Why 2-Factor Cellphone Authentication just got a bit

                                 uuuuuuu
                             uu$$$$$$$$$$$uu
                          uu$$$$$$$$$$$$$$$$$uu
                         u$$$$$$$$$$$$$$$$$$$$$u
                        u$$$$$$$$$$$$$$$$$$$$$$$u
                       u$$$$$$$$$$$$$$$$$$$$$$$$$u
                       u$$$$$$$$$$$$$$$$$$$$$$$$$u
                       u$$$$$$"   "$$$"   "$$$$$$u
                       "$$$$"      u$u       $$$$"
                        $$$u   0   u$u   x   u$$$
                        $$$u      u$$$u      u$$$
                         "$$$$uu$$$   $$$uu$$$$"
                          "$$$$$$$" v "$$$$$$$"
                            u$$$$$$$u$$$$$$$u
                             u$"$"$"$"$"$"$u
                  uuu        $$u$ $ $ $ $u$$       uuu
                 u$$$$        $$$$$u$u$u$$$       u$$$$
                  $$$$$uu      "$$$$$$$$$"     uu$$$$$$
                u$$$$$$$$$$$uu    '''''    uuuu$$$$$$$$$$
                $$$$'''$$$$$$$$$$uuu   uu$$$$$$$$$'''$$$"
                 '''      ''$$$$$$$$$$$uu ""$'''
                           uuuu ''$$$$$$$$$$uuu
                  u$$$uuu$$$$$$$$$uu ""$$$$$$$$$$$uuu$$$
                  $$$$$$$$$$''''           ""$$$$$$$$$$$"
                   "$$$$$"                      ""$$$$""
                     $$$"                         $$$$"

                   [ A YMCMH Pirate Security Production ]




       Why 2-Factor Cellphone Authentication just got a bit weaker, or has it always been?
              ------------------------------------------------------
            Article By: [d]4rk0
            Twitter: d4rk0s


            Intro:
             As I Write This A lot can be said about the security of our current ways to identify
 ourselves on the internet to login and access our data. Using a simple username and password to
 login and access our data has been around for ages. Along with the standardized use of 2-Factor
 authentication people seem to think everything is a bit more secure. The goal of this article is to
 explain why using a standard Cell Phone for 2-Factor authentication should be thought about more   closely along with the type of Phone being used / Provider / TeleService.



           Brass Tax ? so WTF?:
             Most people using services like Twitter and Gmail are now using 2-Factor Authentication which is awesome. I love the classical sense of separate communication channels when logging in. The downside of this is most of the public use their own personal cellphones to retrieve the 2-Factor authentication code. The point of this article is to explain that no matter how well the 2-Factor Authentication platform is coded ( NO BYPASSES ) a person using their own cellphone is low hanging fruit and if its an important mark attackers will go the extra length to full-fill this bypass. This 2-Factor Authentication cell phone bypass can be applied Regardless of which cellphone carrier you are using ( unless its a private PBX or some other number completely controlled by you ) But what average person uses such services? ( And even these things have security issues )


         How This Method Works?:
          	The attacker(s) would already have your Account password along with what cell phone the codes are being sent to. This information is easily obtained even on major marks with simple
recon or SE methods. Once all this information is in play the attackers wouldn't even log in until the next step has been accomplished just to be as stealthy as possible. Cell Phone Providers are plagued with SE problems. This fact has been noted and documented for years.
The attacker now Calls up the phone carrier acting as the main account holder ( Again more Recon would be done sad but true none of this recon is hard ) claiming to have lost his/her cellphone and needs an immediate shut off. After the rep has shutoff / suspended service to the phone you give them the credentials to a new cellphone / "backup" phone you can use until you replace your "lost" cellphone.
Other methods of trying to switch numbers will not work because once you switch a number no matter what that current phone number will sit in a pool of numbers for x amount of time. The stealth part about this is when the cellphone carrier suspends service no messages are sent to the cellphone. You now have a CellPhone with the victims number and are ready for the 2-Factor Authentication numbers or phone calls to come pouring in. Attackers might even try doing this late at night while a target sleeps so by the time they wake up the damage has been done. In some cases maybe the attackers have even called back up switching back on service to the victims cellphone depending on the verbose of alerts that are sent to the phone upon reactivation. Again this method is being explained for ethical reasons so people can understand and maybe pick a safer alternative then their own personal cellphone that can be altered and tampered with.



         Closing Statements;
	 	Never trust your personal cellphone provider when it comes to 100% security along with any security mechanism in play. The down-side to this article is the majority of people using 2-step are using their personal cellphones. Remember their are alternative telecommunication services you could use to avoid this. Also remember depending on the service you pick it to might also have its own security issues.