factor authentication. It has been escalated with apple and I'll let you know what happens. I suspect my SMS messages are being intercepted and copied somehow. Two ways this might be done a) fm or other uncontrolled radio signal with Siri or b) imei number being known to attacker. – user637251 Jan 9 '17 at 16:41
  • Omg... Will wait for your answer... Thanks for coming back & informing us.... – Surendra Patil Jan 9 '17 at 16:52
  • 1
    I was likely the victim of an ss7 attack. You can google it but it's a flaw in the telco infra that is known to hackers and means if you know someone's number you can track location, listen to calls, forward calls and SMS messages and spy on everything. There is no way to get rid of it. I think the person got my number when I turned on 2 factor authentication on that was already compromised and hacked. I also suspect there's another hack on my phone via Bluetooth but not as sure about that one, and that can control my web page access. Apple is confirm likely hack but don't know what. – user637251 Jan 10 '17 at 11:04
  • I did read about it, watched few videos about SS7 attack. It seems that it is known vulnerability since a decade, previously people have faced this same issue & its strange to see that it does not have a fix yet. This is going to be a big problem if not fixed soon... regarding other hacks happened to you... Did you ever jailbreak this iphone ? – Surendra Patil Jan 10 '17 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.