Scammers Work Around Two-Factor Authentication With Social Engineering 186
mask.of.sanity writes "Thieves have made off with $45k after they intercepted a victim's two factor online banking codes used to verify large transactions. The scammers got the Australian executive's mobile number from his daughter, and work place details from his willing secretary. Armed with this data, they bluffed Vodafone which ported his phone number, meaning the criminals could verify the bank's two factor verification codes generated during their spending spree and the victim never knew a thing."
Account security (Score:5, Insightful)
This just goes to show that you should always have additional protections in place for protecting accounts (in this case, a mobile number) that can be used to control, secure, or otherwise materially modify other important accounts.
Re:Account security (Score:5, Insightful)
A Hardware Token (such as RSA Securid) would have prevented TFA's fraud. SMS is clearly not a good replacement for real Two-Factor authentication, though it is cheap for the banks to implement compared to other options.
Re:Account security (Score:5, Insightful)
SMS is clearly not a good replacement for real Two-Factor authentication
Two-factor auth isn't a panacea. SMS (or rather, mobile numbers) are real two-factor authentication - or, more accurately, they are a valid second factor. Something you know, something you have, something you are - pick any two. Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.
The fail at this point wasn't that the bank implemented security poorly - it's that the Telco did. They didn't even have one-factor authentication. They asked for two points of information - customer number and DOB - neither of which can reasonably be considered a secure secret. Even then, the Telco is following the process that it has been mandated to follow by the government - including the data that should be used to verify identity. If the government are going to mandate requirements for business processes, then they should either be damn sure what they're mandating is secure, or they should explicitly leave security implementation up to the business.
Re:Account security (Score:4, Insightful)
Two-factor auth isn't a panacea. SMS (or rather, mobile numbers) are real two-factor authentication - or, more accurately, they are a valid second factor. Something you know, something you have, something you are - pick any two. Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.
It sure does. You might say it's the Telco's fault for allowing the service churn to happen, but this lack of security is widely known which makes the SMS as a second factor all but useless, and the banks are stupid for allowing it.
Re:Account security (Score:5, Interesting)
Two-factor auth isn't a panacea. SMS (or rather, mobile numbers) are real two-factor authentication - or, more accurately, they are a valid second factor. Something you know, something you have, something you are - pick any two. Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.
It sure does. You might say it's the Telco's fault for allowing the service churn to happen, but this lack of security is widely known which makes the SMS as a second factor all but useless, and the banks are stupid for allowing it.
You are confused. SMS to your mobile IS TWO FACTOR AUTH. just because it sucks doesn't make it not two factor auth. Besides when directly targetted there are very few good two factor auths that are practical that can't be defeated by a well targetted scam such as this. RSA/Vasco tokens can be stolen as can Smartcards or USB keys and when you are talking about scams in the amount of this article then the theft of a token isn't that much of a reach either. It isn't like it takes long to empty a bank account.
Re: (Score:3)
You are confused. SMS to your mobile IS TWO FACTOR AUTH
you said "Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.". I said "It sure does". I wasn't disputing that password+mobile number was two factor auth, I was disputing that it was a reasonable choice.
I may be a bit out of date here but I thought that sniffing an SMS wasn't really that difficult for a sufficiently motivated criminal... but maybe it's sufficiently difficult with today's 3G networks? Last time i checked mo
Re: (Score:2)
It sure does. You might say it's the Telco's fault for allowing the service churn to happen, but this lack of security is widely known which makes the SMS as a second factor all but useless, and the banks are stupid for allowing it.
Google promotes it as well - is it okay to call them stupid in this case, or do we still give them a pass?
Re: (Score:2)
The phone number isn't something you have. It's something that anybody could have.
Re: (Score:2)
The same could be said about anything. The seed for your token generator isn't something you have - it's something anybody could have.
Re: (Score:2)
The seed for your token generator isn't something you have - it's something anybody could have.
Err, how? (Besides physically stealing your token generator, I mean)
Re: (Score:2)
It all depends on the security of the authority that issued you your generator - much the same as your mobile number. If they hand out your generator seed willy-nilly - the way telcos appear to do for mobile number porting requests - you're just as vulnerable.
