Text authentication is even worse than almost anyone thought

Everyone has been lecturing IT about how horrible the security is from texting numbers for authentication for years, including me. Now, due to some excellent reporting from Vice, it’s clear that the text situation is far worse than almost anyone thought. It’s not merely texting that has inherent cybersecurity flaws, but the entire telecom space surrounding the text infrastructure is absolutely abysmal.

The demonstrated white hat attack intercepted and rerouted all of the victim’s text messages, but it wasn’t a technical takeover. The white hat (who had been asked by the Vice reporter to try and steal his text messages) simply paid a small fee ($16) to a legitimate SMS marketing and mass messaging firm called Sakari. The whitehat had to lie about having the user’s permission, but no meaningful proof was sought.

“Once the (attacker) is able to reroute a target’s text messages, it can then be trivial to hack

Article source: https://www.computerworld.com/article/3612243/text-authentication-is-even-worse-than-almost-anyone-thought.html