In other news, I built and deployed a "2FA Mule" last weekend.
It's a stock android phone with no google account and no apps installed except for "SMS Forwarder"[1].
It is configured to forward all SMS to an email address via encrypted SMTP. This means that I can receive these 2FA codes anywhere I have Internet access - such as an airplane or newly arrived in a foreign country where my SIM card does not work.
The "2FA Mule" itself is plugged in at my office in a corner.
I'm not employing this for anything sensitive but it's interesting to consider that I can use SMS based 2FA while divorcing it from my day to day SIM identity ...
[1] https://play.google.com/store/apps/details?id=com.frzinapps....
So the email address is not 2FA secured?
Could be his email address uses OTP or UFA, which would make it secure.
If anything SMSs are much more dangerous than OTP and services should eschew them.
Sadly some of them still force you to have SMS.
It's my own mail server. I just tail the mail spool ...
Is your account with the DNS registrar who controls your MX record 2FA-secured?
>[...] via encrypted SMTP
In addition to establishing a secure socket, does the mule validate the mail server's TLS certificate name?
Nice. I do something similar but forward it to Slack.
I also have it auto-answer 2FA calls and automatically hit the # key.
Yeah, call it not real 2FA, but it's really companies that choose to not use U2F are at fault.
U2F is great, but these companies want to be able to provide 2FA for people who won’t/can’t have a dedicated hardware device for 2FA.
Yeah but (a) by not supporting U2F they suck (b) I don't want them to use 2FA as a magic excuse to get my phone number
"I also have it auto-answer 2FA calls and automatically hit the # key."
One year at defcon - maybe 20 years ago - the speaker told an anecdote about a user who had set up a webcam and put their RSA token under it.
And we all laughed ... "haha what a dummy ... I can't believe users are so stupid" ...
But secretly I thought it was genius.
Oh I've done that too before. If they only give me one RSA token and no backup, then that's what i do.
> set up a webcam and put their RSA token under it.
That's only stupid if anyone other than you has access to your webcam.
I've done exactly this. Well, my SO did it at my direction since I was in another country and had forgotten to take the token with me.
Google Voice works for many services which is protectable with 2FA (hardware tokens) and accessible most anywhere in the world--you're at the mercy of Google, though
That should help against SIM swap attacks
Lately more and more of my accounts aren't accepting GV as a phone number linked with the account.
Recent memory: 7-11 app and eBay both made me use a number that's associated with an actual SIM card.
It's hit or miss and that is why I am basing this on an honest-to-god mobile number on a SIM card. I don't want to deal with the finnicky number validation that is done ...
Do you pay for a separate phone line for the mule?
In many countries, a pre-paid phone costs almost nothing to keep active.
I keep a UK number for some 2FA systems, it costs about £0.10 per year. I just have to send an SMS every 6 months to keep the line active.
It's very easy to forget to send the sms, which will then make you loose your number. The carrier will take the number back and assign it to another person.
This must be automated.
Yes. I have a dedicated account with a verizon MVNO and this account has no other SIMs or accounts associated with it.
However, depending on how I choose to use it I can point 2FA for numerous different services to this one SIM. I just don't want to point multiple accounts at the same service to this SIM since that's a clear, common identifier and correlates those two accounts better than probably anything else could ...
- If you use different services with the same SIM, using a phone number to identify you across platforms is my primary concern.
- Yet, confirmer SIMs can't really be throwaways. I'm 'stuck' with a prepaid the same way people are stuck in to gmail — they have 400 accounts with the e-mail address.
I've had it before, where I got locked out of accounts, with no way to delete the account, or even do a data takeout. The only way forward has been the same SIM.
The only way forwards would be to 'start a SIM farm': buy those SIM slot AliExpress boards, and sell(/use) a forwarder service.
(here is business plan, on how risky, and expensive to the customer it'd be)
The 'challange' is keeping track of multiple people, to avoid same-site conflicts. Users would hopefully be encouraged to tell where they are using the phone, as to not get an used one themselves.
For Estonia, the minimum of keeping alive a prepaid is topping up 3€ every 6 months, per SIM (whereas new is 1€).
Of course, IoT numbers are available, but they aren't likely a valid option, as they definitely aren't meant for burners, and even a single misuse/complaint would likely shut everything down. More on this later.
Assuming there would be (monthly) paying customers, prepaids could do. It'd be a bit pricey, I'd start at ~10€/mo/user, assuming small users (few sites) would use the same sites, and larger ones needing many, many numbers. Billing per new site isn't likely very cheap either.
That aside, hardware is the most concerning, AliExpress pricing is 12-22€/slot depending on how bulk you go. Hundreds or even few thousands of euros in upfront needed. (Side note, on a >100 users scale, old phones etc aren't feasible; otherwise go with android dual SIMmers (using feature phone nokias for the price of nothing and stuff would be cool, but custom fw, and soldering each one isn't worth the time), and WiFi (on the scale WiFi stops working, you'll have bigger problems to deal with, and it'd be extra hardware cost as ell) (Side note 2: 'sim banks' exist, what allow to connect many SIMs to one modem, it'd bring the hardware cost to ~2€/sim, unsure if they can be online at once (though 'click here and wait 5-10s before clicking send SMS' could work for the user); even if they can be online, you still run in to the interference and 'why is there 1000 phones in this house' problem)
I'd say after a few hundred, it probably makes sense to start building them yourself.
For a good user experience, you have to keep them always online as well. Building a SIM-switcher would be likely as expensive, as well. The real concern is interference and infrastructure — having hundreds or thousands of devices in the same spot will not work well in physics, nor the service provider coming knocking.
Now, even small scale, it'd make sense to be your own service provider. This way you could get SIMs, and can connect directly to the network. You could emulate devices a this point, not needing any SIM cards either.
Problem is, all of your network activity is for SMS confirmations. That is going to get many strange looks.
The bonus of being in a small country is, that the other way, you can be friends with the person, who happens to be a head or person actually doing things, at a telecommunications provider.
Though, on a large enough scale, you're going to have actual overhead to their network. That's when you'll need to start paying for the service. Pricing for businesses isn't cheap.
**
Well, that was a wall of text. Insanities.
So — assuming you aren't a large-enough service provider already, normal long-term vEriFiCatIoN is deadly, assuming you need captchas on many accounts.
That's... genius
I'm going to have to steal that.
Nice.
Will actually go this route in the future.