The issue here isn't that the technology wasn't good enough, it's that the trusted authority shouldn't have been trusted.
Re: (Score:3)
They could get the serial number off your token generator and compromise the token provider's database. I've replaced token generators with software token generators in the past to streamline helpdesk operations, we had a database full of the token keys. If that got compromised, it would be bad.
Re: (Score:2)
I'm confused, are you saying the whole token system is poorly designed? The database should only contain the public key equivalents for the physical token generators. The private key equivalent data shouldn't exist anywhere outside the key-fob.
(It's like you're saying stealing the password file would give you remote access to a UNIX system, without further decryption/password guessing)
Something you... (Score:2)
Something you know, something you have, something you are - pick any two.
I thought it was something you forgot long ago, something you just had stolen, something you were before they beat the shit out of you and started cutting body parts off.
Re: (Score:2)
Security is inconvenient, if a business implements tougher security than its competitors then users will flock to the more convenient competitors...
Losing customers in this way has been judged to cost more than the resulting fraud from weaker security, and so this is how its done.
Re: (Score:2)
Unfortunately zero banks in the US (or Australia) offers SecurID. PayPal does, but they don't really offer modern bank features, like bill pay or check/"cheque" writing, and the average bank wouldn't want to support such a thing, because there's no demand and it would intimidate customers -- irrationally, but so what? You'd need a bank reg.
Stories like this make me want to put all my money in Bitcoins. I HATE the whole Bitcoin concept and think its a crock, but with a Bitcoin at least I'm in charge of the s
Re: (Score:2)
Unfortunately zero banks in the US (or Australia) offers SecurID
I've had a token (not RSA but equivalent) for years for my bank account in Australia.
Re: (Score:2)
Maybe I spoke too soon.
Re: (Score:2)
I'm an HSBC customer in the US, after scouring their site I can find no mention of tokens or SecurID. It's annoying.
Re:Account security (Score:5, Informative)
Re: (Score:3)
Re: (Score:2)
Both HSBC Australia and the Bendigo Bank offer hardware tokens.
Re: (Score:2)
Erm there's many banks that offer SecurID in Australia:
Suncorp
Westpac
NAB
ANZ
Commonwealth Bank offer them to limited customers only.
As for the US I think Citigroup uses them too.
Re: (Score:2)
Re: (Score:2)
Well, not RSA, some other form of token where the customer (in this case the bank) keys it themselves.
The idea of buying a token that's already loaded with key material is an epic fail, as proven by RSA when they got owned a few months ago.
Re: (Score:3)
This just goes to show that you should always have additional protections in place for protecting accounts (in this case, a mobile number) that can be used to control, secure, or otherwise materially modify other important accounts.
I agree, but the average person does not unfortunately.
The average person will view this as the bank trying to get in the way of them and their money. In Australia there will be huge sensationalised reports about the EVIL BANKS stealing from hard working Aussie battlers and keeping all that dastardly profit for themselves where as in reality, the new security measures cost more to implement but the real problem is Bazza from Frankston is too dumb and lazy to learn how to keep his cash secure.
So the sy
Re: (Score:2)
Given how much is being linked to a cellular number, I actually would support making number portability more difficult (in that securing a process almost always makes that process more difficult/complex).
Unfortunately, politicians seem to swing from one extreme to another with little in between, so any regulations mandating increased security are likely to either be completely ineffective or much more inconvenient than necessary.
Something like SIM registration seems like it would go a long way toward combat
Re: (Score:3)
Given how much is being linked to a cellular number, I actually would support making number portability more difficult (in that securing a process almost always makes that process more difficult/complex).
Something like SIM registration seems like it would go a long way toward combating this sort of hijacking, and should be relatively easy to implement.
We've go the same problem as with the banks. After banks and speed cameras, telco's are the favourite targets of the sensationalist bollocks brigade.
Any move to make it more secure will be met with scorn and venom from anyone who doesn't want to understand why it's happening. Right between signing up for the Vodafail page and complaining about how bad their teclo is.
