SMS-Based Authentication Is Imploding, Precisely as Experts Predicted

SMS-Based Authentication Is Imploding, Precisely as Experts Predicted

For a relatively long time it seemed as if the password problem had been solved using SMS text messages.

  • By Michael Lynch
  • Jun 22, 2017

For a relatively long time it seemed as if the password problem had been solved using SMS text messages. Forgot your password? Don’t worry, we’ll send you a one-time passcode via text message.

Except there was a problem behind this security technique, one that was well known to security professionals. That is, SMS is not always a secure communication channel. Using vulnerabilities in the mobile data network known as Signaling System 7 (SS7), hackers can intercept, forward, and relay text messages in a few simple steps.

It was only a matter of time before this was loophole was breached in a major way and that’s just what happened when hackers exploited it in Germany recently to drain several bank accounts over the past few months, according to the country’s largest subscription daily newspaper Süddeutsche Zeitung.

According to the report, the scheme was composed of two parts. The first phase involved a fake email (phishing) that tricked people into entering their personal account information, including their mobile phone number, into a lookalike bank website.

Then, armed with this information, the cybercriminals instructed the global communications network, via SS7, to forward all calls and SMS messages sent to the victim’s mobile phone to a number operated by the criminals. The fraudsters could then log into the victim’s bank account, set up a money transfer, and approve it.

Because of the global usage of SS7 to route text messages, the episode has already generated widespread condemnation. On Friday, not long after the news broke, Congressman Ted Lieu of California issued the following statement:

“Everyone's accounts protected by text-based two-factor authentication, such as bank accounts, are potentially at risk until the FCC and telecom industry fix the devastating SS7 security flaw. Both the FCC and telecom industry have been aware that hackers can acquire our text messages and phone conversations just knowing our cell phone number. It is unacceptable the FCC and telecom industry have not acted sooner to protect our privacy and financial security. I urge the Republican-controlled Congress to hold immediate hearings on this issue.”

The Writing Was on the Wall

Like the iceberg that hit the Titanic, this is a problem that should have been anticipated long before it happened. The warning signs were already there. Last year the National Institute of Standards and Technology specifically recommended against the use of SMS in multi-factor authentication (MFA).

Despite these warnings, why have so many organizations continued to use SMS to secure their communications and websites? Until now, there was no real alternative. The sending of one-time passcodes through separate communication channels (referred to as “out-of-band” communication) like SMS was considered best practice because it made fraud more difficult.

But, as the German hack demonstrated, not impossible. The SMS system was vulnerable to social engineering and “man-in-the-middle” attacks (as done in the two-prong attack) in addition to malware and other means of compromise. For this reason, organizations need to refrain from sending information through SMS that contains sensitive information and transaction-specific information.

This type of out-of-band security overlooks the possibility to leverage the inherent and superior security found in dedicated mobile apps. These apps, unlike SMS, rely on tokens and end-to-end encryption to create a secure environment to communicate and perform transactions. Further, when these encrypted communication channels are coupled with authentication software, the device itself can acts as a trusted token and make all communication 100% secure. This method eliminates reliance on insecure third-party messaging systems, like SS7, to handle sensitive information, and guarantees only the intended device can receive and read the message.

The silver lining to this high-profile incident is it appears it may be the wake-up call for the industry that alerts the larger public to the danger. And, hopefully, this awareness will prompt a widespread migration towards closed loop communication channels through dedicated mobile apps. Financial organizations can no longer afford to take a “wait and see” stance in moving away from SMS and instead should take advantage of new ways to push notifications, step up challenges, or at the very least ensuring defense in depth with other layers of defense when SMS is the only available option. It’s clear what the financial and reputational implications are.


Featured

  • Survey: 48 Percent of Worshippers Feel Less Safe Attending In-Person Services

    Almost half (48%) of those who attend religious services say they feel less safe attending in-person due to rising acts of violence at places of worship. In fact, 39% report these safety concerns have led them to change how often they attend in-person services, according to new research from Verkada conducted online by The Harris Poll among 1,123 U.S. adults who attend a religious service or event at least once a month. Read Now

  • AI Used as Part of Sophisticated Espionage Campaign

    A cybersecurity inflection point has been reached in which AI models has become genuinely useful in cybersecurity operation. But to no surprise, they can used for both good works and ill will. Systemic evaluations show cyber capabilities double in six months, and they have been tracking real-world cyberattacks showing how malicious actors were using AI capabilities. These capabilities were predicted and are expected to evolve, but what stood out for researchers was how quickly they have done so, at scale. Read Now

  • Why the Future of Video Security Is Happening Outside the Cloud

    For years, the cloud has captivated the physical security industry. And for good reasons. Remote access, elastic scalability and simplified maintenance reshaped how we think about deploying and managing systems. Read Now

  • UL Solutions Launches Artificial Intelligence Safety Certification Services

    UL Solutions Inc., a global leader in safety science, today announced the launch of artificial intelligence (AI) safety certification services, enabling comprehensive assessments for evaluating the safety of AI-powered products. Read Now

  • ESA Announces Initiative to Introduce the SECURE Act in State Legislatures

    The Electronic Security Association (ESA), the national voice for the electronic security and life safety industry, has announced plans to introduce the SECURE Act in state legislatures across the country beginning in 2025. The proposal, known as Safeguarding Election Candidates Using Reasonable Expenditures, provides a clear framework that allows candidates and elected officials to use campaign funds for professional security services. Read Now

    • Guard Services
Most   Popular

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.