Can We Stop Pretending SMS Is Secure Now?

Re:Can We Stop Pretending SMS Is Secure Now? by iscoelho on Wednesday March 17, 2021 @02:23PM (#26494990)

If you've worked in the industry, you know you can get a BGP uplink these days with bare minimum IRR source validation with only a signature on a contract (not even payment is required to turn up generally).

Using this, you can advertise any IP prefix you want. Since a lot of providers advertise /23+ as well, if you hijack the /24, you will always be the BGP best path and will be able to accomplish a full internet-wide hijack.

Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible.

If you are a nation-state, you already have all of the above, and nobody to hold you accountable for using it.

[ Parent | on HN ]

Re:Can We Stop Pretending SMS Is Secure Now? by ryanlol on Wednesday March 17, 2021 @03:04PM (#26495491)

> Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible.

Few weeks? With most providers you can get this done within 24h from the initial email to sales@

[ Parent | on HN ]

Re:Can We Stop Pretending SMS Is Secure Now? by iscoelho on Wednesday March 17, 2021 @04:41PM (#26496528)

Getting the colocation, hardware, BGP uplink, and the creativity involved in not using your identity at all & minimizing (or eliminating) expenses. Possible, but it'll take a few weeks.

[ Parent | on HN ]

Re:Can We Stop Pretending SMS Is Secure Now? by ryanlol on Wednesday March 17, 2021 @09:42PM (#26498937)

You don’t need any of those things, you can just rent a dedicated server (perhaps even a VPS) and send over a LoA and have the host route the IPs to your box.

I’ve never had to deal with colo or think about hardware to have my IPs announce.

[ Parent | on HN ]

Re:Can We Stop Pretending SMS Is Secure Now? by iscoelho on Friday March 19, 2021 @04:33PM (#26517900)

Generally the reason an attacker would do those things is because their hijacks will last much longer due to lack of an abuse department and victims having to contact upstreams.

Shorter ASPath, planning which Tier 1/2 is the best to hijack from, and lack of LOA requirement or RPKI.

If an attacker wants to do this - they don't want to "just" cause damage. This is a limited opportunity. They want to do it right, and that takes planning.

I do agree that your idea is possible, but I don't think it captures the full severity of the issue.

[ Parent | on HN ]