Federal agencies are warning about security vulnerabilities in SMS-based two-factor authentication (2FA) methods following recent cyberattacks that have exposed weaknesses in these systems. The FBI has specifically cautioned Americans about the risks of using text messages for two-factor authentication, building on previous joint advisories with CISA about SMS vulnerabilities.
A significant incident known as the “Salt Typhoon” cyberattack, attributed to Chinese espionage efforts, demonstrated how attackers could exploit SMS-based authentication vulnerabilities. The attack targeted U.S. internet service provider systems used by law enforcement for court-authorized wiretapping under CALEA requirements. Attackers successfully intercepted SMS one-time passwords to gain unauthorized system access, prompting new security guidelines from the FBI and NSA.
Cybercriminals employ multiple techniques to compromise SMS authentication, including SIM swapping, where attackers convince mobile carriers to transfer phone numbers to their control; exploiting SS7 protocol vulnerabilities to redirect text messages; using malware to access text messages; and conducting man-in-the-middle attacks to intercept cellular network communications. Recent FBI reports indicate that SIM swapping attacks alone cost victims $48 million in 2023.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued guidance directing federal agencies to implement multi-factor authentication for social media accounts. Federal agencies recommend using phishing-resistant authentication methods, such as app-based authenticators or hardware keys, instead of SMS-based 2FA. The guidance supports CISA’s recent mobile security guidelines emphasizing FIDO authentication and the growing adoption of passkeys, which have seen a 550 percent increase in implementation during 2024.
Alternative authentication methods include encrypted messaging applications like Signal or WhatsApp, which provide end-to-end encryption. These solutions offer enhanced security compared to standard SMS authentication. U.S. intelligence agencies have endorsed the use of encrypted messaging apps for sensitive communications, particularly following several high-profile telecom data breaches that have exposed the vulnerabilities in traditional carrier-based messaging systems.
Sources: Alvarez Technology Group, Security Links, YouTube, Keypasco
Follow Us