A hacker got all my texts for $16

In Australia it&#x27;s mandated you&#x27;re sent a message before rerouting or migrating to another provider. Surprised this isn&#x27;t enforced in the other countries, it costs next to nothing to implement and is just an additional step in the account migration process.<p>I&#x27;d love to see companies allow for opt in additional security measures, like banks or telco&#x27;s calling me - having a verbal password to confirm things, that level of security seems to only be available to VIPs.

SMS is irredeemably broken, like all telco-designed garbage protocols. The only way you can incentivize companies to stop using it as security theater is to shift liability so any losses incurred by SMS jacking is automatically the liability of the company using SMS, just as nowadays any credit card fraud is borne by the company that is not using the EMV chip to secure a transaction.

Reminder: SMS 2FA adds only a negligible amount of security, if your company does 2FA via SMS you&#x27;re doing nothing more than lulling your users into a false sense of security. Don&#x27;t do it. Support proper 2FA. (And while you&#x27;re at it, allow your users to decide how much they care about their account. Don&#x27;t make the decision for them.)

<a href="https:&#x2F;&#x2F;lucky225.medium.com&#x2F;its-time-to-stop-using-sms-for-anything-203c41361c80" rel="nofollow">https:&#x2F;&#x2F;lucky225.medium.com&#x2F;its-time-to-stop-using-sms-for-a...</a>

SMS-2F needs to die. It has absolutely no benefit other than perhaps as protection against credential stuffing.

Voip.ms, vonage&#x2F;twilio, et al let you set up an SMS capable number really quickly and cheaply, available globally... And you&#x27;d be fully in control

Too many services use phone numbers as the keys to the kingdom. It&#x27;s a convenient and stable identifier, but holy shit it&#x27;s not designed for security <i>at all</i>.

It’s worth pointing out that often LOA forms ask for a PIN, usually the same PIN as would be required to check voicemail. A better telecom company might make the PIN something harder to remember but enforcing such things would also make it harder to switch carriers, particularly if it replaced today’s standard forms of ID checks.<p>It’s better to assume that until phone numbers can be locked and unlocked the way domains can, with a random authorization code only accessible by real offline 2FA (though not all domain providers require it), and with the option of completely encrypted end-to-end texting (RCS?), well, then SMS won’t really be all that secure.

Can they do this with a Google Voice phone number? I always hate hearing how I’m basically surviving hacks because of obscurity.

So, when my nontechnical friends ask me what they should be using for 2FA, I&#x27;m kind of at a loss what to tell them. It&#x27;s either a false sense of security (e.g., SMS), or too complicated for them (Yubikey).<p>There&#x27;s got to be a better system.

How do you protect against this type of attack?

It’s insane that providers can do this.<p>I note, however, that this attack seems to only be possible on VOIP routable numbers, and it’s my experience that banks, etc, will not allow you to use VOIP routable numbers for 2FA.<p>That’s definitely not the case for a naive implementation of sms 2fa as would be done by likely any dev using Twilio, etc.<p>Also, don’t forget that NIST deprecated SMS 2FA over 5 years ago. Here’s their reasoning: <a href="https:&#x2F;&#x2F;www.nist.gov&#x2F;blogs&#x2F;cybersecurity-insights&#x2F;questionsand-buzz-surrounding-draft-nist-special-publication-800-63-3" rel="nofollow">https:&#x2F;&#x2F;www.nist.gov&#x2F;blogs&#x2F;cybersecurity-insights&#x2F;questionsa...</a>

Lots of comments here along the lines of &quot;SMS 2FA is bad&quot;, but hell, if the phone companies had an appropriate level of liability here (which should be a shit ton), this should be impossible.<p>And it&#x27;s not just about 2FA, most of humanity expects that if someone else texts them, those texts will go to their phone and only their phone unless they&#x27;ve given explicit verifiable consent.<p>I mean, in this case all the hacker did was fill out a form and say pretty please. I hope phone companies that allow this get sued.

Isn&#x27;t this easy solvable with additional SMS token approval as mentioned in article?<p>&gt; &quot;orsman added that, effective immediately, Sakari has added a security feature where a number will receive an automated call that requires the user to send a security code back to the company, to confirm they do have consent to transfer that number. As part of another test, Lucky225 did try to reroute texts for the same number with consent using a different service called *Beetexting*; the site already required a similar automated phone call to confirm the user&#x27;s consent. This was in part &quot;to avoid fraud,&quot; the automated verification call said when Motherboard received the call. Beetexting did not respond to a request for comment.&quot;<p>But it seems that the entire system is globally infested with security holes. Is this applicable worldwide or just limited to one country ?

Based on the high level description given in the article it seems to be related to enum lookup or net number. It&#x27;s basically a kind of DnS lookup for phone numbers used for sms routing. Also this is used for routing sms that are belonging to a user to an application (in case you want to reroute your sms to an application). The company will change the enum code for the number to a.code that belong to the company and reroute the messages to its services. So the hack is not really a hack in a sense that it work as intendant, the safety net is missing though. The company operating the enum is supposed to check the legitimacy of the change.

That’s crazy that there is no verification system in place allowing the user to approve the forwarding.<p>Years ago I asked my carrier to not port or forward without me being physically present at a store. Maybe I should test them out to see if that’s still the case.<p>Regardless, I don’t use SMS MFA for anything important and even when I do, I have a 32 character password to go along with it.

&gt; While adding a number, Sakari provides the Letter of Authorization for the user to sign. Sakari&#x27;s LOA says that the user should not conduct any unlawful, harassing, or inappropriate behaviour with the text messaging service and phone number. But as Lucky225 showed, a user can just sign up with someone else&#x27;s number and receive their text messages instead.<p>Um, what?!

What I would find really interesting is if someone used this exploit to hack into the accounts of Sakari staff and sabotaged their service, deleting all their infrastructure from their cloud hosting provider etc. I&#x27;m sure Sakari would take this security hole more seriously if their own C-suite fell victim to it.

Weird. The whole idea behind the whole company is to <i>send</i> SMSes on behalf of its customers, if I understood the article correctly. So why would they need to muck about with reassigning the phone numbers of SMS <i>recipients</i> in the first place?

So how to disable the possibility to switch to SMS-Authentication as alternative 2nd token on my Google-Login?

I’ll sell all my texts for $15.

My strategy is to have a second phone that has Authenticator and is also the phone for any SMS based 2FA. The phone is locked in a file cabinet when not in use and never leaves my desk. An extra phone only costs me $10&#x2F;month. Well worth the peace of mind.

The problem is that user does&#x27;nt own his own phone number

FCC obviously needs to come down on this like a ton of bricks.

He can have all mine for a tenner! How do I contact him?

These hackers have so much time in their hands , that they can understand this technology more than the creators and abuse them, amazing how hacker culture works.

Damn lies. Damn lies. The attack vector only works for VOIP or Toll Free Numbers. The upstream agreements already block Mobile numbers. This is paid marketing for his company.

okay so how did he manage to pull this off and is this still possible? how would you protect yourself against this attack (i dont understand how it works)