Re: (Score:2)
Considering my mobile number was previously registered with Vodafone in my mums name (at the time I signed up, I didn't have enough credit history to get a postpaid plain in my own name) and I was recently able to switch it from Vodafone to TPG Mobile without either entity seeing any kind of actual ID (and I dont remember providing ID when I first signed up to TPG for ADSL either) I doubt that there are as many requirements on getting a SIM card as there should be.
Re: (Score:2)
Last time I ported a number between UK carriers I was sent several text messages to each phone.
It used to be that you couldn't start the process until you'd received a letter with a code (PAC - Porting Authorisation Code), but they were happy to tell me the code over the phone.
(But anyway, my bank uses the encryption key stored on my debit card to authorise similar transactions.)
Not Thieves (Score:4, Funny)
They didn't steal anything real.
I don't believe in imaginary property.
Re:Not Thieves (Score:4, Funny)
I don't believe in imaginary property.
Please send me all your money, via wire transfer. Thank you.
Re:Not Thieves (Score:5, Insightful)
Whoosh!
Money stored electronically at the bank is one of the classic counterexamples to the belief that all property is (or should be) tangible. The GP is taking a dig at people who subscribe to this view.
Re: (Score:2)
Money stored electronically at the bank is one of the classic counterexamples to the belief that all property is (or should be) tangible
You mean the kind that gets inflated away to worthlessness?
Re: (Score:2)
Yeah, the same as the little slips of paper-cotton blend and the hunks of worthless metal that represent their physical counterparts.
Re: (Score:2)
Yes indeed, the kind that has never once inflated away to worthlessness.
But, if you disagree, I'd be happy to trade my 12 year old car for, oh let's say, 100,000 of those worthless, electronically-stored dollars? Think about it; you give me some worthless, replicable data, and I give you something that will give you at least a year's worth of transport. It's a positive bargain!
Re: (Score:2)
Can you give me an explanation as to why you would make that demand (you could be jeopardising your free car)? For a worthless piece of data, you seem awfully possessive of it.
That's fair enough. Could you tell me why you should get any control whatsoever of this piece of data which is stored on the bank's private property? Why shou
Re:Not Thieves (Score:4, Interesting)
That sounds consistent with larger numbers having larger values, but not so consistent with it being worthless either way. You're not being very convincing here.
OK, let's start being clear here. What I'm claiming you own is not the number itself (it's a number that probably occurs in many places), nor the physical bits that it's stored upon (they're owned by the bank), but you own being the subject of the bank's duty to pay a person money when you decide to lower that number. You claim that this is not ownership, merely some mechanics tied to a contract.
First of all, this duty is not worthless. The proof of this is to simply ask anybody on the planet to relinquish this duty to you, and ask them what they'll pay for it. For the vast majority of people, they won't accept any amount less than what is stored in there. This tells us that, to them, the duty of the banks to pay them money in exchange for lowering their balance is worth to them at least what the balance reads. This is literally the definition of subjective monetary value: how much a given person will trade for the object in question. So, we have at least proven that, while completely intangible, this duty is not worthless.
If you decide to define property in a way that excludes this duty, you may. Do not expect the courts, or anyone else, to agree with you on that point. You must remember that property, even of tangible objects, is an abstract, artificial concept that is enforced only by law. It is up to us to decide what to treat as property, and what not to treat as property, as well as what to call property and what not to call property. In this case, we have this duty, which has worth like property, is forbidden to be taken or otherwise abused like property, that can be bought, sold, and otherwise transferred like property. To me, to many others, and to the courts, this is sufficient to consider it property, as it shares all the core properties that make up the concept of property. Like I said, you're free to make exceptions, or impose further arbitrary restrictions to your personal concept of property, but if you want others to share your view, you need to be more convincing.
I wasn't claiming that copyrights should be protected. I was pointing out that so many on /. have decided that a potential to gain money should not be protected by law, specifically because they consider it not to be "real". I think that distinction is probably better placed at the feet of the people whose view I was attacking.
I'm with you so far. You, of course, realise that this makes any quibbles over what constitutes property utterly moot, right?
Well, I don't think it's nearly so clear that it's a net loss, in that we would be better with no copyright than with copyright as it is now, but yeah I agree shorter terms would be appropriate.
Re: (Score:2)
Clearly you accept that valuable items need not be tangible. And, from what I can tell, you accept that some intangible items should be subjected to property laws. You've now gone to the next logical step which is to argue that ideas specifically should not be treated as property. The theme of this argument is that ideas are more valuable with less restrictions on them, which is undeniably true. An idea benefits only those who can access its implementation, and the more freedom they have to use and play wit
Re:Not Thieves (Score:5, Insightful)
Sorry to double post, but I wanted to add something extra (not that it contradicts your viewpoint in any way). All property is artificial. It's an abstraction of possession that's protected by law. Let's say that I have a banana, and you take the banana from me, with no previous arrangement made between us. I now no longer possess the banana, but you do. What is there in the natural world to say that I "own" the banana and not you? Clearly possession is not enough.
Our laws define ownership. Without them, natural law would basically be along the lines of "It's yours until someone stronger takes it". People tend to place far too much importance on possession, not realising that what really underpins property is a complicated series of laws, without which property would hold no weight. It is but another reason why picking on intellectual property purely because it refers to something intangible is not really a valid concern (not that you do that, of course).
Social engineering is cheating (Score:3, Funny)
Magically hacking everything is so much more interesting.
Re:Social engineering is cheating (Score:4, Funny)
The Blame Game (Score:5, Informative)
So the banks say it's not their problem, it's the fault of mobile operators for making numbers portable. Yet the banks were offered access to the national mobile database so they could check if a number was recently ported, but declined to use the information. Meanwhile the fraudsters are getting away with their winnings...
Re:The Blame Game (Score:5, Interesting)
It wouldn't make a significant difference even if they did.
There are thousands of examples of carriers being tricked into forwarding numbers by 3rd parties. I do it all the time for customers that port into us if something goes wrong with the porting process.
Often all I do is:
1. Identify myself as $MYNAME from $MYCOMPANY. (NOT $THEIRCLIENT)
2. State that I'm calling on behalf of $THEIRCLIENT.
3. Tell them that $THEIRCLIENT is in the process of moving to our services and need to forward the number temporarily.
4. Carrier asks for the forwarding number and it's generally done in 1-2 hours.
The only shred of validation that might happen is them checking my caller id. I've never needed an account number, billing contact name, authorization code, or anything. Just the phone number.
I've even offered to pay for the forward but been declined because I'm not $THEIRCLIENT. They were happy enough to charge the $THEIRCLIENT on my behalf.
Phones/SMS/etc will never be a reliable way to verify an account holder because it really can be anyone on the other end.
Re: (Score:2)
But the point is banks could have access to see if a number was recently ported. If they detected a number was ported they could take further action or require additional authentication. The banks choose not to use this information, and customers are defrauded.
Re: (Score:2)
Re: (Score:3)
Phones/SMS/etc will never be a reliable way to verify an account holder because it really can be anyone on the other end.
Thats true with ANY kind of authentication, except for some kind of mythical, perfect, no-side-channel-attacks biometrics.
Re: (Score:2)
You bring up an interesting point, a lot of companies including banks will call you up to discuss various things...
They often block their caller id, so the call comes up as anonymous...
When you answer, the company expects *you* to authenticate yourself to them and will often refuse to authenticate themselves to you... I even had someone use the line "well we're a big company" on me this week... How do i know that? Anyone could call up and say the same thing...
Re: (Score:2)
Re: (Score:2)
This is one reason for me to not trust security solutions using mobile phones.
And if the target has a smartphone it's theoretically possible to intercept text messages and forward them to the perpetrator keeping the victim completely unaware of the attack.
One thing that perpetrators also can use is Over-the-air programming [wikipedia.org] to reconfigure the phone, and as an end user you can't tell if it is your legitimate operator that wants to reconfigure your phone or someone else.
Re:The Blame Game (Score:5, Informative)
So the banks say it's not their problem,
No they didn't. They paid up fully and automatically. First they blocked his account:
The team tried – unsuccessfully – to call Craig on his mobile. After several attempts to contact him, Craig’s bank account was frozen. The fraud unit eventually reached him on a landline.
Then they sorted everything out and paid for everything automatically.
Craig is satisfied that CommBank has done everything it can to resolve his specific matter, and he applauded the work of the bank's fraud squad.
