Gone in 60 seconds: your phone is the Achilles heel of your security!

For many, the security of your online life relies on the security of your phone and phone number.

I’ve recently been speaking about the security of mobile phone numbers, and how losing your number can result in serious identity theft and account compromise.

Email providers, online stores, social media sites and others need to make it easy for us to ‘get back in’ when we forget our passwords, or lose access to our accounts. A common solution to resetting your password is to verify you through another email address, or by sending you a text message.

Phone number porting attack

Related: ABC Local Radio Interview – Louise Saunders interviewing Nikolai about mobile phone number porting scams (Feb 2017)

With phone number porting scams, the bad guys go in to a mobile phone shop or online, and they ‘buy a new phone’ or sim. The scammer tells their provider “hey, I want to port my old number across”. Surprisingly, usually all they need is: account name, date of birth and account number! If they know these things about you, it’s not hard to impersonate you as far as the phone company is concerned!

In Australia, the carrier is required (by law) to release your phone number pretty quickly. If the attacker managed to convince their carrier that they are you, they’ll soon have complete control over your mobile number.

Into Facebook with just a mobile phone

For those who have never done it, here’s a walk through of how easy it is to recover a Facebook account if you have control of a mobile phone. Keep in mind, never do I enter any detail other than the phone number.

Click on the “Forgotten Account” link under the Facebook login. Enter the phone number in to the box:

Recover your account with mobile phone

Now select the phone number as the recovery method.

Sending a reset code to mobile

Sending a reset code to mobile

Here’s the SMS with a ‘password reset code’.

Facebook SMS Reset Confirmation Code

Facebook SMS Reset Confirmation Code

Enter the reset code in to the password recovery page and then enter a new password!

Password Reset Success

Password Reset Success!

Done in one minute!

So if your phone is ported you’re in big trouble. But just losing access to your phone for 10 minutes can be enough. Does your phone display notifications on the lock screen? If so, your attacker just needs to see your screen to reset your passwords.

Codes nabbed from lock screen

Text messages are frequently displayed on the lock screen! No pin, fingerprint or password required!

Other sites are also guilty of weak SMS account reset

Password recovery via SMS is common for many service providers. Even the Australian Government uses SMS to reset logins. They adds one extra layer (a secret question) – but how much have you shared on social media, can someone guess the answer by searching your history?

MyGov Recover Login

Australia myGov “Recover Login”

Australian MyGov Password Reset

Australian myGov Password Reset uses SMS!

Australian Government MyGov - Secret Question

Australian Government myGov – Secret Question

myGov password reset - extra security, a secret question

myGov password reset – extra security, a secret question

Using your mobile phone is indeed convenient for password recovery, but it’s not secure. Even the USA’s National Institute of Standards and Technology (NIST) has declared using SMS for “two factor” authentication a security risk!

Standards body warned SMS 2FA is insecure and nobody listened

What should you do?

It’s difficult! We need to be able to recover lost passwords, but your security is weakened if you provide your phone number to a site that uses SMS to send unlock or 2-factor authentication codes.

Less is best when it comes to what information you put out there. Personally I rarely share my phone number. But that’s not always an option; vigilance is necessary.

Don’t leave your phone laying around, don’t put your date of birth on your social media accounts. Limit what you share and keep an eye out for anything suspicious. Have a plan, think for yourself:

“How should I react if something suspicious happens to my mobile phone, or if my account has been stolen? What do I need to protect, who do I notify?”

PRINT FRE(0)
 199

READY.
Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Tech explained: Hash puzzles and proofs of work

Following my blockchain Computerworld article, I’ve been getting quite a few questions about how the Bitcoin blockchain is protected by ‘difficulty’.  Mining blocks is hard, so, what are miners doing that uses so much time, effort and power? They’re proving their work, by solving hash-puzzles.

See also: Burning coin – estimating the energy use of the Bitcoin network in 2016.

Puzzles as Proofs of Work

Puzzles come in many shapes and forms: from the common jigsaw puzzle, to number puzzles, and even crosswords. Regardless of the type of puzzle, they all have some similarities: puzzles take time to solve, they have varying levels of difficulty, and most solutions are obvious and easy to check.

