SMS Verification Code vs. Response Message [duplicate]

Question

I need to verify each user's phone number in an enterprise SaaS system. Instead of using the common "Enter the 4/8 digit code in this form", I'd prefer to have the user respond with an SMS message saying "hello" or possibly a unique message for each user.

My goal is to make it easier for the user to verify if they happen to abandon the website's onboarding flow.

Is there anything inherently more secure about having users enter a 4/8 digit code online vs. sending a code or simple message from their device?

Answer 1

Great question! I'll attempt to break down the security models.

Is there anything inherently more secure about having users enter a 4/8 digit code online vs. sending a code or simple message from their device?

While SMS as a whole makes for a weak 2FA method (see the article above from The Verge), at least the former requires the attacker to do some hacking on the global telecom network. The latter is trivially broken by anyone who know about the online services for sending an SMS with any from: number.

SMS is a weak a 2FA method

Let's start by saying that SMS is not a secure way to deliver sensitive information. This article from The Verge seems to line up pretty well with my understanding:

By exploiting known flaws in the cell network, the group was able to intercept all text messages sent to the number for a set period of time. That was enough to reset the password to the Gmail account and then take control of the Coinbase wallet. All the group needed was the name, surname and phone number of the targeted Bitcoin user.

Positive Technologies was able to hijack the text messages using its own research tool, which exploits weaknesses in the cellular network to intercept text messages in transit. Known as the SS7 network, that network is shared by every telecom to manage calls and texts between phone numbers. There are a number of known SS7 vulnerabilities, and while access to the SS7 network is theoretically restricted to telecom companies, hijacking services are frequently available on criminal marketplaces.

Source: The Verge.

So, with the understanding that we are comparing the security of two variants of a very insecure system, let's proceed.

Security Model for entering the verification code in the web UI

Security model: for an attacker to spoof ownership of your phone number, they would need to:

1. Initiate the website's onboarding flow, providing your information.
2. Read the SMS code sent to your mobile number.
3. Enter that number into the onboarding flow.

Pulling off this attack requires the ability to read your SMS messages in real time, which as The Verge points out above, is easily doable.

Replying to the SMS with "hello"

Security model: for an attacker to spoof ownership of your phone number, they would need to:

1. Initiate the website's onboarding flow, providing your information.
2. Receive an SMS from the server.
3. Reply to the server's SMS number with the word "hello".

At first glance, this looks like the same security model as above: "if the attacker has SS7 hacks and can read your SMSes, then they can reply to them also".

But in fact this model is much weaker; there is actually no coupling between steps 2 and 3. There are a million websites that let you send an SMS and set whatever from: number you want, so as long as the attacker knows the server's SMS number, they can spoof the "hello" from your number even if they have no ability to read your incoming SMSes.

Replying to the SMS with a code

Security model: for an attacker to spoof ownership of your phone number, they would need to:

1. Initiate the website's onboarding flow, providing your information.
2. Receive an SMS from the server containing a code.
3. Reply to the server's SMS number with this code.

Alright, we've fixed the coupling problem and required the attacker to be able to read your incoming SMSes. As noted above, sending messages that appear to be from you is trivial, so I think this security model is equivalent to that traditional one of "type the SMS code into the website".

You will however run into usability problems in that correctly typing a code into your phone keyboard is significantly more annoying than typing it into your computer, so I'm not sure you gain anything here.

Summary (same as above)

Is there anything inherently more secure about having users enter a 4/8 digit code online vs. sending a code or simple message from their device?

While SMS as a whole makes for a weak 2FA method (see the article above from The Verge), at least the former requires the attacker to do some hacking on the global telecom network. The latter is trivially broken by anyone who know about the online services for sending an SMS with any from: number.

Answer 2

I don’t think it’s a good idea to require a response message if your goal is just to make the verification process easier. At least, you should remember that it will be impossible to pass the verification if the user is not able to send SMS (e.g., do not have credits or the user is in roaming and he did not buy a plan with outgoing SMS).

In addition, sending SMS costs the user money. Moreover, since the user doesn’t know for sure how much it costs, he will most likely think that this is a scam (recall that there are many fraudulent sites that require phone numbers to access “premium content”).