1
$\begingroup$

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep.

I was wondering if this procedure is secure against a Man In the Middle attack. In this case, EVE would be listening to the call and get the sensitive data.

In Literature i found that GSM stream ciphers such as (A5-1,A5-2) are known to be weak.

Is it safe to send sensitive information such as a bank online account code through a voice call?

$\endgroup$
  • 1
    $\begingroup$ This question might be better asked in security.SE. From a cryptographic POV the answer is negative, for the reasons you state, but banks are known to take calculated risks for various reasons. That is rather a general security question than a cryptographic question. $\endgroup$ – Henrick Hellström Apr 1 '13 at 18:20
  • $\begingroup$ As this question was duplicated on Security Stack Exchange, I'm closing it here. In future, please flag a question where you think it should be better on another StackExchange site, so we can move it. $\endgroup$ – Paŭlo Ebermann Apr 2 '13 at 15:42
2
$\begingroup$

Are you defended against a MITM attack? Certainly you are not well-protected. First, you have no assurance that the phone number you dialed was answered by a bank employee. The phone call could have been intercepted by an attacker, impersonating the bank. GSM encryption can also be disabled by an attacker, especially so on an iPhone which violates the GSM standard by disabling the "Warning! Unsecure call!" prompt. So it's possible your call could go out in cleartext to an eavesdropper.

But you asked a more important question: "Is it safe?" That's a risk assessment you'll have to decide for yourself. Do you know if there is an attacker interested in you, personally? Do you have vast personal wealth that would tempt a criminal? The level of sophistication required to perform a MITM intercept would have the attacker looking for millionaires to steal from in order to maximize profits while minimizing risks. If your bank account has only a few thousand dollars in it, you are probably not a valuable enough target to worry much about it.

Finally, to protect yourself and your money, you should look at using a bank with two-factor authentication, where you have a pocket token with a rotating number. The bank would refuse to deal with you unless you held the token, and you would refuse to deal with them if they couldn't authenticate themselves to you.

$\endgroup$
  • $\begingroup$ I've put this question on security exchange since it is more related to security than cryptography. Thanks for the response. $\endgroup$ – danieltorres Apr 1 '13 at 22:47
1
$\begingroup$

In short: No. Especially, you have to take into account that not always dtmf signaling is send in the voice channel. Often it's a outbound signaling. Gsm IS weak, but you can (very likely) set your mobile phone to use G3 instead of 2G which is not weak.

$\endgroup$
  • $\begingroup$ None of the GSM stream cyphers are still standing. Even if they were, attacks by a MITM tower work by telling the phone that encryption is not supported, and that the call should go through unencrypted, rendering all forms of encryption inactive. $\endgroup$ – John Deters Apr 1 '13 at 20:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.