How can you secure SMS-based authentication against SIM swapping attacks?

Desde el 2016, el NIST ya no recomienda los SMS como segundo factor de autenticación, por los conocidos problemas que tiene. En nuestras aplicaciones es importante implementar otros mecanismos y en nuestras cuentas optar por métodos más seguros como el uso de OTPs con aplicaciones específicas, siempre que estén disponibles.

Use app-based authenticators, Multifactor Authentication, or hardware tokens instead. These methods don't rely on SMS, reducing vulnerability to SIM swapping attacks.

It is better not relay on SMS and using Microsoft Authenticator is also helpful. In case you are using any application on your phone make sure your phone is secure.

Usar um aplicativo ou dispositivo de hardware: Em vez de depender exclusivamente de códigos SMS, opte por aplicativos de autentica??o ou dispositivos de hardware para gerar códigos de autentica??o únicos.

Transitioning from SMS-based 2FA to app-based or hardware token solutions significantly mitigates the risk associated with SIM swapping. Throughout my career, I've observed a marked decrease in account compromise incidents among users who adopt these technologies. Apps like Google Authenticator or hardware devices like YubiKey offer a layer of security that isn't tied to a phone number, making it inherently more resilient against SIM swap attacks. These methods, by virtue of their design, provide a physical or digital barrier that is exceptionally challenging for attackers to bypass without direct access to the user's device.

La seguridad es tan fuerte como el eslabón más débil, por lo que la recuperación de nuestra cuenta tiene que ser tan segura como nuestras contrase?as y demás factores de autenticación. En caso de utilizar preguntas de seguridad, es recomendable que las respuestas sean aleatorias como una contrase?a y guardarlas en nuestro gestor de claves

Usar um aplicativo ou dispositivo de hardware: Em vez de depender exclusivamente de códigos SMS, opte por aplicativos de autentica??o ou dispositivos de hardware para gerar códigos de autentica??o únicos.

In my experience, robust account recovery mechanisms are a crucial safety net. By setting up multiple recovery options, users create a diversified recovery strategy that reduces reliance on a single point of failure, such as a phone number. This approach not only aids in quick account recovery but also ensures that you have alternative access routes if one option is compromised. Regularly updating and testing these options to confirm their effectiveness is a practice I strongly advocate for maintaining the integrity of account security.

Desconfiar de phishing e engenharia social: Esteja atento a tentativas de phishing ou engenharia social que possam visar obter acesso aos seus códigos de autentica??o.

Nunca, repito, NUNCA, debemos brindar información personal crítica por teléfono, correo o ningún otro medio que nos sea solicitada por un supuesto proveedor de servicio. Si nuestro proveedor de telefonía lo permite, es recomendable bloquear la posibilidad de gestionar nuevas SIM de forma no presencial.

The best prevention is to familiarise ourselves with the common signs of phishing and social engineering attacks. Organisations should conduct regular training sessions to raise awareness among the employees. By staying vigilant and adopting these protective measures, we can significantly reduce the risk of falling victim to phishing and social engineering tactics, safeguarding our personal and organisational data from unauthorized access or personal identification theft.

The best way to prevent such attacks would be by educating users to recognize phishing attempts, emphasizing the importance of verifying sources before clicking on links or providing sensitive information. Implementing email authentication standards like DMARC to reduce email spoofing and phishing risks. Use advanced email filtering systems to identify and block phishing emails before they reach users’ inboxes. Conducting regular phishing awareness training for employees to enhance their ability to spot and avoid social engineering tactics. Implementing multi-factor authentication (MFA) to add an extra layer of security, even if credentials are compromised through phishing.

Informe-se sobre quais dados o seu banco pode solicitar e quais n?o pode. Saber, por exemplo, que você n?o deve informar senhas ou PINs em liga??es telef?nicas, pode evitar que você perca acesso a contas de redes sociais ou até mesmo ao chip do celular (SIM). Manter uma postura de desconfian?a também é um dos comportamentos que pode lhe ajudar a n?o cair em golpes de phishing ou engenharia social. Caso receba liga??o ou uma mensagem com uma informa??o sobre algo que você n?o reconhece e n?o solicitou, prefira entrar em contato com o canal oficial da institui??o ao invés de responder a mensagem.

Si no hay otra opción que usar SMS como segundo factor de autenticación, es importante saber que opciones de seguridad extra tiene nuestro proveedor de telefonía. En base a eso, hay que aprovechar las opciones de seguridad disponibles, teniendo en cuenta los riesgos a los que nos exponemos.

It is also important to consider about security protection you receive from the mobile provider. They might required additional protection or security questions which hacker could not gain easily or in some cases they might ask you to physically go to their service center or provide additional security mechanism which make job more difficult for the attacker.

Engaging with mobile providers to understand and utilize available security measures is a proactive step towards safeguarding against SIM swapping. In advising organizations and individuals, I emphasize the importance of establishing additional account safeguards, such as PINs or verification codes, which act as an extra layer of security. Mobile providers can also play a critical role in alerting customers to potential SIM swap attempts, offering an early warning system that can prevent unauthorized access to sensitive accounts.

The proof of concept using silent SMS to localise LTE users' locations exists and it highlights a method that poses serious privacy issues. Tracking individuals without their awareness or permission is ethically questionable and potentially illegal in most countries (however, this is what the adversaries can do). Additionally, this emphasizes that anything transmitted through SMS/SS7 is not encrypted or secure. Consequently, organizations should reconsider using SMS as their primary two-factor authentication method and phase out this 2FA method. Addressing the vulnerabilities inherent in these protocols requires a comprehensive approach that involves collaboration between industry standards organizations, governments and other stakeholders.

To secure SMS authentication against SIM swapping: - Use Multi-Factor Authentication (MFA) with app-based OTPs and hardware tokens. - Encourage strong, unique passwords and the use of password managers. - Implement alerts for unusual account activities. - Require extra verification for sensitive account changes. - Train customer support to recognize and prevent SIM swap fraud. - Collaborate with network carriers to detect unauthorized SIM changes. - Run educational campaigns on SIM swap risks and prevention.

Uma a??o muito eficaz contra a troca do SIM é adicionar uma senha ao chip (você pode fazer no seu próprio aparelho, sem ajuda da operadora). Assim, sempre que o chip for incluído em outro aparelho ou que o seu dispositivo for reiniciado, essa segunda senha será solicitada. Sem esse fator de autentica??o, o golpista n?o conseguirá ativar seu chip e portanto n?o irá aplicar os golpes. E caso ele tente "adivinhar" a senha e erre algumas vezes, o chip fica bloqueado, dificultando ainda mais a recupera??o que só poderá ser feita com um outro código de seguran?a, o que lhe dá tempo para fazer contato com a operadora. Mas lembre-se de criar uma senha única e diferente de qualquer dado pessoal seu! Fique seguro!!

Beyond TOTP and hardware devices, great alternatives to SMS-based MFA, the use of biometric passkeys provides your users with yet another easy way authentication method. I recommend implementing additional security questions or PINs for account changes. And, monitor for suspicious activity and alert users to unusual login attempts or information changes. Educate users about phishing and the importance of secure passwords. Of course, work with telecom providers to flag and verify any SIM change requests rigorously.

Beyond the immediate measures to secure SMS-based authentication, it’s crucial to adopt a holistic view of security. This encompasses not only technical solutions but also a continuous commitment to security education and awareness. Encouraging users to adopt a security-first mindset and to stay informed about emerging threats and protection strategies is fundamental. Furthermore, exploring advancements in biometric authentication and behavioral analytics can offer additional layers of security, moving beyond traditional 2FA methods to provide more dynamic and adaptive security solutions tailored to the individual user’s habits and risk profile.