Hot answers tagged

49

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the attack. Even an "average user" might have crypto wallets or precious twitter accounts. Sometimes the gain of an attack is also not that obvious, like when a ...


16

Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective. Most stuff, including every new system that comes up every few months and that completely obsoletes everything else is usually based on personal financial interests, dogma, belief, and snake oil. ...


10

"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability and risk against cost and inconvenience. A different question you could ask is whether SMS 2FA is sufficient mitigation against criminal teams working on mass ...


7

Having multiple factors of authentication are always more secure than any one of those factors apart. A password and a token from an SMS message is harder for an attacker to circumvent than just a password or just a token sent through SMS. However, SMS itself is currently considered the least secure authentication method, and there does not seem to be any ...


4

Although SMS 2FA is not as strong as TOTP base MFA or the use of a hardware security key (e.g. yubikey) it still offers a significant amount of protection against the typical attacker who's just trying to make use of weak or compromised passwords.


4

To echo James' response. It is entirely possible for someone to send you something for a number that doesn't belong to them. This will usually be criminals trying to get you to click a link and steal credentials. Whether this is likely will be dependant on the nature of the message received. If the message is generic and contains a link then sure it's a ...


4

If you still have service to your phone, it's unlikely to be a SIM swap attack. Generally, one of the consequences of a SIM swap is that all the services provisioned on your phone (including your phone number) are transferred to the attacker's phone, by the exact same process as those services would be transferred to your new phone when you upgrade. This is ...


3

The problem I see with this statement is that both of these attacks to me feel like they're essentially only really feasible for attacks targeted at a specific user with the goal of breaching a targeted service. [...] You can't do SIM swap attacks in an automated way or even at scale (unless there is a serious issue with a phone provider). [...] The average ...


3

You have two areas where you can control this. First, you can control the user/number pair spamming by recording the number you sent an SMS to and limiting the number of messages your system can send to that number. For the case where someone generates multiple users and multiple numbers, you can control that on the user-creation process before the SMS part....


3

It sounds like you've got two problems that you're kinda rolling into one: Device enrollment -- you need some way to know which user to register this device to, that's where the email or the phone number comes in. A valid user can register any device they want, as long as you can track the device somehow. Fingerprint the device -- on subsequent logins, ...


3

By storing the token in the database and sending the (encrypted) id of it to client you've just created new token. Forget about JWT tokens, you new token is the encrypted integer ID in the database. You shouldn't use ID as the new token: IDs are usually incremented (and therefore predictable), and in some encryption schemes flipping the bit in cyphertext ...


3

A screenshot doesn't prove anything. At all. As long as you know how to use Paint you can modify anything you want. So the screenshot could be fake. Or he could indeed have sent that message and then deleted it. Conclusion: you can't know based on just the information you currently have. You'll have to find more information: If it was an actual text ...


2

I would recommend that you DO NOT contact the new owner of your previous phone number. He/she would have no obligation to complete your task, in fact, you will be letting him know that he possesses a huge foothold to your account. You will be relying on how he/she responds, hopefully in good faith, as Instagram allows users to send a login link using their, ...


2

Depending on the attacker, they probably won't care much about the meta data for your transactions If someone was targeting you specifically, because you are a high profile target, then they may want this information as a part of their reconnaissance. Assuming you are not a high profile target that needs to be concerned about attackers reading your emails,...


2

The SenderId of an SMS can be easily spoofed by anybody betweeen Google and your phone. Note that Google does not directly send you an SMS but uses service providers that have network connections (maybe indirectly) to your phone. And since the Telcos between Google and your phone want to filter out non-person-to-person traffic (because of $), it makes sense ...


2

Maybe... just maybe.. a simple answer is that your friend has a malware on his phone, and the "victim" isn't actually you but him. I'd suggest you let him know he should comb through his installed apps/plugins, ask if he's installed anything sketchy lately, especially if it reoccurs.


2

SMPP is an application layer protocol and is not intended to offer transport functionality. It is therefore assumed that the underlying network connection will provide reliable data transfer from point to point including packet encryption. Vulnerabilities that are found in SMPP protocol: Zero Confidentiality: As there is no encryption standard specified ...


1

I would not say this is an glitch or something like that. Basically this sounds like a spoofed text message. This technique is called "Caller id spoofing" and can be achieved in numerous ways. Caller ID spoofing is the practice of causing the telephone network to indicate to the receiver of a call that the originator of the call is a station other than ...


1

The fact is his card is VbV. He claims not to have received any OTP message, while it was obviously sent. There is nothing obvious about that. As far as I know Verified-by-Visa isn't mandated by the card alone, it also has to be supported by the Merchant where the card is used for payments. When the Merchant doesn't support VbV then none of the extra ...


1

The SMTP protocol has always had support for temporarily down servers. The nominal use case is that a message is submitted by a Mail User Agent (typically a mail reader like Thunderbird) to its closest Mail Transfert Agent (sendmail, postfix, exim, etc.), what is declared as the SMTP server. Then the MTA tries to deliver the message either to a forwarder if ...


1

A "telegram engineer" access my telegram account Short answer is that it's possible. The simplest way would be for a telegram engineer to change the Telegram client to forward your password when it's entered. Then, Telegram can have bullet proof crypto, you can own the keys, their systems can be audited but the end-to-end system is under the control of ...


Only top voted, non community-wiki answers of a minimum length are eligible