SS7 cellular network flaw being exploited to drain bank accounts
techdirt.com
techdirt.com
You could enable any phone to be a receiver for SMS and literally see the network traffic around you on the SMS paging channel. The phone real time operating system actually discards messages that do not match your number (to put it very very high level.)
https://silo.tips/download/exploiting-open-functionality-in-...
Also, great reads if you can find them: Qualcomm standard PDF's.
What the linked presentation describes is somewhat obvious DoS attack on the infrastructure that depends on ability to cheaply inject larger number of SM-MT messages into the network which authors assume will exhaust the downlink capacity of the network. My assumption is that in such case the first resource that will actually get exhausted is uplink capacity of RACH as the paged MS will attempt to allocate SDCCH in order to complete the paging procedure. I also assume that any currently deployed implementation of GSM has reasonable enough QoS implementation that this cannot happen in practice (especially in relation SMS because various SMS-related accidental RR exhaustions were somewhat common in early implementations). By the way nothing prevents you from causing cell-level DoS of similar type by simply spamming the RACH (except the fact that your local equivalent of FCC will be very unhappy and will be knocking on your door in surprisingly short time).
This is literally true, and actually, you can do it with an SDR device and the GNURadio liveCD.
However, this data will all be encrypted. Even on 2G networks, you can't just camp at a cellular base station and watch SMS fly by ...
One only has to look at Jack Dorsey getting jacked to prove this is an inevitability for every single one of your users.
Electronic Funds Transfer is similarly based on trust. I can withdraw funds from any bank account just by knowing the account number. The only incentive is that you don't want to lose your account, but once you've been through the process of setting things up, it's quite easy to see how the system could be gamed.
Maybe someday we'll be able to trust the underlying protocols our lives are built on top of.
While SS7 does seem like a problem, I think the bigger issue is using SMS for 2FA.
Banks with local branch offices are especially well placed to do better. They can offer Yubikey to their customers, and also since they can see customers in person, they have a way to provision new ones if an old one gets lost (customer comes in and shows government ID, etc).
These are banks. It took them over a decade to only finally implement SMS 2FA. It'll be another 2 before they implement U2F or TOTP.
Actually, shockingly, Vanguard offers U2F support which is quite the minority for financial firms :D
Meanwhile american express still makes passwords case insensitive AND trims the fucking lengths behind the scenes.
In the meantime, I have been banking with a 'calculator' for over 15 years which accepts my bank card, I enter the PIN and it spits out a code.
A lot of the slowness is driven by regulation and especially the slow decision-making that leads up to regulation.
In the UK for example, I cannot think of a single bank that uses SMS as a 2FA channel for internet banking.
Some card providers (Amex for instance) do currently provide one time codes for card purchases via SMS, in an attempt to be compliant with PSD2’s Strong Customer Authentication (SCA) rules, but I suspect this’ll change soon because the EBA has already indicated that SMS based SCA is not acceptable[1].
It’s worth remembering that ultimately, SCA or not, banks and do bear liability for fraud not due to the customer’s negligence (in the UK at least), so that’s the ultimate backstop to whatever tech they choose to deploy.
[1] https://www.ensygnia.com/blog/2019/7/11/sca-otc-not-ok-says-...
The eventual democratization of SS7-based attacks was entirely foreseeable. If I were to use plaintext http to access a bank website today, I would be reasonably confident that there would be no immediate problem. But given a year or two of this practice being normalized, the market would find ways to infiltrate consumer ISPs, the bank's upstream, hijack routing prefixes and DNS, etc. And what are text messages but a similar non-e2e protocol? The chief difficulty seems to be that telco standards are hidden away and obscured by horrible complexity, rather than being published as straightforward RFCs.
Duo and all the other 2 factor methods are such jokes. I worked in a hospital that used duo for everything from logging into your workstation to accessing the intranet. Many people had duo set to call their office phone 6 inches from their computer. All someone would have to do is sit down in that desk for 10 minutes, lift the handset and press '1,' and have a field day on protected patient data.
As far as I remember, there will be some sort of "layered" encryption. The innermost layer is the user's payload, end-to-end encrypted between operators. Each service provider (responsible for transporting the data) adds patches with modifications and a signature by the service provider.
Not sure if that actually made it into the standard yet. I think the motivation is that roaming requires cost-effective routing, fraud detection,.. so there's a whole business ecosystem around that.
Long story short: I think people are working on this
It's a bit silly to wait for a completely different radio transport before thinking of carrier and backhaul improvements, which are almost completely orthogonal.
> Long story short: I think people are working on this
Given the specifics of the sorts of flaws in these network standards, it's hard to come away feeling that they were anything short of intentional. I get the impression that “working on it” more or less amounts to improving plausible deniability by making the backdoors less obvious.
Development on radio access and core network does indeed happen in parallel, and as far as I know, the core network overhaul was not delayed to wait for the radio-layer.
But marketing-wise, the radio-layer is what makes the phone show a 5G icon.