With most puzzles, it is possible to alter the difficulty by changing parameters. For example an easy jigsaw might have 100 pieces, while a difficult one has 5000 pieces.

The more difficult a puzzle is, the longer it will take to solve.

 Similarly, hash-puzzles take time to solve, vary in difficulty, and are easy to check. However, unlike solving a jigsaw puzzle, logic doesn’t help. Hash-puzzles are much harder, and they can only be solved by trial and error.

How a hash works

A hash is like a fingerprint. It’s a massive, random-looking number that uniquely identifies a piece of information. Given any electronic data, it is possible to generate its hash (which looks like a very long serial number). Hashes are infinitely sensitive to change, even a tiny change to the input results in a wildly different hash output.

See also: Tech explained: What is a hash, what is brute force and are hashes secure?

While hashes appear random and unpredictable, they are deterministic. For each input, only one hash output exists — every time I use the same hash inputs, the same output value will come out.  Hash-puzzles rely on both the random and deterministic properties of hashes to prove and verify work.

Solve this

If I challenge you to roll a dice until you saw a two: for each roll you’d have a 1/6 chance of throwing a 2. If I gave you two dice and wanted double twos, the likelihood of that is 1/6 X 1/6 = 1/36 (and with three dice, 1/216). The difficulty increases exponentially, and the challenge takes longer to complete.

Solving a hash puzzle, making the hash match the puzzle rules

A short python script to solve hash puzzles. Using random values (a nonce) to make the hash result match the rules of the puzzle. The difficulty of the puzzle is affected by how many letters need to match the rules. The more letters, the more difficult the puzzle – A single letter is easy to match, but three letters starts to take a long time!

I can do the same with a hash-puzzle. I can say “roll hashes until you find one starting with the letter ‘A’” (probability 1/64), or roll a hash that starts with something longer e.g.: “Hi” (1/4096) or “Dog” (1/262,144). The only way to solve the puzzle is to try random input values, perform the hash operation, and then look at the output to see if it matched the puzzle rules. If I want to make the puzzle take longer or require more resources, I just make the rule harder to match.

I can also require that you find a solution where the input starts with some pre-defined content. Your task is to append some random value to my starting content, hash, test and repeat. My input doesn’t affect your effort, but it does ensure you start from scratch.



Bitcoin puzzles

Bitcoin uses the transaction data, and ‘chains’ the previous block’s hash value as a starting input for the next block’s. Miners then race to tack on massive random numbers until they find one that produces a hash that matches a specific pattern with a certain level of difficulty.

The blockchain is protected from modification because the hash-puzzle takes (on average) about a one-hundred-billion-billion attempts to find — it’s more work the any individual is capable of producing. But, the miners work in parallel competing to solve the next puzzle — thousands of miners, rolling the hash-puzzle-dice, over a million-million-million times per second.

Hash-puzzles are an elegant solution that provides security to the Bitcoin blockchain.

PRINT FRE(0)
 2

READY.

 

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Scraping Data with Python and XPath

I decided to write a short post about how I use Python and XPath to extract web content. I do this often to build research data sets. This post was inspired by another blog post: Luciano Mammino – Extracting data from Wikipedia using curl, grep, cut and other shell commands.

Where Luciano uses a bunch of Linux command line tools to extract data from Wikipedia, I thought I’d demonstrate pulling the same data using Python and XPath. Once I discovered using XPath in Python, my online data collection for research became a whole lot easier! Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Tech Brief: Anonymising sensitive data with entropy and salt.

As researchers or programmers, we will often want to protect our data by anonymising sensitive information like names and addresses. To do this, we can combine pieces of user data to make an ’anonymous’ key that can be used in-place of the sensitive information. Instead of referring to “Jane Smith of Drury Lane”, Jane could have a nonsense identifier like “675AF3C”, which can be used throughout our study.

(Want more info? See security brief: Statistical Linkage Keys and Security)

Anonymising data with hashes and entropy

A common method for anonymising fields such as name and date of birth is to combine them with a hash function. But, because secure hash functions are ’deterministic’, they produce the same identifier for the same set of input data. If we have limited hash inputs, we will have a limited range of possible outputs; if we limit things too far, an attacker can run a brute force search to identify our original inputs. Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Security Brief: The Australian Census and Statistical Linkage Keys

There have been concerns among security professionals and privacy advocates about changes to the Australian 2016 Census. The biggest concern is how the ABS plans to combine your private data. The ABS will link your Census records across multiple products, services and share it with other government departments.

