81

I did some research about how secure and private SMS messages are.

Providers and governments can see these SMS messages in plaintext,
but what is weird is that these messages are not encrypted in transit.

According to my knowledge, that makes the service vulnerable to MiTM attacks: a semi-skilled hacker who knows my location can intercept the connection and get a code to reset my Google account's password for example.

10
  • 15
    SMS is built-in feature on mobile phones, you don't have to install it and you can not uninstall it intentionally or accidentally . As @user10489 mentioned in his answer, a risk assessment could be a way to choose or not using SMS. For further understanding check this security.stackexchange.com/a/197187/21144
    – elsadek
    Jul 6 at 12:52
  • 11
    I work on an SMS app. Sending an SMS from any arbitrary number is outright trivial. There is nothing more insecure than SMS. Jul 7 at 0:09
  • 6
  • 29
    @MooingDuck Yes sending to any number you want is easy. Sending from any number is also easy. But both of those are irrelevant here. What matters here is being able to receive messages that are meant for any number. This isn't trivial afaik. Jul 7 at 12:44
  • 5
    @MohamedWaleed: it's no different than sending a letter and signing like someone else. It has been doable for millennia. The tricky part is to intercept the reply. Jul 9 at 4:56
70

Yes, you're right. SMSes are not recommended in any two-factor authentication (2FA) process nowadays. They can be easily intercepted and modified.

That's why a lot of companies are recommending other alternatives:

SMSes are considered obsolete when talking about a secure way to verify your identity. They are also affected by SIM Swapping attacks. That's why some 2FA apps that use TOTP, like "Google Authenticator", are gaining more popularity in the market.

There are many examples on the Internet exploiting these weaknesses:

Even with all these examples, SMSes are still used because:

  • The infrastructure for SMSes is already implemented worldwide and changing it would be really expensive.
  • They are a relatively easy and cheap way to implement 2FA.
  • They can be used without special software / apps in any cellphone.
  • For old cellphones, this may be the only way to receive a 2FA code.

But no matter what technology are you using, attackers always take advantage of the weakest link, in this case, people, so they will use social engineering techniques to try to trick you so you end up sending the 2FA code to them.

15
  • 65
    The SMS will stay there for a long time. It is simple and it works in most cases. Intercepting SMS requires being in range of the victim so the attacks are easy only in theory. Social engineering is still a bigger concern that actual black-hats driving around in a ice-cream truck to intercept your paypal authentication code.
    – nethero
    Jul 6 at 11:39
  • 29
    "Google Authenticator" is just a brand name for the open standard TOTP. Unbranded open-source compatible apps are available.
    – A. Hersean
    Jul 7 at 8:00
  • 8
    @nethero Sim swapping does not require to be in range of the victim. You do not even have to be in the same state as the victim to intercept SMS. You might be confusing with IMSI-catchers used to intercept all mobile communications (including vocal) at proximity.
    – A. Hersean
    Jul 7 at 11:48
  • 2
    The problem with TOTP is that most big services that support TOTP also allow SMS as a backup (I'm looking at you Google & Amazon). It completely nullifies the security benefits of TOTP.
    – zakinster
    Jul 8 at 9:30
  • 11
    With SMS being unarguably the worst way of implementing 2FA, it's worth highlighting that even the worst 2FA is infinitely more secure than no 2FA.
    – René Roth
    Jul 9 at 11:24
52

SMS is not exactly plaintext.

The network operator has it in plaintext, but the attack surface there is limited and both organizational and technological measures limit the exposure.

Over the air, it is pretty much encrypted, unless one uses 2G which can be optionally unencrypted and vulnerable to downgrade attacks. Most modern phones can be forced to use 3G and above.

And yes, these encryption methods are considered weak in relation to e.g. TLS and sucessful attacks do exist. But these attacks require equipment, skills and have their own prerequisites (like a great deal of exchanged data, etc...).

SIM swapping and other social engineering attacks are also possible, but they are - again - attacks and they require luck, skills and effort. They are not ready to use access channel. They can fail miserably as well - all the way down to being arrested and prosecuted.

In short, SMS is not that bad for use as a second factor.

edit: There is no good and bad (by itself) method.

There are good and bad methods in relation to the risk spectrum, the stakes and the user base involved. SMS is bad for launching nukes, but good enough for the average Joe's online payments. It is bad as well in regard to the order of an attractive toy use in a kindergarden.

In the security field, "good enough" is quite often the best method, because the security always cripples the usefullnes of the resource in question.

