Schneier on Security

Thoth • August 3, 2016 7:24 AM

SMS should have been removed long time ago considering the SS7 problems. Better to use a secure token.

Thoth • August 3, 2016 9:16 AM

@Oskar Sigvardsson

No serious security flaws are known for TOTP or HOTP if used in a separate tamper resistant token (not in a smartphone app !!!!).

Thoth • August 3, 2016 10:17 PM

@Vesselin Bontchev
Yes you are right. Malwares are one of the problem. I have forgotten to mention that since I was in a hurry when I was replying.

@Clive Robinson
That is more of a Usability vs. Security problem. The security lines in the authentication server setting a limit on how many wrong OTP code tries before requiring the user to manually re-synchronize the OTP token again which would bring up more questions whether the security of synchronization is fit for securing the future transactions.

Asking a user to type in hexadecimal 160-bit SHA1 outputs would not be acceptable by users either since they are not adapted at typing more than a couple of characters correctly. The better options would be using PKI tokens (for added security) but here is the pain of pushing out requirements to all banking customers or users to adapt to using PKI infrastructure which neither of the web browsers provide a usable interface.

I guess it all boils down to how much Security vs. Convenience needs to be set in place. From highly secured physical tokens that are capable of PKI to 6 to 8 digit OTP codes, consumer behaviours drives market practices and security standards.

Just to add a little side note, if you still remembered the National Authentication Framework the Singapore Government tried to roll out but toppled over like a tortoise being flipped on it's back (in a very pathetic and sarcastic manner), the SG Govt attempted to revive the plan many times and this time round they settled on SMS authentication to protect national infrastructures .... just only shortly before NIST kicks SMS authentication out of the door.

The NAF framework is crucial to the local National Security because of a national authentication implementation called the SingPass which the service is controlled by the IDA (controlls all Government electronic standards including security - across the board including military domains which is comparable to NIST with a bit of NSA) and outsourced to a contractor running the SingPass service.

The current SingPass authentication service only uses complex passwords and once authenticated it opens gateways to all government services tied to that account. They attempted to spawn a front company to sell a branded TOTP tokens from Vasco called OneKey token (simply a rebranding of Vasco's OTP token) and they vigorously push the sales of the OneKey token for the NAF/SingPass framework. The end result was a flop. Few bothered to purchase the OneKey token and the plan fell apart. They attempted to revive the plan by using SMS authentication and the deadlines for registration was moved back again and again due to poor reception until it was made mandatory for all SingPass accounts to use SMS authentication otherwise access would not be granted and the application for the SingPass account by citizens are really a pain in the bottoms taking around 1 to 2 weeks to get the access while having to apply via a badly designed application webpage or by physical presence. One of the side goals of the NAF is to collaborate with banks as well to provide a single authentication framework.

As the SingPass SMS 2FA rolls out, Singapore Government services would become vulnerable to attacks on the SMS services by SS7 vulnerability and malware intercepting OTP codes and not to forget the SingPass is the Government's authentication gateway and once that is breached, National Security and integrity locally would be placed at high stakes as the attacker would be able to traverse all the Government services associated to that account breached. For protection of high stake government access portals, I would have expected something more robust (continual push for OneKey token adoption).

In fact, I recently thought that our mandatory national ID cards we carry in SG should be upgraded to include an embedded on-screen (H/T)OTP function so that it becomes more binding to a particular individual. For added security, the OTP code could be used with extended code length 8 to 10 digits output or more according to different portions of Government services being accessed in accordance to the level of security required.

Thoth • August 4, 2016 7:02 AM

@r, Vesselin Bontchev, kevinm
If a malware can access SMS auth codes, it could as well even change them and delete them. If a malware stole the SMS auth codes and deletes notifications on the usage of the SMS codes, the user would become oblivious for most part. No need for hacking the A3/5 ciphers used in GSM.

All it needs is hacking the already weakened endpoints (i.e. Android) and quietly intercepting, replacing and deleting SMSes as needed. Although SS7 is for nation states, as @Bruce Schneier likes to put it, these vulnerabilities would quickly spiral out of control if left unhandled (which is mostly the case in the industry and one good example being EMV payment) until it becomes common place and probably even the script kiddies could download scripts to mess the entire SS7 when the opportunity arrives.

Thoth • August 4, 2016 6:27 PM

@John
It shows just how slow standards are adopted and changed.