Security researchers have demonstrated the ease with which a mobile messaging network security flaw can be exploited to take control of users’ online accounts.
The flaw involves the SS7 (Signalling System 7) communications protocol, used to route messages across the world’s mobile networks. The protocol’s insecurity was first disclosed in 2014, and was used to pilfer funds from German bank accounts earlier this year.
Now researchers from Positive Technologies have released a video in which they demonstrate that the flaws are still easily exploitable.
But he noted that the issues with SS7 aren’t the only way attackers can intercept SMS messages, which are considered less secure than device- or application-specific two-factor authentication methods because they’re sent to any device registered to a given mobile phone number.
“Exploiting SS7 specific features is one of several existing ways to intercept SMS,” Kurbatov said in a statement. “Unfortunately, it is still impossible to opt out of using SMS for sending one-time passwords. It is the most universal and convenient two-factor authentication technology.”
For the demonstration, Positive targeted a Coinbase account used to handle Bitcoin and other digital currencies.
They then obtained the Gmail address linked to the target’s Coinbase account and the mobile phone number linked to the two-factor authentication of both the Gmail and Coinbase accounts.
With this information in hand they triggered a password reset for Gmail and intercepted the SMS message sent to verify the action. And once the Gmail account was under their control they triggered a password reset for the Coinbase account, once again accepting an authentication code sent via SMS. They then logged into the Coinbase account and could have emptied it of funds.
For the demonstration’s purposes Positive obtained a mobile operator’s permission to access its network, but hackers would do so by either purchasing a black-market SMS hijack service or attacking the network itself and sending illicit SS7 instructions to reroute messages.
Kurbatov said the technique would work for any account that relies on SMS messages for password recovery.
The use of two-factor authentication is still, however, considered to add a layer of security, and since many service only offer SMS-based two-factor Kurbatov said users can protect themselves by using a separate phone number for receiving security messages.
The attacks in Germany earlier this year used a slightly more complex method that involved sending phishing messages to targets to obtain their bank login credentials.
The thieves then used an SS7 exploit on Telefonica Germany’s network to intercept the authentication messages sent when they carried out a transaction, according to Süddeutsche Zeitung, which reported the incidents in May, citing unnamed sources.
The thefts, which were confirmed by Telefonica Germany, spurred telecommunications and banking representatives to meet in Berlin in April to discuss a solution, the paper reported.
German researcher Karsten Nohl, who initially disclosed the SS7 issues at the end of 2014, last year demonstrated how it could be used to hack into users’ mobile phones, eavesdrop on their calls and determine their location.
Nohl demonstrated the flaw for CBS news programme 60 Minutes in the US by hacking an off-the-shelf iPhone provided by the programme to Representative Ted Lieu, a California politician who’s part of a House of Representatives committee that oversees IT issues.
Provided only with the phone number of the new handset, Nohl, based in Berlin, was able to record Lieu’s conversations, read his text messages and track his movements within districts of Los Angeles.
Do you know all about security in 2017? Try our quiz!
Discover how emerging technologies like AI, blockchain, and edge computing are set to revolutionise industries…
US Federal Aviation Administration approves SpaceX's Falcon 9 rockets to return to service following second-stage…
Social media platform X drops Unilever from lawsuit against advertisers after reaching agreement on 'safety…
US Congressional Representatives ask for answers from AT&T, Verizon, Lumen Technologies after wiretap networks reportedly…
Swedish EV battery start-up Northvolt in talks for 200m euros in short-term funding as it…
US labour officials say Apple illegally restricted employees' right to discuss workplace issues on Slack…