They had even been part of a group which had investigated the MNP security fixes available but decided not to implement them because of security problems.
“We explored the Mobile Number Portability Database and decided not to progress the solution at the time due to limitations which we believed may have exposed our customers to undue risk," the spokesman said.
I hate banks in general as much as the next man in the times of this crisis induced by some of them but lets at least blame them for the evil things that they really have done. This is not one of them.
Re: (Score:2, Interesting)
Only because they are forced by the law to do what they did.
Banks can make things incredibly painful for people if they get hurt by fraud if they want to. One of my former bosses with a $20K AUD platinum card from an unnamed 3 letter Aussie bank had almost 19K swiped from it by card copiers a few years ba
Re: (Score:2)
In the UK, a card issuer is required to immediately credit the money back to you and then carry out their investigation... I imagine this is specifically so interest charges don't rack up in the interim. That way the customer doesn't have to care how long it takes.
Re: (Score:2)
Regardless, you sue everyone, because EVERYONE is at fault. And then we all lose in the long run, since they pass the costs on to their other customers.
CBA Security is ok. (Score:4, Informative)
To operate with that bank on-line, you need an Internet acc number (which is different to a normal account number), and at least a password. Additional secret question knowledge is required for 2 answers to set up a new transfer. Then, and only then is the SMS verification code needed. He must of been very slack to have made all that info available to the scammers.
Congrats to the bank to have picked it up. It's not the $45000 'raising a red flag' either. Once they rang me for confirmation because I sent a donation to a German software foundation - it was only $20.
Re: (Score:2)
To operate with that bank on-line, you need an Internet acc number (which is different to a normal account number), and at least a password. Additional secret question knowledge is required for 2 answers to set up a new transfer. Then, and only then is the SMS verification code needed. He must of been very slack to have made all that info available to the scammers.
Congrats to the bank to have picked it up. It's not the $45000 'raising a red flag' either. Once they rang me for confirmation because I sent a donation to a German software foundation - it was only $20.
I've had United Community shut down my card because it was used in a Thai ATM. Thailand is not an unusual destination for Australians (for those in other nations playing along). I rang them at my expense (OK, about A$0.5 a minute, but still) and they said they would not unlock the card even though I could verify I was in Thailand and still in possession of the card. For the rest of that trip I had to go into bank branches to withdraw money, with passport and all.
As a side effect, I learned there is a ni
Re: (Score:2)
Congrats to the bank to have picked it up. It's not the $45000 'raising a red flag' either. Once they rang me for confirmation because I sent a donation to a German software foundation - it was only $20.
They have lots of ways the red flag is raised.
I forgot to get cash one weekend, and there isn't a convenient cash point between home and work. I bought lunch at work, for about £1.80, on a credit card, three days in a row. Then I paid the local council over the phone for some evening classes for a year in advance -- £240. That was blocked.
I've told them I travel frequently within Europe. These transactions aren't blocked, but apparently it helps if I pay for the transport with the same card.
was this really two-factor? (Score:2)
This wasn't a failure of "two-factor authentication" this was a failure of the bank to have actually require two factors. It seems that the bank was relying on one of the two factors to be a "something you have" factor, which was the client's mobile phone, when in reality it was just another "something you know" factor. The "something you know" being just the phone number itself.
Re: (Score:2)
No, the scammers convinced the victim's phone company to transfer the number to a different account. Meaning they then had control of the second factor.
Re: (Score:2)
No, the scammers convinced the victim's phone company to transfer the number to a different account. Meaning they then had control of the second factor.
I'd argue that an account doesn't satisfy the intent of the "something you have" part of 2 factor authentication. "Something you have" seems like it should be something physical, not a non-physical entity such as a phone account. If it could be tied to the physical cell phone via hardware ID it could work.
Re: (Score:2)
what was the second factor then? Something you know and... ____ what?
The first factor (Score:5, Insightful)
Everyone is focusing on just the (in)security of the second factor, the telephone number, but what's missing from this story is that the scammers obviously also got their hands on much more information from this person first: they knew his bank login details (account name, password), and they knew his daughter's identity and managed to contact her.
