> Due to the risk that SMS messages may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out of band verification is to be made using a SMS message on a public mobile telephone network, the verifier SHALL verify that the pre-registered telephone number being used is actually associated with a mobile network and not with a VoIP (or other software-based) service. It then sends the SMS message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change. OOB using SMS is deprecated, and may no longer be allowed in future releases of this guidance.
So they are finally admitting that SS7 is a huge security problem to the point they have to recommend everyone not to use it for 2FA anymore....but they are not going to try and fix SS7.
It's not just the technical problems with SS7 - it's a business issue.
The Telco's prime motivations are to make it easy for their customers to make more calls and send more text messages - that's what make them money. Making it difficult to port phone numbers away from competitors, or making it difficult for customers to redirect phone calls or text messages is bad for business, and will lose them customers and/or increase customer support costs.
There's absolutely no upside to a Telco for doing any of that - they don't really care if that makes their product less secure for use-cases other 3rd parties who aren't paying the Telco - the Telco's never signed up to provide a secure channel for your bank to send secrets to you - and the banks aren't offering to pay them for it. The Telco's customers are paying, and to an overwhelming degree they demonstrate that they prefer convenience over security - you get pissed off and potentially change carriers very quickly if you cant call them up from a friend's phone when yours get broken/stolen and get your calls/texts redirected to another number immediately. The fact that that same ability give access to social engineers to get hold of banking pins and internet service 2fa secrets is a vanishingly small concern for the people paying the Telco's.
So they just don't care. Not their problem. Sucks to be a bank.
My idea is get rid of minutes and text and simply have data on your phone. Then you can use the call/sms service of your choice to provide those features over https. Basically unbundle the whole deal. The carriers would never go for it but I think it would work.
I've got a nephew who sort-of does that with an iPod touch. It doesn't even have a cellular data connection - he relies on glomming on to free wifi at school/home/friend's houses/the library/the shopping mall/wherever, and gets iMessage and Skype only when he's got wifi - which is "good enough" for him to not even bother upgrading to a phone with a pre-paid account... (He's even managed to convince his Mom to leave the wifi hotspot on her phone running all the time, so he can make/receive calls in the car...)
SS7 attacks get a lot of news coverage but they still aren't practical for most non-government attackers. What generally happens is that they trick the phone provider into issuing them a new SIM card for the account or redirecting the number to one they control.
Also, TOTP is kind of secure if you never log into the website from the device that has the authenticator. Otherwise, it is pretty vulnerable to attacks that target the client.
IMO the real issue here is that almost all websites consider that email is a good way to verify the identity of someone when they want to reset their password, while in reality email is a terrible medium. Attacks on the DNS work, and a lot of SMTP traffic is still plaintext. The way to secure email is to encrypt and sign at endpoints but of course websites don't do this in the reset password flow.
Comments
Well, it's not recommended:
Source: NIST (https://pages.nist.gov/800-63-3/sp800-63b.html)
http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...
The telco industry tells the banking industry not to consider SMS secure...
So they are finally admitting that SS7 is a huge security problem to the point they have to recommend everyone not to use it for 2FA anymore....but they are not going to try and fix SS7.
It's not just the technical problems with SS7 - it's a business issue.
The Telco's prime motivations are to make it easy for their customers to make more calls and send more text messages - that's what make them money. Making it difficult to port phone numbers away from competitors, or making it difficult for customers to redirect phone calls or text messages is bad for business, and will lose them customers and/or increase customer support costs.
There's absolutely no upside to a Telco for doing any of that - they don't really care if that makes their product less secure for use-cases other 3rd parties who aren't paying the Telco - the Telco's never signed up to provide a secure channel for your bank to send secrets to you - and the banks aren't offering to pay them for it. The Telco's customers are paying, and to an overwhelming degree they demonstrate that they prefer convenience over security - you get pissed off and potentially change carriers very quickly if you cant call them up from a friend's phone when yours get broken/stolen and get your calls/texts redirected to another number immediately. The fact that that same ability give access to social engineers to get hold of banking pins and internet service 2fa secrets is a vanishingly small concern for the people paying the Telco's.
So they just don't care. Not their problem. Sucks to be a bank.
Isn't migrating to a pure LTE network a legitimate option to fixing SS7 ?
Not that I think we'll be rid of SS7 even a decade from now, but there is a reasonable path to take, yes ?
My idea is get rid of minutes and text and simply have data on your phone. Then you can use the call/sms service of your choice to provide those features over https. Basically unbundle the whole deal. The carriers would never go for it but I think it would work.
I've got a nephew who sort-of does that with an iPod touch. It doesn't even have a cellular data connection - he relies on glomming on to free wifi at school/home/friend's houses/the library/the shopping mall/wherever, and gets iMessage and Skype only when he's got wifi - which is "good enough" for him to not even bother upgrading to a phone with a pre-paid account... (He's even managed to convince his Mom to leave the wifi hotspot on her phone running all the time, so he can make/receive calls in the car...)
SS7 attacks get a lot of news coverage but they still aren't practical for most non-government attackers. What generally happens is that they trick the phone provider into issuing them a new SIM card for the account or redirecting the number to one they control.
TOTP is overall more secure, but if Kenneth had used TOTP in this case, he would not have found out about the attack.
Also, TOTP is kind of secure if you never log into the website from the device that has the authenticator. Otherwise, it is pretty vulnerable to attacks that target the client.
IMO the real issue here is that almost all websites consider that email is a good way to verify the identity of someone when they want to reset their password, while in reality email is a terrible medium. Attacks on the DNS work, and a lot of SMTP traffic is still plaintext. The way to secure email is to encrypt and sign at endpoints but of course websites don't do this in the reset password flow.
Yes, yes NIST has many recommendations, and technically SMS is insecure.
That said, many websites use a Twilio two-factor integration and don't support anything else. If that's the case, you should still use it.
Yep, I've witnessed telco's being social engineered to forward numbers for attackers to intercept SMS messages.