Carrier injecting ads into SMS '2FA' texts

https://9to5google.com/2021/06/29/google-verification-code-sms-ad/

by exabrial • 5 years ago

69 76 5 years ago

exabrial• 5 years ago

I hope Apple, Google, et all will step using SMS as required 2FA, or regulation comes down the pipeline to eliminate this practice.

amichal• 5 years ago

NIST attempted to indicate SMS was not usable for 2FA sometime in 2016. Since other methods were not common yet (and maybe because banks had just barely gotten SMS 2FA deployed?) they were pressured to "soften" their recommendation.

Their followup blog post https://www.nist.gov/blogs/cybersecurity-insights/questionsa...

Edit: https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB

    5.1.3.3 Authentication using the Public Switched Telephone Network
    Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10. If out-of-band     verification is to be made using the PSTN, the verifier SHALL verify that the pre-registered telephone number being used is     associated with a specific physical device. Changing the pre-registered telephone number is considered to be the binding of a new     authenticator and SHALL only occur as described in Section 6.1.2.
    
    Verifiers SHOULD consider risk indicators such as device swap, SIM change, number porting, or other abnormal behavior before using the PSTN to deliver an out-of-band authentication secret.

atatatat• 5 years ago

Good to know even they're toothless, now..

rocqua3• 5 years ago

That blog post was really interesting. I'm going to save it for future reference.

bagacrap• 5 years ago

not only does Google not require 2fa, it offers multiple other methods of 2fa besides sms

lotsofpulp• 5 years ago

Google does not require SMS 2FA. Not sure if Apple does, they prefer to use other devices logged into iCloud as 2FA.

tyz10• 5 years ago

The purpose of most 2FA schemes is not to secure things, but to get a unique identifier of the user.

The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. Of course, since cloud providers constantly have security holes and leak databases, perhaps 2FA is for covering up their bad practices, too.

ascagnel_2• 5 years ago

2FA is more to protect users from phishing attempts than for securing a database, at least in my view. If you fall for a phishing attempt, it means your attacker will need to take the extra step of breaching/replicating your 2FA setup, and the service provider can note the login attempts and notify you (giving you a chance to change your password, rendering the result of the initial attack unusable).

2FA is not for securing a database -- salted+hashed passwords do that.

perryizgr83• 5 years ago

2FA is more to protect users from phishing attempts

Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password.

My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam.

So I feel 2FA is worse than useless for preventing phishing attempts.

UncleMeat3• 5 years ago

2FA only prevents phishing if you are using something like a yubikey. The phisher can just ask for your SMS code or your TOTP code. You can go buy tools that completely automate this on the black market.

robjan• 5 years ago

Most people recycle passwords. You can say they are doing the wrong thing but it's the reality. When that recycled password inevitably gets pwned, 2FA makes the account more secure.

dragonwriter• 5 years ago

The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine.

Yes, but its very hard to enforce a requirement that a password actually be random; meanwhile, it is very easy to enforce the use of 2FA.

rocqua3• 5 years ago

The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine.

There isn't a 2FA craze. There is a slow and painful acceptance from companies that 2FA is one of the more effective things they can implement. It is slow and painful because the login logic is threaded throughout most organizations. Moreover, it requires changing how all users work, and that always meets a lot of resistance.

Despite all that, it is still growing. That is because password stuffing and password stealing are rather effective, and the number 2 cause of most infections (with the leading issue being phishing mails). 2FA, in one stroke, protects against these measures. It means password re-use by your users (which is inevitable) is a much lower risk. It means shoulder-surfing and keylogging are much lower risk.

2FA is one of the most effective security controls.

UncleMeat3• 5 years ago

for most applications a random password with length 16 would be completely fine

Yes. If we could figure out how to actually get people to do this universally we'd be in good shape. But nobody knows how to make this happen at scale.

metalliqaz• 5 years ago

Previously on HN: https://news.ycombinator.com/item?id=27679433

matheusmoreira2• 5 years ago

Is there some kind of limit to how obnoxious advertisers can become?

dylan604• 5 years ago

I would suggest watching Black Mirror to see that the answer is no

matheusmoreira2• 5 years ago

One million merits is my favorite black mirror episode.

tialaramex4• 5 years ago

Effective regulators can deliver such limits. For example, Americans are used to obnoxious TV adverts for medicines they don't need and financial investments that are a bad idea, because their regulator says that is OK. In many countries neither of these would be allowed, the TV channel and the advertiser might be fined so they wouldn't even try.