The solution for SMS as my bank implements it, is that SMS is never sent to a forwarded number. That's arranged between the bank and the carriers or so, I don't know the technical details, but SMS is sent only to the original number. That's already a safeguard against arranging numbers to be forwarded, which other commenters note is quite easy to accomplish.
Anyway it is the classic story of when something goes wrong, it's usually not a single issue that went wrong. It's almost always an array of factors that have to come together "just right" to make it work. While it may be a good idea to review the security of the SMS as second factor, one should also look at how the criminals got their hands on the first factor and the rest of the information.
Re: (Score:3)
The solution for SMS as my bank implements it, is that SMS is never sent to a forwarded number. That's arranged between the bank and the carriers or so, I don't know the technical details, but SMS is sent only to the original number. That's already a safeguard against arranging numbers to be forwarded, which other commenters note is quite easy to accomplish.
This isn't the same as number porting. Porting is rerouting a number to a different SIM card, effectively permanently changing the network operator for a paritcular number. Many customers will have this on their number ,so if you stop it then you won't be able to use SMS for possibly a majority of users.
Re: (Score:2)
Indeed. Later I read the article, and found out the number had actually been ported to a completely different network.
How that is possible without putting down a signature and showing an ID document (if only at the receiving network!) I really can not understand. And I would think that this is a problem that goes much further than just allowing attackers to intercept banking details.
And besides, if they get the old network to give up the number, it has to go somewhere: attacker must have registered an accou
Re: (Score:2)
This is exactly what they do...
When i ported my number a few years ago, i had to:
Show proof of address in the form of a utility bill (anyone can print a fake one of these)
Make a random mark on a piece of paper with a pen, a "signature", anyone can fake this even easier
and that was that, porting process started.
It gets better (Score:2)
Everyone is focusing on just the (in)security of the second factor, the telephone number, but what's missing from this story is that the scammers obviously also got their hands on much more information from this person first: they knew his bank login details (account name, password), and they knew his daughter's identity and managed to contact her.
Commonwealth Bank for first time external transfers not only requires the traditional two factor authentication but also requires you to answer two secret questions. These are normally stock questions like the name of your pet, your mothers maiden name, etc.
To pull this off they likely knew quite a damn lot about him.
The downside to the bank in question is that all you need to raise your daily transfer limit is the SMS code, no additional questions.
Re: (Score:2)
I can't wait for everyone to use apps like Google Authenticator to set up two-factor authentication. SMS is a hack, and it is better than not having two-factor authentication at all. However, an app that resides on the phone would require access to the actual phone itself and can't be stolen using remote means (that I can think of). LastPass is the only third-party app I can think of that uses GA for added protection, but hopefully banks will work with Google to set this up for their websites as well.
Re: (Score:2)
If this "authenticator" is an app running on your phone, then it is limited to people with a phone capable of running that. So that must be a smartphone for starters. And running a supported OS. I don't know the numbers but I wouldn't be surprised if in most countries that's still a minority. Otoh virtually everyone has a mobile phone, and all of them can receive SMS.
After reading the comments... (Score:3)
The 20-20 hindsight is strong in this one.
Number portability (Score:2)
Number portability should be for moving between providers while retaining the same number (to save having to give the new number to all contacts).
When I have moved a number to a new (PAYG) handset (keeping the same provider), the process required me to quote the IMEI of both handsets as well as answering security questions. For a contract phone (which one would assume is what a business owner would have), surely the only time the number should need moving a new handset is when the handset is changed as part
Re: (Score:2)
Thats down to the network...
For any GSM based network with sim cards, moving to a new handset is as simple as swapping the sim.
Moving the number is completely separate, they ported the number to a completely different provider.
Wrong victim (Score:3)
they intercepted a victim's two factor online banking codes
Surely the victim here was the bank. They are the ones who gave away money to people who weren't entitled to it. They were the ones who allowed a weak form of authentication to be accepted. They are the ones who will bear the eventual loss.
The person who's account was used did nothing wrong. He didn't disclose any confidential information and (from what I've read) complied with the terms of his account.
We need to get away from defining the victims of these crimes as being the person who's name is on the account that was used - the account that the bank wrongly withdrew money from and gave away to the scammers. Unless we start identifying the true victims as being the financial institutions who we entrust with our money, yet have weak and inappropriate security measures the time will come when they shift the expectation and liability, so that the customer will bear the loss for something that is neither their fault not within their control.
there's a solution to this (Score:2)
Re:Victim never knew a thing? (Score:5, Informative)
He received an SMS which he believed to be from Vodaphone, stating that they were having network difficulties and he would experience loss of cell service for the next 24 hours.
Re: (Score:3, Funny)
Considering it's the Vodafail [vodafail.com] network, a 24-hour outage would be considered normal service.
Re:Victim never knew a thing? (Score:5, Funny)
It's disturbing when the scammers have better customer service than the actual phone company.
Re: (Score:2)
Re:Victim never knew a thing? (Score:4, Insightful)
Porting between carriers and devices, in most cases, requires so little authentication it's rather disturbing. It does not require any meaningful ID of the person before proceeding or at least I'm not aware of a carrier that does.
But the problem is - post Ma Bell, when the carriers used to make the customer jump through numerous hoops and bend over backwards before they'd allow you to port your number to a different company, people screamed bloody hell. This current state of affairs is the way it is because it's basically what the customers (and their politicians) demanded.
I'm not saying it's right - just that it's not completely the carriers' fault.
Re:What's the point of this story? (Score:5, Interesting)
The point is that if you trust your cell phone to be a 2nd authentication factor for your banking, you've contracted out your security to [the dumbest customer service rep at] your mobile carrier.
Also, being broke is probably a pretty good strategy for avoiding these kinds of problems.
Re:What's the point of this story? (Score:5, Funny)
If you're not broke, you don't need to worry either, because the scammers can soon fix that.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The point is that if you trust your cell phone to be a 2nd authentication factor for your banking, you've contracted out your security to [the dumbest customer service rep at] your mobile carrier.
Worse. The thief just needs your mobile phone and account numbers (e.g. stolen from mailbox, or trash) to port your number within minutes without any human approving it.
The names on the accounts do not even need to match.
Two-factor authentication by SMS is almost worthless in Australia.
Re: (Score:2)
You're missing the point of the GP's post. You rely on the fourth party, but really, you know little about their security requirements. I personally refuse to use 2 factor unless it's via a time sync key (can be done easily via a phone app) as any message being sent to you can be intercepted in various ways.
Re:What's the point of this story? (Score:5, Interesting)
Not True. The product is AFAIK, A Telstra product under which they use SMS to provide a "token" as an additional factor.
Given that there have been many confirmed examples of MNP ( Malicious Number Porting ) in Australia, this is known weak security. Under the circumstances, its entirely reasonable to assume that the Bank knew this was likely.
However I can't see them rushing out to address the issue in the near future. In fact, with some banks, it's impossible to turn off the ability to transfer out large sums of money. You can turn it off easy enough, but anyone who accesses the system can turn it back on by default by clicking a screen saying you agree to the risk. :(
All the major banks in Australia have this form of security. On the other hand, all the credit unions ( everyone except the "Big 4" Banks ) use VIP ( Verisign Identity Protection IIRC ) which can be downloaded to most smartphones and works as a soft-token.
Security in Australia, as with much of the world, is severely compromised by CEOs and CTOs who really don't understand it and as long as they can blame someone else, then due diligence is done.
GrpA
Re: (Score:2)
I doubt the CEOs implemented the system, it was most likely an incompetent engineer. And you can't rely solely on the time based apps, you need to consider all the clients that still use phones from the 1990's. A hybrid system that supports both forms of identification would be ideal.
And please tell me what do they have to win with having an insecure system? Your whole speech was going great until you pointed the CEOs as the ones responsible..
Re: (Score:2)
They win lower business costs, and depending on their compensation package that could mean they indirectly win more income.
Re:What's the point of this story? (Score:4, Interesting)
1) no it's a hole in the auth, since they used a known weak method that relies on the security of the telco over which they have no control
2) the problem is how do they authenticate that it is the customer requesting the number porting?
Most likely they will ask some "security questions" over the phone which a good social engineer will know the answers to...
If doing it in person in a shop they just ask for a signature, which ofcourse is totally arbitrary and trivially easy to fake...
Even if the telco has strict policies, how is the actual number porting carried out? Usually it is based on carriers trusting each other not to submit rogue requests, so all it needs is one rogue or compromised carrier...
Re: (Score:2)
Ok, 1 can be seen that way, you are correct but for 2) no. telcos should just ban most of their phone "services". In my country you can call pretty much any mobile phone serivces company (if you have a contract with them and call from the subscribed sim) and request to upgrade your plan. Seriously, some only validate the name and birthday. No account ids no personal data. You could easily upgrade someone who went to the toilet and let him worry about the 48month legislative hell you have to go through to ge
Re:What's the point of this story? (Score:5, Interesting)
no form of security is absolutely 100% perfect in every way..
Right; but that's not something new. No bank vault has ever been 100% safe either. The difference is that the bank takes responsibility for that so they ensure that it's "good enough", whatever that means. If money gets stolen from the bank vault they don't say "oh that was money from your account; sorry". With electronic security, there's often a level where they blame the failure of their own security measures on "identity theft" and make it the customer's responsibility. Two factor authentication of this kind is fine for a transaction of a few thousand dollars; It's not enough for transactions of hundreds of thousands of dollars. For 45k AUD that's a judgement call. `
This case is not like most American and some European banks though; Commonwealth Bank discovered the problem its self, is paying off the cost of the transaction and, even so, warned their customer. When they take the responsibility for the losses then what systems to use or not use become their commercial judgement. They looked at an MNP security system and decided there was something wrong with it. Maybe they now change their mind, maybe not. That's exactly the right thing. Hopefully they can persuade Vodafone to at least send a text message warning customers that their number is being ported before they actually do it in future.
Banks don't keep money in bank vaults. (Score:5, Interesting)
I assume that's something you picked up from the movies. Any bank which stored a significant percentage of cash in a bank vault would be out of business pretty quick.
And the money in "your" bank account is the bank's money, not yours. You loaned it to them therefore it's their responsibility. If they happen to try to pass that responsibility back to you... Well, you'd have to be pretty dumb to sign that contract.
Your relationship with your bank is that of a creditor. The money is no longer yours, and the bank can pretty much do what it pleases with the money.
The responsibility for security lies with the bank.
HTH.
must post before I even read the article :) (Score:2, Insightful)
"George Craig .. was told that his .. mobile phone .. was used as a tool in the attack .. the criminals sent an SMS to Craig purporting to be from Vodafone. The message said that Vodafone was experiencing network difficulties and that he would likely experience problems with reception for the next 24 hours" link [scmagazine.com.au]
Re:Victim never knew a thing? (Score:5, Funny)
As someone on Vodafone in Australia, this should immediately have started ringing alarm bells.
No way they'd have the problems fixed in 24 hours.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
If someone is keeping it in their wallet it would be easier than you might think, you can read cards without physically swiping them through a traditional card reader, especially the not so common no-swipe enabled cards.
It's a piece of cardboard with numbers printed on it. Good luck reading that without removing it from the wallet.
Re: (Score:2)
Re: (Score:2)
I wouldn't call RSA at all secure... The fact that they provide all the keys is a terrible idea and always was, them fucking up was always an accident waiting to happen.
I wouldn't trust any such system unless i could seed the device myself. There is no reason for the vendor to supply the seeds.
With a properly configured Yubikey, only two parties would have the necessary seed values - myself and the organisation i'm dealing with. If someone successfully hacked Yubico it wouldn't help them attack me.
Re: (Score:2)
I would think the smart card authentication devices like this [barclays.co.uk] are quite cheap. The debit card already needs the chip (to authenticate transactions in shops in the UK, and many other countries), and the reader probably doesn't do much.
Re: (Score:2)
The bank could supply a LiveCD... You want to do online banking (or require that transactions over a certain amount) then you boot the livecd.
Instead, they try to foist snake oil software on you like Trusteer Rapport (http://www.digit-security.com/blog/?p=47) which just adds additional unnecessary cruft onto your machine.
If someone got a keylogger installed on your machine they have privileged access to it, so then its purely a case of pot luck as to which software is able to bypass the other first.