12

And if not would like specific reasons why.

I have this suspicion that, although an inferior method these days to MFA applications, believe that the security is adequate enough as most phone companies have been made aware of SIM jacking and are working to prevent it.

3
  • 2
    We cannot really fix SIM jacking...
    – fraxinus
    Jul 29 at 17:14
  • Subjective @fraxinux. They are a lot better and are aware, agree there is ways to go but that's everything security related. Jul 30 at 2:08
  • 1
    SIM jacking can be performed leveraging human factors. Distraction, naiveness, bribery, rubber hoses. You can't fix those. Jul 30 at 9:18
10

I agree preventing SIM Jacking would be a step forward; still even if we fixed SIM Jacking/swapping, we still have to worry about Man-In-Middle (MITM) attacks like the SS7 attack https://www.firstpoint-mg.com/blog/ss7-attack-guide/

Which is a much bigger problem, as my understanding (and I could be wrong) the security flaw is baked into legacy infrastructure; so not an easy problem to solve.

Of course other MFA can also be susceptible to MITM, but only when the user is entering the passcode. Because of the aforementioned SS7, SMS passcode is also vulnerable on delivery to the user. (See CBHacking's great breakdown of some other MITM attack: https://security.stackexchange.com/a/253759/261890)

For an example of the SS7 attack, see the banks and other companies that got hit by it: https://www.itpro.com/security/32898/metro-bank-targeted-with-2fa-bypassing-ss7-attacks

Returning to the original question; if we fixed SIM jacking would it be a valid way to send MFA token?

Depends on how you define 'valid'. Which leads us into opinion/judgment.

Security is about picking the right tradeoffs. I'd say it's better than having only a password as it means an attacker has one more thing to get; but there seem to be better options out there.

1
  • 4
    I find people implement SMS and then won't implement client cert because they already have two-factor. Boo.
    – Joshua
    Jul 29 at 18:25
21

In addition to the issues with SS7, SMS is not meaningfully encrypted. Sometimes the last mile portion (between tower and device) is encrypted, but that encryption is weak and can be broken. Other times, even that layer of protection is absent. Furthermore, at lots of other points along the transmission process - including some that can be intercepted by outsiders, such as between tower and mobile provider, which is usually unsecured microwave transmission - the message is available in plain text.

Asking "is it OK to use SMS for auth if we got rid of hijacking?" is a lot like asking "is it OK to use plain HTTP for login pages if we got rid of the ability to brute-force/shoulder-surf/credential-stuffing-attack passwords?". The answer is no. Many of the attacks even have equivalents:

  • Last-mile connections to the device are like WiFi, and potentially unsecured or at least weakly secured (mostly nobody uses WEP anymore, but lots of cell phone connections are similarly weak)
  • You can cause the infrastructure to misroute your message via SS7 attacks, very similar to DNS or ARP spoofing
  • You can take over the "router" for a man-in-the-middle position using a compromised microcell (I once saw somebody intercept legit SMS by accident, until he told the microcell he was pentesting for research to stop claiming to be part of a legit network; peoples' phones just automatically connected to it before that)
  • You can physically intercept the plain-text messages further from the end node, where they're transmitted through the infrastructure over tappable media (like microwave links or copper cables)
1
8

SMS is better than nothing, but even if we fixed SIM jacking, the problem is that it's sent over an unencrypted channel. Most cell phone networks are IP-based these days, so that means it's going unencrypted over the Internet. Nobody should be sending anything unencrypted anymore, and therefore SMS is not the ideal solution.

The best forms of 2FA are FIDO2/U2F security keys, because they send a digital signature instead of a secret and are bound to the site in question, and are therefore invulnerable to phishing. TOTP, while not possessing that property, at least has the benefit that the secret during setup and the codes are usually sent over an encrypted channel.

I also think it's naive to assume that phone companies being aware of it means that it's going to be fixed. Oftentimes, the people that actually perform the SIM swaps are relatively low paid and are bribed or cajoled by criminals to do the swap. As long as this remains a viable way for criminals to do this (that is, it is cost-effective to bribe or social-engineer the employees who have this access), it will continue to happen. Because most phone companies aren't experiencing significant negative consequences (e.g., legal liability, lost business, criminal prosecution) as a result of SIM swapping, there is little incentive for them to make the structural changes to avoid it, which will likely be expensive and inconvenient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.