We sometimes get asked why we don't support SMS based tokens in AuthAnvil. For those that don't know, the idea behind an SMS based token is that a server sends a text message to a cell phone with the next passcode to use to log into a system. There are several reasons why we don't support this, but it boils down to two specific areas of concern... security and reliability.
SMS spoofing is rampant in the industry. It is trivial to trap and trace SMS messages, allowing an attacker to play a man-in-the-middle attack without having to attack the underlying site that is using the system. Further more, you are trusting the security of the cell phone provider, which isn't always the best thing to do. For those that remember my talk on social engineering attacks and identity theft during my lecture at the Microsoft Conference Center a couple of years ago, you will recall me making a call on stage and changing the complete account settings for a popular US cell carrier of an attendee to my own phone (with his permission of course). The point is that most cell providers are just to easy to hack into. If you need more evidence of this, you can look at Ben's post on how easy it is to breach Sprint's systems.
When the accounts themselves aren't that easy to attack, the criminal element have other options. With the roll out of SMS messages to many European banks, we are now seeing the criminal element attack these financial institutions through flaws in Nokia based phones that have an inherent flaw in their design. This Monday PC World reported that fraud investigators in the Netherlands had found criminals were paying top dollar (umm... guess that would be euro) for discontinued Nokia 1100 cell phones. Why? Because they can be tampered with to allow an attacker to intercept one time passwords (OTP) sent from the bank to specific numbers. You can see where we are going with this. And it will be interesting to see how the banks and vendors of SMS based tokens deal with this in the coming months.
Security aside, the other reason we don't use SMS tokens is reliability. What good is a token if you can't get the OTP when you are out of the network area? This is frequent when in the dungeons of a data center or server room. When on the road in another country, to use an SMS based system you have to pay for roaming services. You ever see how much that costs?? Or what about when you need to log into a system such as your laptop while on an airplane, where you must turn off your cell phone. That's just not practical. And what about load delay? It is said that on some cell carrier networks, SMS messages just cannot be guaranteed for delivery. With so much text messaging going on these days, sometimes it can take up to 30 seconds (and sometimes longer) for messages to arrive. These frequent delays and lost messages just don't make it easy to accept SMS as a viable option for our clients.
So there you have it. That is why we don't use SMS tokens. We focus on easy to use hardware and software tokens that work out of band, with the OTP being generated and shown on an LCD or phone screen. So even if your cell phone isn't connected to a network or is in 'airplane mode', you can still generate the credential you need to log in.