Edit2: As per @Steve comment: the worst second factor is one that users refuse to use because it's "too complicated" or "doesn't work on my system". This will either lead to users having only single-factor authentication, or becoming ex-users as they cancel their service or similar. In that context, a "bad" second factor is still good, because it's better than losing customers or relying on only a single factor. Even more customers can be kept by offering a stronger alternative to SMS (or other weaker second factors) for those customers who appreciate the technical differences and prefer stronger security.

9
  • 7
    I agree with everything but the last part. SMS is still a bad second factor despite of the available protections.
    – ThoriumBR
    Jul 6 at 21:45
  • 7
    There is no good and bad (by itself) method. There are good and bad methods in relation to the risk spectrum, the stakes and the user base involved. SMS is bad for launching nukes, but good enough for the average Joe's online payments.
    – fraxinus
    Jul 7 at 6:26
  • 17
    "Good enough" doesn't mean no incidents happen. "Good enough" means that incidents are on small scale and are manageable (from the viewpoint of the decision-maker). And, the whole 2FA thing is about allowing a margin of error. If it wasn't for the margin of error, the password alone can be "good enough", too. In a lot of cases the 2FA is imposed by the regulation and not because too much and too big incidents happen.
    – fraxinus
    Jul 7 at 8:59
  • 4
    Security is about risk management, not being a inconquerable forteress. As I am no security experts, I won't comment if the SMS is "good enough" for the average Joe, which by "good enough" mean, the risk/cost associated are low enough.
    – Walfrat
    Jul 7 at 9:10
  • 7
    @ThoriumBR - the worst second factor is one that users refuse to use because it's "too complicated" or "doesn't work on my system". This will either lead to users having only single-factor authentication, or becoming ex-users as they cancel their service or similar. In that context, a "bad" second factor is still good, because it's better than losing customers or relying on only a single factor. Even more customers can be kept by offering a stronger alternative to SMS (or other weaker second factors) for those customers who appreciate the technical differences and prefer stronger security.
    – Steve
    Jul 8 at 9:08
27

SMS has significant advantages to the user:

  • It's universal - every mobile phone can handle it, even the dumbest feature phone. Users may not be able to afford a smartphone and associated data plan, or may have no need for something so complex.
  • Similarly, a new phone but the same number, and it just keeps working.
  • It's accessible - if you can't see to read a notification but your phone can use text-to-speech, it still works. Not all apps respect the device's font size setting either.
  • It takes essentially no storage on a phone (unlike installing one app for every provider - my bank would use its own app, and last I checked, so would paypal, for example)
  • It doesn't demand unreasonable permissions (e.g. Microsoft authenticator has things like delete accounts, precise GPS location, prevent phone from sleeping, broad access to files, etc.)

As yet there's no single standard to replace that across such a wide range of accounts and providers

15
  • 4
    It's a point that a lot of IT depts overlook. Digitial poverty is very real, and not everyone has access to a smartphone that can have access to a "dumb" phone. I like to make this point a lot more clear for people to understand why SMS, while insecure, is still very valid.
    – schroeder
    Jul 7 at 9:04
  • 3
    And nice text-to-speech point. That's a more difficult point to raise as a lot of people can't imagine a visually impaired person using a phone with a screen.
    – schroeder
    Jul 7 at 9:06
  • 2
    @schroeder Yes, vision is very variable, and a specific authenticator app may not lend itself well to text-to-speech (via google assistant) or even to enlarged fonts (as may be done in a browser)
    – Chris H
    Jul 7 at 9:08
  • 2
    - portable to a new phone. Google Authenticator at least doesn’t let you transfer to a new phone. And especially if you lose your phone, you’re stuck. (One of many reasons I don’t use Google Authenticator).
    – Tim
    Jul 7 at 18:32
  • 2
    @InterLinked universal in the context of cellphones, which globally is the majority of phones. Then you can add in landlines that can receive SMS (I don't know if mine still can, but it used to be able to). SMS is far closer to universal than email in a global context, considering the large parts of the world where a feature phone or basic smartphone may be the only electronic device people own
    – Chris H
    Jul 8 at 20:57
13

One aspect of SMS as 2FA authentication that I feel isn't as covered is the availability of the method itself; you don't need a wifi connection or a data plan to run a SMS 2FA setup, nor do you need a 2FA specific app to set it up.

If you're working from an Ethernet connection in a remote area that has cellular reception, but would be considered roaming in your current mobile plan, a single SMS message is a cheaper cost than the data plan enabling you'd otherwise need.

