The Princeton study found that carriers would permit the reassignment even if the attacker had repeatedly given incorrect answers to security questions designed to ensure that they were the legitimate account owner. Once a phone number has been reassigned to a SIM in the possession of an attacker, they can reset passwords even on accounts protected by two-factor authentication (2FA). They were able to persuade the carriers to assign phone numbers to new SIMs without successfully answering any of the standard security questions.
One common one is known as a SIM-swap attack.Īn alarming test carried out by Princeton shows that the five largest US carriers fail to properly protect their customers against so-called SIM-swap attacks. Signal already requires a code sent via text message to register a phone number, but there are a variety of vulnerabilities in the SMS system which mean this isn’t a completely secure system. Signal registration lock won’t allow anyone to register your phone number on a new phone without a PIN … We created this feature to protect users against threats like the Twilio attack.Secure messaging app Signal has added a new level of protection in the latest version. To best protect your account, we strongly recommend that you enable registration lock in the app’s Settings. Open Signal on your phone and register your Signal account again if the app prompts you to do so. If you received an SMS message from Signal with a link to this support article, please follow these steps: We are notifying these 1,900 users directly, and prompting them to re-register Signal on their devices. 1,900 users is a very small percentage of Signal’s total users, meaning that most were not affected. This attack has since been shut down by Twilio.
Here’s what our users need to know:Īll users can rest assured that their message history, contact lists, profile information, whom they’d blocked, and other personal data remain private and secure and were not affected.įor about 1,900 users, an attacker could have attempted to re-register their number to another device or learned that their number was registered to Signal. Recently Twilio, the company that provides Signal with phone number verification services, suffered a phishing attack.
0 kommentar(er)