In the past, this has never been a problem because the ABS never used our individual name and address data. Consequently, people could answer uncomfortable questions honestly, with the knowledge that even if data were to leak, there would be no back to them.

The Census Data Statistical Linkage Key (SLK)

This year that has changed, the ABS revealed plans to assign Australians a unique identification number called a Statistical Linkage Key or SLK. Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Tech explained: What is a hash, what is brute force and are hashes secure?

Identifying Data

Security professionals often use hashes to represent data – think of it like a unique fingerprint or “key” for the data. While there are many ways to make data keys (we could assign them sequentially, or pick them at random) hashes provide a way to build a unique key from the data itself.

The purpose of a key is to allow us to reference a piece of data. Perhaps we need a key to identify movies; we could define a data key as:

- the first letter of each word in the title,
- directors initials
- and the year of release.

So, Indiana Jones and the Temple of Doom, by Steven Speilberg (1984) would have the key: IJATTODSS1984.

This key is pretty simple and easy to reverse. Because we know the key (IJATTODSS1984) and how it’s made, we can identify the movie by searching the Internet for releases in 1984, and directors with the initials S.S. This key is also not guaranteed to be unique, Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Security concerns and Census Statistical Linkage Keys explained

An in-depth explanation regarding the security surrounding statistical linkage keys, why they’re important and how their security can be compromised…

The security of the Australian 2016 Census has sparked much debate and consternation among privacy advocates and security professionals alike. At the core of these concerns is a move by the Australian Bureau of Statistics (the ABS) to start linking census records to other data. The mechanism proposed for linking records and data is a ‘random looking’ Statistical Linkage Key. We have been told that the linkage key is secure and will be ‘hashed’ to make it irreversible – but what exactly does that mean, and how does it secure your data?

Introducing the Statistical Linkage Key

Statistical Linkage Keys or SLKs have been used frequently by people doing data research, it provides some very basic anonymity, and a sanity check on the data while retaining a way of identifying an individual throughout a study.

The Australian Bureau of Statistics publishes a standard called the SLK581 cluster. It defines a method for turning “Jane Smith 01/01/2007 Female” in to random looking serial number like “MIHAN010120072”. Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Your broadband router is not as secure as you think it is

Your broadband router is not as secure as you think it is

Patryk Szewczyk, Edith Cowan University and Nikolai Hampton, Edith Cowan University

Between your home network and the internet sits your broadband router. This humble device is often overlooked, yet it is also your first line of defence against hackers, malware and viruses.

It’s easy to assume that the latest firmware for your router will provide protection against cyber threats. However, our new research has found that even the latest broadband router firmware remains dangerously vulnerable to attack.

A simple overview of what makes your router go.
Nikolai Hampton, CC BY

Firmware is the operating system and software that controls all the features of your router, from the blinking lights and configuration options, to advanced network security features. Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Is someone watching you online? The security risks of the Internet of Things

Is someone watching you online? The security risks of the Internet of Things

Patryk Szewczyk, Edith Cowan University and Nikolai Hampton, Edith Cowan University

The range and number of “things” connected to the internet is truly astounding, including security cameras, ovens, alarm systems, baby monitors and cars. They’re are all going online, so they can be remotely monitored and controlled over the internet.

Internet of Things (IoT) devices typically incorporate sensors, switches and logging capabilities that collect and transmit data across the internet.

Some devices may be used for monitoring, using the internet to provide real-time status updates. Devices like air conditioners or door locks allow you to interact and control them remotely. Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn

Analysis – Email list integrity, 96% of organisations handle my email address appropriately

How are businesses and organisations handling your email? I know how they’re handling mine!

For about 10 years I’ve used “burnable email addresses”. These are email addresses that I can use and expire. They are unique to every relationship between me and another organisation, business or blog that I register with. This means I know who’s got my email and if they’ve leaked it. I know if they’ve shared if or if they’re spamming it.

I guess that makes me a living honeypot? But, unlike many automated honeypots that try to trap malicious users, the data from my email servers are based on real-world interactions between myself and others. Continue reading

Share this:Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedIn