> For companies which should be putting security at the centre of their business, they apparently have no idea that they're normalising phishing.

Yeah, this appears to have stopped, but was somewhat common a few years ago. My standard response was 'you called me, tell me who you are and I will call back on the official line'. They couldn't object to that. It was obviously some plan to 'ensure user privacy' that once it became known to one or two people with the authority to do something about it and the knowledge to know better it was quashed.

Now if only they would allow you to enable 2FA options that aren't SMS and also disable SMS. They don't understand that SMS is a terrible 2FA system isn't mitigated by 'but you can enable other things' if you cannot remove SMS as an option.

I didn't know that. What makes SMS a terrible 2FA? (other than the fact that you can lose your phone, but that's true for any "have" factor)

"SMS-transmitted OTPs are susceptible to a variety of attacks. One is by obtaining control of a target’s cell phone number, often by calling the cellular provider or going into a retail store of the provider and impersonating the subscriber. In 2016, the chief technology officer of the US Federal Trade Commission had her number hijacked this way. In other cases, the interception is the result of compromising the mobile account because it’s protected by a password the subscriber used on a different site that was breached. Still other interceptions are the result of exploiting decade-old weaknesses in the SS7 routing protocol that carriers around the world use to ensure their networks interoperate. OTPs are also vulnerable to phishing and social engineering attacks, as long as the attackers enter the codes quickly after obtaining them."

* https://arstechnica.com/information-technology/2017/05/thiev...

* https://arstechnica.com/information-technology/2018/08/passw...

This is something I still cannot understand, in the sense that usually the procedure is the following, at least with my bank (that uses SMS OTP):

On the website:

1. you input a user ID

2. you input a password or PIN

3. you press a button that sends a SMS with an OTP code to the registered cellular number

4. you input this OTP code on the site

Even if someone can intercept the SMS, they wouldn't (shouldn't) have ID and PIN.

For one thing, there are a lot of security holes that let people reset passwords by getting a code via SMS

For another, what's the point in having 2FA if one of the factors is completely insecure? It's just an annoyance at that point, and a good way to ... tie your account to your phone number, which just coincidentally happens to be the primary key for most advertising tracking services. What a coincidence

You build a fake website. The victim enters their ID and password. The fake website asks for the SMS TAN. The victim gets an SMS from the actual bank and enters the TAN. Profit.

It doesn't have any security benefit for phishing like this, it's just one additional password input field.

Sure, but in this case, like in many "phishing" schemes, there is no interception of the SMS, this same approach applies to all other authentication tokens, as it is the victim that enters the OTP on the (fake) site or communicates it to the phisher who calls impersonating a bank employee.

> this same approach applies to all other authentication tokens

Not true. FIDO and prevents this. The key is bound to the site you authorized it on, so inputting the key while connected to a phishing site will do nothing.

* https://www.yubico.com/authentication-standards/fido-u2f/

Yes, I meant those (I believe much more common) various hardware token generators and those "in-app" ones (issued by the bank), that end up as a 6 or 8 digits that you have to type on the site.

By that logic, you don't need an OTP code at all, because your adversary "shouldn't" have your password or PIN.

The entire point of two-factor authentication is to provide an extra layer of security for when the first layer is compromised.

I think the logic is the same.

Having the possibility/capability of intercepting the SMS is only effective if the ID and PIN are already known, and while surely there are "other" ways to get them, the attacker needs all three.

From what I have read/seen, most if not all successful attempts to access someone else's bank account online go through some form of phishing.

Not only phishing, but too many people have the terrible habit of using the same password everywhere. So with public breach data, it's not a stretch to think bad actors would try, and probably be successful way too often, to use said credentials on bank sites.

Assume for all these attacks that the user has been first thoroughly keylogged via malware or had all static credentials stolen first via leak or phishing.

The SIMjacking is the last barrier to access.

In most cases people reuse passwords and their login/password are known via any number of a million dumps of large websites whose dbs have been breached.

how easy it is to sim swap, you can go to any phone store and unless the manager at the location is competent, you can get a new line in a persons name or a new phone with an old number. Its incredibly easy and you can read a lot of them happening in krebs website

Now if only they gave me a real 2FA option that doesn't actually decrease security. So they made a fancy app where I need to confirm PC logins with a 5 digit pin. But the same app is also their official banking app and lets me do everything with my account, all with the same 5 digit pin. I don't even need to enter the credentials necessary on the PC. This is what you get when the government tries to mandate security.

> This is what you get when the government tries to mandate security.

The NIST actually has great guidelines for digital identity authentication:

* https://pages.nist.gov/800-63-3/sp800-63-3.html

Don't blame the government -- they outlined an ideal way to do it on many levels of need. Blame the specific people who implemented that specific system.

Banks in the UK used to get you to enter a PIN on your phone keypad to authorise them (different PIN from your ATM cards!). I pointed out to the call handler one day that when I entered my PIN I could still hear background noise from his open mike, and did that mean he could hear what I typed?

"Yes, I hear you typing in the PIN"

Oho, but that's a bit of security hole, isn't it?

"It's just beeps though, I can't tell what you typed"

Yeah but someone suitably skilled *could*, is my point!

"Yeah but it's just beeps, like this <beep beep beep beep>"

Okay and you typed 1 3 5 8.

"Uhhh... oh. Yes, I did. Uh, how did you do that?"

I've got an ear for it. This is absolutely not a criticism of you in any way and thanks for helping me demonstrate it, but could you get your supervisor to play this call to their manager and get back to me, once we're done with the call?

"Yes, I'll do that"

Awesome! Now these bank transfers...

They didn't call me back, but now call handlers transfer you to a totally different service to put a PIN in.

-> /r/thathappened