9

Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for authorization (in case of 2 step auth) or for controlling the account (password reset, etc..).

However, already long ago was proven GSM technology to have the disclosed vulnerabilities:

That leads us to the decision, that SMS-enabled services are really hackable (yes, it needs some money and resources, but as time goes, everything becomes cheaper). So, the matter is only:

  • How important figure you are, or

  • If attacker is just willing to spend the resources to attack you.

So I have 3 questions:

  1. What is a foreseeable future - is it going to happen, that worldwide GSM providers will soon fix all the vulnerabilities and upgrade the technologies easily? And if they don't plan this, then what should we do?

  2. What is a foreseeable future of internet? Will Google, banks, and all others tend to deprecate SMS authentication soon? Otherwise we will be always vulnerable with #1 issue. (btw, in Google you can disable SMS)

  3. And as a last note, of course, in our reality, 2 step authorization (SMS based) increases security from most of hackers (i.e. in case our passwords are stolen), but the reality turns out to be that users who uses 2-step SMS authorization (or, doesn't use 2 step, but has entered own mobile number in his profile, as a recovery method) have increased security threat. For example, when hacker doesn't know your password, but is capable to hack SMS (as opposed to the first category of hackers, when you have increased security instead). Quite a problematic dilemma.

  • 2
    Good question. Also, many better 2 step authentications will fallback to SMS, making them equally unsecure. – Esa Jokinen Feb 2 at 10:22
  • 2
    TOTP, hardware tokens and Web Authentication API have already started to act as an alternative to SMS token. But changes take time to be adopted as new standards. – defalt Feb 2 at 19:01
  • @defalt yes,thats problem, that "it takes time...". I think tech-giants should have a eay to disiable (as an user-option) sms based recovery... maybe they should implement other alternatives too,like unique voice recognition, fingerprint, whatever... i dont know... – T.Todua Feb 2 at 22:46
  • Any new implementation will take as much time as the current implemented standards. Current standards have been verified by cryptographers and engineers so they are ready to replace SMS-OTP. – defalt Feb 3 at 5:39
  • SMS-based 2FA has been actively being replaced for a while now since the official recommendations are not to use it. I'm thinking that this question has been answered for a while now. – schroeder Feb 3 at 15:55
3

Bruce Schenier talks about this issue here.

To quote the article.

Here are two new active attacks we're starting to see:

  • Man-in-the-Middle attack. An attacker puts up a fake bank website and entices user to that website. User types in his password, and the attacker in turn uses it to access the bank's real website. Done right, the user will never realize that he isn't at the bank's website. Then the attacker either disconnects the user and makes any fraudulent transactions he wants, or passes along the user's banking transactions while making his own transactions at the same time.
  • Trojan attack. Attacker gets Trojan installed on user's computer. When user logs into his bank's website, the attacker piggybacks on that session via the Trojan to make any fraudulent transaction he wants.

See how two-factor authentication doesn't solve anything? In the first case, the attacker can pass the ever-changing part of the password to the bank along with the never-changing part. And in the second case, the attacker is relying on the user to log in.

The problem with 2fa is that the password and the otp are both sniffed. Or just the password is sniffed and then the user taps the 'tap here to login' prompt. Either one allows the attacker in.

As mentioned by defalt. The proper way to authenticate a user (mathematically speaking) is to use strong mutual authentication like how yubikey's security key does.


1) What is a foreseeable future - is it going to happen, that worldwide GSM providers will soon fix all the vulnerabilities and upgrade the technologies easily? And if they don't plan this, then what should we do?

Things take a very long time to change because of lock-in . Ipv4 was predicted to be dead by 2010. In 2019 ipv6 usage is about 25%. Rolling codes were created back in the 1980s but fixed code systems are still around in 2019. So sms will stick around for a long time to come.

The best thing you can do is utilize the strongest authentication that a website has available. There's not much an individual user can do beyond that. It's really up to the website to implement strong authentication.

2) What is a foreseeable future of internet - does GOOGLE, BANKS and all others tend to deprecate SMS authentication soon, or that's not gonna happen, and we are will be still sticked with #1 problem?

Google and Yubico are working hard on upgrading user authentication for the internet in 2 ways. 1. delivering hardware based tokens and 2. making it easy for web servers to implement webauthn. These 2 ways are really just different sides of the same coin.

3) And as a last note, of course,in our reality, 2 step auhorization(SMS based) increases security from most of hackers(i.e. in case our passwords are stolen) , but the reality turnes out to be, user who uses 2-step sms authorization (or, doesn't use 2step, but has entered own mobile number in his profile, as a recovery method) has increased security threat - for example,when hacker doesnt know your password, but is capable to hack sms (as opposed to the first category of hackers, when you have increased security instead). Quite a problematic dilemma.

A chain is only as strong as it's weakest link. If it's easier to hack someone's account directly or by "recovering" the account. The attacker doesn't care. A website needs a strong primary way of authenticating it's users, and if it chooses to implement recovery. That needs to be secure too.

  • wouldnt installed trojan able to access or sniff the connected hardeare, like yubikey? – T.Todua Feb 3 at 21:06
  • 1
    A yubikey uses challenge-response authentication instead of shared-secrets. The gist is that the server sends a challenge and the yubikey signs that challenge and then sends it back to the server. The signature is only valid for that session and for that website. The Google authenticator app just generates 6 digit codes but it's up to the user to verify that the website he/she is on is using tls and that the domain name matches character for character. This is a bit over simplified. If you want to know more you can start here (fidoalliance.org/how-fido-works) – silverduck Feb 3 at 23:33
2

I think it will keep its place because there is no "buy in" on the user's end IE they don't need to complete any actions on their device prior to using it. I haven't come across any data suggesting that using SMS 2FA decreases security over not using 2FA.

1

And if they don't plan this, then what should we do?

I will share my experience while implementing 2FA for an ERP software :

  • Provide Authenticator-app based 2FA.
  • If possible, integrate 2FA with mobile fingerprint if you support mobile app. .
  • If for some legacy reason or requirement, you need to provide SMS-based 2FA, make it clear that App-based 2FA is a better choice by displaying message during setup process to end-user. (Yes, there are companies which don't allow smart devices to be carried inside office premises)
    • For B2B, ususally such policy is decided by IT team of the company. Make sure to convey the pros/cons/security risk of using SMS-based 2FA clearly.
  • For banks, It would be great to use App-based or hardware tokens for 2FA.
    • Example : DBS in Singapore gives their customer a hardware device to generate tokens. First, a SMS will be sent to your phone with 6-8 digit OTP. You need to enter this OTP into the device to generate another OTP, which will be used to validate the second factor.

That being said, all the above methods have some tradeoffs. (Usability vs Security)

If there is too much security, it might decrease the usability which in turn would decrease the security if users are not aware.

  • I remember, while I was an intern in a company for few months where users were forced to change their password every month with strong policy as 8 letter password with 1 lowercase, 1 uppercase and 1 special character and cannot set last 10 passwords. This resulted in users to have a pattern in the password like : Jan012018. Some users even had sticky note with their password on it.

I would suggest to consider all possibilites and adopt based on the use-case.

does GOOGLE, BANKS and all others tend to deprecate SMS authentication soon

As said above, Banks have started moving towards more secure ways of second factor. Ofcourse it would take time for it to be universal.
(From what I remember, Google also supoorts App-based 2FA, hardware tokens and other methods of 2FA)

  • Nice answer, wish I could upvote X times. – T.Todua Feb 14 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.