8

tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received upon requesting it came from your number. That would be impossible, right? That's what happened here, except it wasn't between two friends in this case, but between me and a complete stranger.

Original post:

I have a Google account, and for various reasons, I decided to activate 2-factor authentication (2FA) for my account (i.e., input your password, and confirm the login by typing in a 6 digit code sent to your registered mobile phone number). I did this about a month and a half ago.

The first few codes I received came from a sender identified as "Google" by my phone/service provider. Then, on the 21st of January 2020, I received the 2FA code from a mobile number, when I tried to log in. At that time, I didn't think much about it. I just presumed that Google was probably using a couple of additional numbers and whatnot as backups when there were too many 2FA codes to be sent out or whatever. However, I did retain the SMS, as I was surprised to receive it from what was clearly a regular mobile phone number.

Since then, every single 2FA code I've received has been sent by "Google", and I've never received another code from a mobile number of any sort (or for that matter, from a sender with an identifiable number). Being a bit curious, I called that random number from which I had received the code then, and much to my surprise, somebody actually answered.

They seemed equally surprised by the fact that I had received a 2FA code from their number, and were utterly confused. They gave me their first name and location, and told me I could find them on WhatsApp (which I couldn't; I tried using another person's phone to try and find them on WhatsApp, but that didn't work either).

I am really confused now, and I thought I'd turn to the SE community for some inputs.

Some information that might be pertinent in this discussion:

  • All the "regular" 2FA code messages are always in English (here's the newest one here; I always delete the messages once I use the code, which is why I don't have a history here). google_og

  • The errant code I received was in German (I live in Germany, the sender's number is also a German number; the person I spoke with confirmed it by stating where they lived). The person told me that they use Google (Gmail?) as well. A text I sent them (after we spoke) asking if they are actually reachable on WhatsApp can also be seen in the screenshot below (I haven't received a response as of the time of writing).

    google_weird

  • The errant code worked. I had logged in successfully with it, which is what surprised me the most.

  • I received a "Critical Security Alert" from Google on the 19th of November 2019: "Google noticed unusual activity in your account. Someone else might have signed in and deleted emails. Review your account activity to make sure no one else has access." However, as far as I could tell, I did not lose any data, and I did not see any suspicious activity either, and this was long before I even activated 2FA anyway.

  • I don't see anything unusual in the Google Accounts Security page.

  • As far as I know, none of my accounts (with Google or elsewhere) have been compromised.

  • If it helps, I use Ubuntu 18.04 on a Lenovo Thinkpad X230 at home (and another Ubuntu 18.04 machine at work). My phone is a ZTE Axon 7 running Android v.7.1.1 (there is no way for me to update it!). I can provide a list of apps and the likes if that will be helpful.

My question is: what is going on? Is it possible for a 2FA code to be sent like this?

  • FWIW, for some service I receive a 2FA code from a "named" number, but if click resend, I get it from what looks like a real number, +1... (I don't live in the US). While SMS for 2FA is questionable, I've always seen the problem as contents exposed. I guess it's possible someone has changed your phone in Google account to their number, and is intercepting those codes and resending (but why not just use then?). – domen Feb 4 at 11:03
  • 2
    I dont know about the part "somebody actually answered." but google and other companies use third party messaging for sending 2FA codes and such – Vipul Nair Feb 5 at 10:58
  • @VipulNair as I mentioned in the OP, the mobile phone is registered to an ordinary citizen who was extremely surprised that I had received my 2FA code from their phone number. What you've mentioned here is NOT what happened in my case. The same goes for domen's comment. If somebody did accidentally register my number in their account, how did it (the registration) even get validated to begin with? As far as I can tell, what's happened here should be impossible. – Dunois Feb 5 at 22:12
  • 1
    you may want to follow some of the advice given in this thread: security.stackexchange.com/questions/224553/… btw, the # was probably spoofed, so the person you called is likely not involved. – pcalkins Feb 6 at 0:05
  • 1
    See security.stackexchange.com/a/175607/3644. The SenderID of SMS can be spoofed. – Martin Schröder Feb 6 at 17:16
2

The SenderId of an SMS can be easily spoofed by anybody betweeen Google and your phone. Note that Google does not directly send you an SMS but uses service providers that have network connections (maybe indirectly) to your phone. And since the Telcos between Google and your phone want to filter out non-person-to-person traffic (because of $), it makes sense for someone on the route to make the SMS look like person-to-person (p2p) traffic by choosing a (random) SenderId that comes from a p2p number. And if that number is already in use, even better. :-)

I work at an SMS aggregator who develops 2FA, delivers SMS for 2FA, uses SMS routes, and has heard of SenderId spoofing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.