Hacker News Reader

Comment by wolfgang42 | Hacker News Reader

> I received an SMS saying “Enter Uber code 5483 to confirm your number”. Thinking someone entered their number incorrectly or similar, and assuming - as I had my phone with me - that my account was safe, I ignored the message.

This sounds like yet another example of why SMS is not a good second factor. The Uber rep's responses seem to ignore the question of how this account was compromised (instead providing suggestions for good password hygiene), so it's not clear to me whether they even think that the SMS PIN is supposed to provide any security at all.

View on HN

This actually seemed way worse than the monetary details. Uber offered TFA via SMS, and then apparently failed to require it. That's really bad, and sparks concern about all of their other security practices.

Assuming this is accurate, I guess it's time to assume there's an unexplained failure in Uber's security/login rules?

I assume that the attacker did one of two things: either they were somehow cloning the SMS messages so they came to both the customer's phone and to them, or they jumped the gun on an SMS redirect they had set up and the first TFA got sent to the customer; they then retried later and got the message on their channel.

The logical fallacy in your answer is in assuming that, just because the customer got an SMS with a TFA code, an attacker did not get the same or subsequent code and use it. We don't know that.

Of course, it's also possible that Uber's TFA is broken ...

I had been assuming that cloning was very unlikely, yeah. It seems substantially harder than actual redirection or capture would be.

But honestly, I hadn't considered the possibility that they triggered an SMS and then got access later, maybe with a second (rerouted) SMS. That's a good point.

> This sounds like yet another example of why SMS is not a good second factor.

You know, that name is becoming customary, but this is not two factor authentication.

Two factor authentication requires that you successfully authenticate on both of two separated channels to gain access. That SMS crap companies keep doing require that you authenticate on any one of two channels to gain access.

I think it's because I'm tired, but I'm not following.

I login to $app with my password. $app bounces me to SMS. I then go back to $app with the SMS code.

So I needed my password with $app and the code from the SMS.

In the article, it looks like the code via SMS was never required. Uber sent it out, then allowed a login without it. I've seen something like this before, where companies over two factor auth via SMS, but also allow SMS as a password reset channel - which means it's not two factor anymore.'

But in general, you're right. The problem with SMS as a second factor isn't that it's not two-factor, it's the ease of compromising both factors at once. Hijacking phone numbers is disturbingly easy, and smartphones mean that you can steal one physical token and get both email access (for password reset) and SMS access (for the code).

I got the impression there was no password input. It's getting way too common to do phone based verification, and authenticate new phones by SMS codes.

If it asked for the password (does Uber use passwords at all?) then yes, I was just saying dumb things; please ignore.

If your Android phone is infected then 2FA effectively becomes single factor that is under attacker's control.

Seems like it's possible that the user's phone number was hijacked? In that case SMS verification actually makes their account less secure because it can become a single point of failure.

Wouldn't he know if his phone number was hijacked though? I found Uber's silence on how the 2FA was defeated the biggest issue here.

Could have been hijacked for a brief time, or could have been attacked through a network exploit that duplicates all SMS'es and reflects the copies to an attacker ...

If I get an SMS like this one day, what can I do to stop someone from hijacking my account?

Immediately cancel /close/delete your Uber account. As in the linked article, Uber does not allow you to remove a payment method only change it to another card or to Paypal.

You could also immediately cancel/freeze your credit card until you've resolved the issue with your stolen Uber account.

Reply on news.ycombinator.com