Skip to main content

The WiKID Blog

Viewing posts tagged wireless-cellular-mobile-devices

Google search reveals private Telstra customer data

A man googling for some information on SMS carrier access codes stumbled upon private Telstra customer data. The data could be used to authenticate a user to the phone company, allowing account take-over.  There appears to be a pattern:

Authentication as a Service - mixed incentives

In the past, we've commented on the 'Vendor-in-the-middle' issues in the past, in particular we've pointed out this weakness when using SMS as a one-time passcode delivery mechanism.  As always, such reliance may be ok based on your risk tolerance.  Another example of this risk occurred to me today when someone on twitter mentioned pointed to this Wordpress plugin that add two-factor authentication to Wordpress using Google's authenticator.   There is also one for SSH via a PAM module.  

A world without static passwords

I wanted to quickly clarify my brief twitter rant about SMS authentication.  This was all started by Chris Wysopal's tweet about Zeus's new mobile MiTM attacks and that "phones are not secure enough for 2 factor".  Zeus is now targeting the text messages that banks are using for authenticating transactions.

iPhone Software Token updated

Apple has released the updated iPhone Software Token.  This update fixes various bugs.

Another nail for SMS authentication

Now that European banks are using SMS messaging for authentication, criminals are paying top dollar for used Nokia phones that can be reprogrammed due to a bug to work with any phone number.  We've discussed why SMS authentication is a bad idea before.  Here's more evidence.

Recent Posts

Archive

2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom