Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

9

Yes. Why do I say this? It is important to understand what all these vulnerability's are and why they exists (I will be calling the victim "subscriber"): Why do they exists: SS7 was designed and developed in 1975 as a protocol for telecommunication for call operating centers. Since we are talking here about 1975, the security of the protocol was not ...


5

SS7 attacks can't be done via ISDN lines. In order to attack the SS7 network, the attacker has to be "on the SS7" network. The SS7 network connects telco companies together, but it is not extended to clients. What this means is that the attacker is either has access to the network administrator at a telco company, or the attacker is the network admin at the ...


5

The newest draft of the NIST Digital Identity Guidelines deprecates the usage of Two Factor Authentication via SMS. I would recommend utilizing Google Authenticator (or similar technology) to facilitate 2FA moving forward, and abandon SMS based out of band verification.


3

The answer is yes. As explained in this link a similar exploit has been made on Facebook. If you have a phone number linked to your Facebook account, a hacker just needs your phone number and just by hitting the "reset my password" button and intercepting the confirmation code sent to your phone he will have full access.


3

There are different kinds of blocking. The DoS you describe is merely a UI-based problem. If blocked from the SMS app, then the incoming SMS is ignored and not displayed. This happens client-side. Which means there might be congestion in the network, but SMS is not meant to have high QoS, so you might never notice a problem. But it does solve the UI-based '...


2

It's not clear from the article if the attacker intercepted the SMS code or if he just found a way to bypass it. I think we can't really say what happened without more details. However take a look at the "Ghost Telephonist" attack shown at Black Hat USA 2017, which is just a real world example of how an attacker could intercept a call or an SMS without ...


1

ISDN in itself is a SS7 network. By buying access to an ISDN connection you are getting into the SS7 network which in terms is PSTN. In short, yes it can be done over ISDN you just need to map and convert regular PSTN traffic into an IP-based sigtran and this is not something new. These devices are there on the internet everywhere. Just search for "isdn pri ...


1

In search of an answer to this question, I decided to do some research and see if I could find out myself. Your thinking seems to be on the right track: 60 Minutes showed Karsten Nohl, a German computer scientist, remotely attacking U.S. Congressman Ted Lieu’s cell phone and listening to his cell phone calls... The spying was allowed by security bugs ...


Only top voted, non community-wiki answers of a minimum length are eligible