It's also compatible with cheaper phones that don't have a full app store capability (i.e. flip phones and other non-smart phones).

Furthermore, if the phone/SIM card is stolen, it's revocable - you simply set the system to never send to that number again, and there's nothing an attacker can do from that point onwards short of social engineering to get the number added again.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – schroeder
    Jul 10 at 17:40
10

In an early draft of NIST SP 800-63-3, SMS was listed as a deprecated 2FA mechanism. When the final draft was released, this paragraph was removed, but examples remain in 800-63B of compromising SMS via collusion with the mobile phone operator. Although not deprecated in the final publication, SMS (and PSTN out-of-band authentication in general) is listed as a "restricted" authentication method, meaning that more secure alternatives are supposed to be offered.

It is generally accepted that password + SMS is better than password alone. It is also generally accepted that SMS is not extremely secure, as it can be stolen virtually fairly easy, although efforts have been made to make this harder. (SIM swapping is only one method to do this.)

Intercepting SMS by physical means might actually be harder than other methods, as it requires close physical presence, sophisticated (but inexpensive) hardware and software, and good timing.

The general advise on SMS for 2FA (as with any security measure) is to carefully evaluate risks and determine if SMS is appropriate for your uses.

0
2

I think it's worth mentioning that the second factor here is proof of "something you have" (as opposed to "something you know", or "something you are").

Simple TOTP applications (like Google Authenticator) allow you to prove that you physically have a device you had when you set up the security, by storing on that device a generated secret, and they deliberately don't allow you to transfer that "physical" thing to another device. Some TOTP applications weaken that slightly and allow you to back up that secret in an online account - so it's available across all your devices, or if you lose the original device - but fundamentally it's still proof of possession, the only difference is where that possession is stored. It's not the same as "something you know" because you're not expected to memorise the secret, you're expected to store it somewhere that others can't access.

SMS is proof of "something you have", but the thing you have is not a secret stored on a device, it's access to your own phone number / service. You could probably argue that's "something you are", but it's definitely not "something you know". Regardless of encryption, if you have access to someone else's phone service (because you can look over their shoulder or get a hold of their unlocked phone), you can prove that you have access to that phone number. Of course all the other (much harder) attacks that allow sniffing the SMS in transit exist as well. But all of that just means that the proof is less trustworthy, and all MFA proofs exist on a spectrum of trustworthiness (of which "no MFA at all" is at one end).

Why is it used at all? Because access to someone's phone service is easy to prove (both for users and services) and non-trivial to cheat.

2

We use SMS as "something you have" authentication factor for the same reasons we are still using keys to unlock doors.

All our doors could have keyless smart locks with access history, clone proof tags and video surveillance, but security may not be the only concern. There is user-friendliness, maintenance, emergency/backup/shared access and possible more things to consider.

Of course, SMS is not the safest channel.

Possible attacks

From easy to very hard/unlikely:

  • Physical access to your phone, unlocked or locked with visible notifications
  • SIM Swapping, someone pretends to be you and asks for a new SIM card from your mobile operator
  • Porting Fraud, someone pretends to be you with another mobile operator and initiates the attack immediately after the number portability process completes
  • Remote access to your phone, like the recent news regarding the Pegasus spyware, but there are other less sophisticated ways of exploiting phone vulnerabilities
  • Service providers, in which category I would include everyone transiting the 2FA code, from the SMS aggregator with a HTTP API that the bank is using to send the 2FA code to transit carriers and, finally, to your mobile carrier.
  • Low level SS7 attacks against your carrier network, tricking the network to pass the communication to a third party, like the 2013-2014 reports about a foreign agency candidly snooping the German chancellor's phone.
  • Lawful intercept, when not happening legally

Possible solutions

You can protect yourself from physical access by locking your phone and from remote access by paying attention to what you install or visit online.

For SIM Swap/Port Fraud, the entity generating the 2FA code could do a web API call to a service like the ones provided by the company I'm currently working for, TMTAnalysis (shameless disclaimer, proud of my coworkers, we are not the biggest fish in this pond), that checks with the mobile carrier if the number had been recently ported/swapped before sending the code. If the API result says number is high risk, stronger/alternative solutions could be triggered instead of SMS.

For the remaining attack types, well, there is not much you can do about those. Mobile carriers and government agencies have strict, audited policies regarding access to your communication. Also, there is great effort in firewalling the signaling networks, especially SS7, the attacks currently happening there will keep making interesting articles here on SE in the following years (spam,smishing,tracking,interception,bypass,fake ussd,dos,imsi disclosure,location/ati fraud,..).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.