How hackers bypass 2FA security features and what you can do about it

It's 2021, and computers surround us. I do not doubt that you are staring at one right now. Whether it be your smartphone, tablet, laptop, or desktop, you would've had to input security measures to reach your current destination online.

Using a complex username and password combo can be very effective, but your online security is only as strong as its weakest point. Some measures may be easy to input, such as a fingerprint or PIN. But, without the additional security layer that comes with Two-Factor Authentication, sensitive data and private information can be compromised.

What do hackers, scammers, and phishermen have in common?

They exploit vulnerabilities of online systems and the people who use them.

A hacker's primary goal is to find vulnerabilities and utilize tactics to bypass security measures. While some hackers are white hat—meaning they are employed by companies to find vulnerabilities and rectify them—most are not.

Cybercriminals who have malicious intent can cause an obscene amount of disruption for people and businesses. Accessing private systems and networks, ruining a person's or company's reputation, and stealing someone's identity are a few motives for such criminal behaviour.

SMS 2FA remains 96% effective against bulk phishing attacks. However, recent incidents with SIM swapping and SMS spoofing have compromised cybersecurity—here's how to identify breaches and stay secure online.

Related article: The extraordinary value of 2FA and SMS for digital security

Enabling SMS 2FA features adds a little extra to your cybersecurity tool belt. 2FA is a supplementary security feature that can protect your online data and accounts. SMSGlobal's robust SMS gateway, MXT, allows you to enable 2FA to secure your account.

Build up your knowledge of possible online scams and understand how hackers might attempt an attack on your accounts. Don't make it easy for them to access your personal information.

SMS 2FA Best Practices

• Avoid SIM swapping by adding a PIN with your telecom supplier
• Enable 2FA features where possible
• Ensure your mobile number is updated across all accounts and services
• Strong password management

Enable 2FA with SMSGlobal MXT

1. Create a free MXT account here to get started.
2. Log in to your MXT account.
3. Click the Cog and navigate to SMS Settings.
4. Enable Two Factor Authentication, and the registered number will be displayed.
   1. Ensure that the phone number corresponds with the country on the account or is in an international format.

How it works:

Once enabled, upon the next MXT login, the user will be prompted to input a One-Time Password sent to the mobile number registered on the account. This process will occur every time the user attempts to log in.

The registered mobile number that will receive the OTP can be found in the MXT Contact Information form and updated once access is granted.

The user can request the OTP to be resent up to three times. If the OTP fails after three attempts, the user's account will be locked and can only be unlocked by our Support team.

Related article: Is Apple moving to standardize the SMS OTP format?

Moving everything online has allowed businesses and individuals to streamline processes and integrate data, conveniently in one place. However, with that comes the necessity of building and maintaining robust solutions that ensure the security of sensitive information.

The basics of cybersecurity:

• Complex passwords
• Two-factor authentication (e.g. 2FA SMS plugin)
• Don't share sensitive or private information
• Don't use platforms that aren't trusted
• Maintain security checks
• Document and report suspicious activity
• Install the latest security updates

Maintaining your online security with the above items isn't always enough. You mustn't become complacent.

While these steps bolster your online security, new technologies come with new vulnerabilities that hackers can exploit. Utilizing any digital system requires users to be prudent, audit accounts and security measures, and regularly update systems.

In recent times, SIM-swapping and SMS spoofing has led to an increase in online accounts being compromised. SMS 2FA is a popular choice for many when it comes to two-step verification, as it is easy to use. However, like any security system, 2FA isn't completely impenetrable. Hackers have found subtle ways to intercept OTP text messages, so it's up to the user to remain vigilant, identify possible hacking attempts, and take action where necessary.

SIM-swapping; multiple accounts, one phone number

SIM-swapping is when someone convinces your carrier to swap your phone number over to a SIM card that they own.

While that may seem harmless, SIM swapping can be detrimental to people that use SMS 2FA for multiple accounts. For example, many people use SMS 2FA for their Gmail account, their Spotify Account, and their Facebook account. So, the person who has your number now has full access to your text-based 2FA codes that protect personal accounts and sensitive data.

Brian Barrett from WIRED defined SIM swapping as "a scam in which hackers steal your mobile identity—and use it to upend your life."

What you can do:

Luckily, there is an easy way to avoid SIM swapping; add a PIN to your SIM card. Another way is to ensure that your carrier requests full ID before accessing your account or changing your number.

"If your smartphone suddenly stops working, or messages stop going through, you know you've lost your SIM. The sooner you act to preempt account takeovers from there, the better off you'll be," said Barrett.

SMS spoofing

Directly linked to SMS phishing (or smishing), spoofing allows hackers to falsify the Sender ID of a message, so it appears that a message is coming from a legitimate source.

By impersonating a legitimate source, the person attempting to smish may ask for personal data or a verification code to confirm your identity.

Related article: What do smishing, spoofing, and social engineering have in common?

However, you might notice that SMS 2FA codes do not require a response at all. All you need to do is input the code at login or when approving a transaction. If the code isn't sent through properly, you can request it to be sent again through the website you're using. But there should not be any two-way messaging.

Also, legitimate sources such as banks, will not handle personal data over SMS. For example, a bank will not ask for any personal information or passcodes without proof of identification via approved and secure channels. Usually, you can find out how a business handles sensitive data on its website.

Related article: What do smishing, spoofing, and social engineering have in common?

What you can do:

If a legitimate source asks for personal information or requires a response, contact them by a different channel, such as a phone call or going in-store. Confirm whether these requests are legitimate. If they are not, report them to the company, and if they are, request that this information only be handled via a different secure channel.

IoT and sensitive data

In today's digital age, the Internet of Things (IoT) has meant that smart devices can connect via an interrelated system and transfer information without human intervention.

Smart devices include any electronic object that can autonomously collect and transfer data over a wireless network.

With such developments like home assistants, the IoT can access a connected spiderweb of devices through one login. While convenient, it also poses a risk to overall online security. Before connecting devices, it's crucial that all security measures have been put in place to protect the user.

What you can do:

If you have any suspicion that your data may be compromised, log out of your account and disconnect your smart device from the internet. Do a quick audit of your accounts and contact the company, letting them know your experience.

Related article: Are your mobile marketing campaigns compliant?

Download The Ultimate Guide to SMS APIs and Integrations eBook for free.

Related article: Are your mobile marketing campaigns compliant?