News for hackers. Stuff that matters.

A comment on Can We Stop Pretending SMS Is Secure Now?. Parent comment

Re:Can We Stop Pretending SMS Is Secure Now? by BillinghamJ on Wednesday March 17, 2021 @05:34AM (#26488603)
No, I'm pretty sure eg SS7 attacks work for most (all?) countries.

This particular issue might be US-specific, but the fundamental security problems of SMS are not US-exclusive

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by wealthyyy on Wednesday March 17, 2021 @05:58AM (#26488809)
This is not a SS7 attack. SS7 attacks doesn't work in practice. Eg A lot of carriers in US are CDMA. GSMA Carriers like AT&T has great firewalls in place to block SS7 attacks.

Further, You can detect SS7 attacks. Major Banks already has measures in place...

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by baybal2 on Wednesday March 17, 2021 @07:27AM (#26489531)
SS7 attacks work in practice.

Any network in existence that has roaming enabled is vulnerable to fake roaming requests, and they cannot be "firewalled."

Seeing you implying that CDMA is somehow more resistant than GSM means you know very little how cell networks work. The telephony layer for both is SS7.

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by wealthyyy on Wednesday March 17, 2021 @07:55AM (#26489795)
The Banks already has anti fraud detection systems in place to detect Roaming attacks. They can see whether number is Roaming enabled or not.

The Telecoms do prevent it with Firewalls.

As for CDMA, Please see,

https://www.wyden.senate.gov/imo/media/doc/Verizon%20SS7%20L...

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by baybal2 on Wednesday March 17, 2021 @07:57AM (#26489824)
Banks cannot see if a number is in roaming or not, unless the phone company explicitly tells them through some means.

I so far never heard of anything like this.

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by wealthyyy on Wednesday March 17, 2021 @08:02AM (#26489862)
How come you forget about HLR?

Banks can see. There are lot of APIs on the web that provides this capability.

One example,

https://www.messagebird.com/lookup/

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by baybal2 on Wednesday March 17, 2021 @08:04AM (#26489886)
That looks more interesting. Never heard of such APIs being sold for more than a single operator.

How many operators in the world sell them this access?

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by wealthyyy on Wednesday March 17, 2021 @07:58AM (#26489831)
https://positive-tech.com/products/signalling-firewall/

Please try attacking this Firewall.

[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by baybal2 on Wednesday March 17, 2021 @08:04AM (#26489876)
Are you working there?
[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by wealthyyy on Wednesday March 17, 2021 @08:08AM (#26489921)
No. I've tested it anyway.
[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by baybal2 on Wednesday March 17, 2021 @08:09AM (#26489930)
You still sound as if you are working in the industry. Are you?
[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by nulbyte on Wednesday March 17, 2021 @07:32AM (#26489573)
Isn't it? SMS relies on SS7 to exchange messages. It may not be a direct attack on the network itself, but because of outside dependencies and a history of telcos trusting themselves to get it right (or simply not caring when it's wrong), this attack successfully results in messages getting routed elsewhere on the network.
[ Parent | on HN ]
Re:Can We Stop Pretending SMS Is Secure Now? by wealthyyy on Wednesday March 17, 2021 @07:57AM (#26489820)
This attack is based on a Routing network not SS7.

CDMA carriers don't use SS7 for SMS unless you're on Roaming.

[ Parent | on HN ]