0

Everything is based on phones now. If I have someone's phone I can reset their Salesforce password, access any SAS services etc.

Assume this

  1. Hacker finds someone's phone number
  2. Hacker buys (or works at) a T-Mobile franchise
  3. Looks up the IMEI for that phone number at T-Mobile
  4. Finds what services they use (eg Salesforce)
  5. Calls Salesforce from that number on a cloned SIM card, does 2FA, resets the password and gets into the account.

How could this be prevented?

Improve this question
3
  • 5
    This question starts with the assumption and claim that "Everything is based on phones now." - which actually is not about the whole phone but about the SIM only. The question of "How could this be prevented?" is simple - don't base the security entirely on the SIM. There are various technologies in use (like U2F, RSA tokens ...) which don't rely on SIM at all. – Steffen Ullrich Jul 17 '20 at 5:08
  • 1
    "does 2FA" - that step only works with SMS/text-based 2FA and not the type of 2FA that is the recommended and standard form, which is a big barrier to doing what you describe – schroeder♦ Jul 17 '20 at 6:52
  • 1
    And what you are describing is a "SIM swap" - no need to buy or work at T-Mobile. – schroeder♦ Jul 17 '20 at 6:52
3

Scenarios like that are possible, but not without consequences. Your list continues like this:

  1. A victim reports this to the police.
  2. The perpetrator loses license to operate as a franchise due to this abuse.
  3. T-Mobile hands over the identity to the police.
  4. Criminal charges are easy to bring as the evidence is overwhelming.

A more typical SIM swap scam is to abuse operator's procedure to get a new SIM card to replace a broken or lost card. As the perpetrator impersonates the victim he leaves much less traces back to himself.

Also, SIM card alone isn't enough to bypass MFA. If that was sufficient, it would have been 1FA. Instead, the perpetrator must also get to victim's password in a 2FA or gain access to all other factors of a wider MFA.

Some services may allow resetting the password having access only to the phone number; now that's really a vulnerability! Also, a fallback to SMS authentication on e.g. Time-based One-time Password (TOTP) failure is not a good idea.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.