Phone Numbers as an Attack Surface: What SIM Swap and Data Leaks Actually Expose

The majority of security teams' work time is devoted to passive mitigation, password rotation, enabling multifactor authentication, or making authentication more complex and giving much more attention to the phone number in recovery than to other factors. Not a communication channel, but rather an identifier, as said, it's used in many aspects of tools, banking, and also e-mail, and when all thieves discover the methods of using it, that’s when trouble arrives.

Some developers have begun to take that edge exposure for granted when, for the first time, the user enters a phone number into the low-value data store of a phone. If you’re using a service where you can get a temporary phone number rather than a primary one, you will not have that telephone number in any low-value data store. It is a non-robust solution; it’s not a cure-all solution. It is a mitigation, and there’s some specificity to it.

The Phone Number as a Recovery Identifier, not Just a Contact Method

Typically, a one-time code is communicated to the customer via their phone number in most models of attack. The actual identifier (stable) may be applicable to many different systems. The phone number of the caller will only be part of the normal account recovery procedures, due to its unique nature. The identification can also be done via the phone number - no password or hardware key required.

Another dimension is offered by data brokers and by breach correlation: the attacker assembles a phone number and starts to correlate it with a database of numerous data breaches, transferring data without accessing the target’s device whatsoever. But the important thing about what this is not is that a code gets delivered: it's one that is also an identity between two or more different systems, where these are not designed in such a way that they can be trusted to accept the same schema.

What SIM Swap Actually Exposes

The SIM swapping technique could be really common; still, it is pertinent to notice there are numerous distinct techniques. An adversary will gain a lot of benefits if his or her swap is a success:

• Analyzes inbound SMS and voice calls associated with the victim’s carrier account as opposed to just one service;
• access to any recovery flow which converges on the fact that the number is enough to assume that a successful revival is achieved, no matter how strong the password is;
• typically, the victim loses consciousness of being heard, and a time gap is incurred when the receiver loses the victim’s signal (i.e., fails to pick up the message).

This will not be done by holding a second number as a reserve number. The biggest risk factor would be if the number (any number) was loaded on a carrier and was replaceable. But the value he/she brings into SIM swap mitigation isn’t the numbers he brings, but rather a carrier and what an account-recovery policy is about. The ability to deal with SIM swapping is not in the number of numbers he or she has; it’s in the carrier and account-recovery policy.

Why Contact Data is a Thing that Should Be Segmented

The upstream use of other, typically shorter-lived, numbers to reduce the number of places a primary number is stored doesn’t sound like an awful lot of compensation for anything. Also, any time that a phone number is registered, it can be used in the future, regardless of how attacked the phone number is. The concept of Segmentation is quite simple:

• There is no need to use a number for low-trust requests, such as a forum, trial sign-up, or one-off vendor forms, and so on, but it can be used when such a request has been made earlier;
• those that are only for that primary number (e.g. bank, primary email, IDP providers) are based on that number - password recovery will be based on that number;
• any number used as a high-trust recovery should be considered twice as a convenience field, where it can be passed away freely.

Not applicable if the usage is a SIM port against the home number. Not much else; it makes it less likely for an attacker to be able to get such a number in the first place than if it had to get through a leak, if you’re just looking at it in terms of how many databases are available to an attacker to look for such a number.

All of these are no new thing for most of the security teams, but these are the scenarios where SMS based recovery is being reintroduced: default and third-party integration to Apps: SMS delivery relies on the carrier’s infrastructure, and you will not be able to do an audit of the carrier’s infrastructure, as that is not your environment. If you could audit it, wouldn’t it come as an integral part of your infrastructure?