Touch tone phone username and password

Question

I just got off the phone with Fidelity, who manage the health benefits for the company where I work. Before talking to a person, I was prompted to enter my username and password on the numeric keypad: 2 for abc, 3 for def, ... (Their passwords are limited to letters and numbers)

It occurred to me that doing this severely lowers the set of possible passwords an attacker would have to run through. For example, an eight character password has only about 4^8 = 65536 possibilities once the sequence of keys is known. (Some keys map to 4 letters plus the numeral itself, so it's a bit more than that).

How easy would it be for an attacker to listen to the key sequence and then brute force the password from the sequence of touch-tone digits? My guess is that phone lines are not as secure as HTTPS.

Answer 1

Yes, it's possible - but not necessarily easy - for someone to listen in to your DTMF tones.

Land Line

This is the easiest to tap. In increasing order of difficulty...

• Anyone in your house can pick up an extension and listen to what numbers you press.
• Anyone with access to your house can install a digital recorder into a phone socket and then listen for the DTMF tones.
• Anyone with access to your property could attach a device to your phone line to listen in on everything you say. Phone calls are not encrypted :-)
• Anyone with detailed knowledge of your phone company could open your local cabinet and tap the connection there.

In short, typing in your password, credit card number, or any sensitive data, via a POTS landline is not a good idea.

Mobile Phone

Ok, let's assume that you've got a cellphone / mobile phone. It's a lot harder to tap - but not impossible.

• Anyone nearby will be able to physically hear the tones you type in. Your phone's speaker will play the DTMF as you press the button. A digital recorder, a microphone pointed in your direction, and some software to pick out the tones is all that's needed.
• The connection between you and your base-station is usually encrypted. However, there are known weaknesses in the encryption algorithms. A determined attacker could, theoretically, decrypt your communications either in real-time or after the event.
• It is possible (although difficult) for an attacker to force your phone onto a fake basestation. At this point, the attacker can hear everything which you type in.

Are You A Target?

All of this really does depend on how high a value target you and your account are. I doubt that your health benefits are of particular interest to criminals.

That said, if your bank account contains billions of dollars, and you use the same password for banking as for benefits - some of these scenarios are more likely than others!

Answer 2

Brute-force the password from the tone pattern? Easy, assuming the website does not have any countermeasures to prevent brute-force attacks.

Listen to the key sequence? A good deal harder. Assuming you aren't entering the password in public, the attacker would need to tap the phone line at some point, which is quite difficult for anyone who isn't in law enforcement or employed by the phone company.

Answer 3

As Mark mentions, the most difficult part of attacking your password in this way would be gaining access to capture the numbers entered during your phone call. If an attacker wants to tap your phone line (assuming non-mobile) they need physical access to your house or demarcation point outside your house. Depending on where you live it might not be difficult to access your demarcation point to install a tap, but it would require the attacker knowing where you live. Someone with telco access could also do this, but that's generally much more difficult hack.

They would then attach a device that records DTMF tones so they could later watch for a call to Fidelity followed by your passcode. Capturing the DTMF tones sent when you dial and converting them back to their numeric representation is pretty easy.

Alternatively, if you dial up Fidelity using a smart phone it might actually be better for the attacker. If they could trick you into installing a trojan on your phone this could monitor your calls and capture any digits sent. Of course the trojan could also capture your exact password if you log into the Fidelity web site using the phone's browser.

I've been told by another customer that you can log into the Fidelity web site with the same numeric password you use over the phone. If an attacker just wants into your account then no brute forcing would even be necessary.

Assuming the hacker did want your original password they would have to compile the possibilities. 1 and 0 only represent numbers, while 2 - 9 represent either a number or one of three to four letters. Since they'd want to distinguish between uppercase/lowercase letters that gives us 9 total character possibilities per key.

Worst case scenario (meaning no 1's or 0's were used, and all 7's and 9's) for an 8 character password would then be 9^8, or 43,046,721. It's unlikely a person would really use all 7's and 9's, so that number is likely to much lower. They might also prioritize that pool of possibilities with words or other common password formats guessed first to improve their odds finding it sooner.