Two-factor security is so broken, now hackers can drain bank accounts
Criminals have exploited a known flaw in how calls and text messages travel around the world to redirect a two-factor code for a person’s bank account.
By Zack Whittaker for Zero Day | May 4, 2017
We’ve known for years that a key protocol that allows global cellular networks to communicate with each other had vulnerabilities — and nobody really took it that seriously.
Hackers and politicians alike have been warning for years that these flaws in the calling and text message routing system, known as Signaling System 7 (SS7), can be used to intercept and redirect calls and text messages, allowing hackers to eavesdrop on almost any phone in the world.
Now, financially driven hackers are using the weakness to intercept text messages that deliver two-factor codes to bank customers to break in and empty their bank accounts, according to a report in a German newspaper.
It’s likely the first known account of the SS7 vulnerability being exploited in the wild by a malicious actor, rather than for demonstrative purposes.
…
“Both the Federal Communications Commission and telecom industry have been aware that hackers can acquire our text messages and phone conversations just knowing our cell phone number,” he added, before urging Congress to hold “immediate hearings” on the matter.
Just last year, the National Institute of Standards and Technology (NIST) said that it would deprecate its advice — albeit, not entirely advise against — for text message-based authentication, because it wasn’t as secure as other forms of two-factor authentication — such as apps, like Google Authenticator and Authy, which use end-to-end encryption to send two-factor codes.
Read the full article here
Further articles on this issue:
Hackers are stealing money from Bank accounts in Germany by exploiting flaws in #SS7 protocol
On SecurityAffairs.co
Is your money safe? Bank hack could affect MILLIONS of customers around the world by intercepting two-step login verification codes
On DailyMail.co.uk
Phone Hack Drains German Bank Accounts
On PCMag.com