This needn't be too expensive if done right. The ASA in the UK (which regulates print advertising, billboards, that sort of thing) is not the government, it's funded by the advertising industry itself under the threat that the government might find it easier to just outlaw whole swathes of their industry if they get out of hand. So ASA "rulings" are like a slap on the wrist from your mother in two senses. They seem like a big deal if you didn't realise what you were doing is naughty, but also, if you're intentionally naughty enough because you know there aren't real consequences just a slap on the wrist, the next step may be you're off to jail instead. Some advertisers will deliberately do something that gets negative attention, knowing they'll get free secondary advertising from press coverage of a "ban" and the ASA is no big deal, but even if they stray over the lines it's pretty clear where those lines are.

reportgunner• 5 years ago

If there was, we would have already hit it.

tyleo2• 5 years ago

Google (who isn’t at fault) is named like 5 times in the Twitter thread. At a glance it as though they are to blame even though further reading shows they aren’t. Despite this, the carrier is kept anonymous? Strange.

ajsnigrutin5• 5 years ago

Yep.. naming and shaming the carried should be the first thing in the article. They'll probably disable this feature, apologize, and act as if they did nothing wrong.

newnamenewface2• 5 years ago

The carrier hasn't been shared with the reporting website so far as I can tell.

bluesign4• 5 years ago

Google is to blame though. They are sending sms over a 3rd party which is probably using some shady service on that country for sms termination.

They are avoiding carrier termination fee, basically being cheap.

Google has power to by contract force third party to make deals directly with carriers.

If I charge my clients on my website with some shady CC processor and they are scammed, everyone would blame me.

rtpg• 5 years ago

is this known? It kinda sounds like the carrier might be the one doing this

downrightmike• 5 years ago

Seems like a smear campaign. Like the carrier figured out they could and are using it to make google look bad for some reason.

iNane90002• 5 years ago

It’s a canary. Gmail isn’t secure. People need to know that.

signal112• 5 years ago

SMS 2FA is an antipattern. Many people know this, but it's not percolated down to everyone just quite yet.

tyleo2• 5 years ago

I don’t know. It is maybe not as secure as possible but it is certainly more secure than a password.

I think it’s a baby step. I see other threads under the parent comment recommend banning SMS 2FA altogether. Surely this would be a step back. I suspect most people and companies would think, “well, I guess we won’t do 2FA anymore” rather than, “I guess we will use a proper Authenticator instead”.

meowster3• 5 years ago

it is certainly more secure than a password.

I disagree. I can safely store a long, complex, and unique password. I cannot prevent anyone from social engineering my cell phone service provider and doing a SIM swap.

signal112• 5 years ago

You're just thinking of security -- and there are many valid concerns around using SMS-based cleartext messages as a 2nd factor.

But additionally, a big issue is reliability of the 2FA mechanism. Especially when your service provider is overseas, or you're roaming, the SMSes may simply not arrive in time.

ajsnigrutin5• 5 years ago

It's better than just a password. Not perfect, but works 99% of the time (eg with password reuse, dumb keyloggers, over-the-shoulder spying,...)

stavros4• 5 years ago

It is not better than just a password (in fact, it is worse). Providers have been known to reset accounts with just SMS 2FA, and passwords are harder to steal than SIMjacking.

rocqua3• 5 years ago

There is a real risk to giving a company your phone-number for SMS 2FA. That is that the company might, at some point, use the SMS as a single factor. This has happened a few times, sometimes it requires social engineering. In general, the risk is there.

Combine this with the time Facebook started using the mobile phone number for more than just 2FA (suggesting friends IIRC), and there is a decent argument for preferring plain password over enabling SMS 2FA.

donkarma• 5 years ago

How is 2 factor authentication 2 factor when I can reset my password with just my phone number?

meepmorp2• 5 years ago

That's a policy issue, not specific to SMS; it's no different than getting someone to reset your password over the phone with poor ID validation.

SMS 2FA is shitty for unrelated reasons.

rsync• 5 years ago

"SMS 2FA is an antipattern. Many people know this ..."

Much SMS 2FA in the world is used not for your security but to solve the difficult problem of spam/scam/sockpuppet accounts.

Of course it is labeled as being for your security but it's not about that at all.

Bad actors are relentless and forcing them to burn a SIM chip any SIM chip to participate at least slows down the onslaught.

UncleMeat3• 5 years ago

SMS 2FA is equally as resistant as TOTP to phishing (basically not at all). It is also considerably more accessible. Phishing is a much much much bigger concern than SIM-swapping, since it scales easily. Using SMS 2FA instead of TOTP does not change your risk that much.

I'd buy these complaints much more easily if people actually mentioned this stuff when TOTP comes up. But they don't.

The only meaningful jump in security is when moving to a yubikey or equivalent.

baybal2• 5 years ago

Google appends a very easily identifiable per-app random string, which was probably somebody's dream to farm 2FA codes.

By making 2fa codes per-app identifiable, the situation was only made worse.

dmitryminkovsky• 5 years ago

The advertisement — for a VPN — includes a quick message and short URL.

~ Amazing ~

hashtag-til• 5 years ago

Somebody else in the same twitter thread named the carrier as 'boost' (which I never heard about).

https://twitter.com/saltajose/status/1410538739588292609

viro• 5 years ago

if its boost moblie I can't say im very surprised. basically tracfone level trash

smoldesu• 5 years ago

"I'm electing not to state the carrier for privacy reasons"

Cool, so this entire brouhaha was for nothing? You just wanted to pistol-whip Google for something they had nothing to do with, and then you're refusing the publicly persecute the real bad actor?

Carrier injecting ads into SMS '2FA' texts

Related Stories