Home

Podfeet Podcasts

Security Bits logo - a green padlock with the words Security Bits to the right and in tiny letters below ithat it says 10101010 indicating a digital lock

Security Bits — 12 September 2026

  • by Bart Busschots

    • Feedback & Followups

    Listener Questions

    How Insecure is SMS Multi-Factor Authentication? (from Allister)

    A service I use has just introduced two-factor authentication via SMS while another I use has just removed this option citing its insecure nature. I know any 2FA is better than none, but in 2026 how insecure is SMS 2FA really?

    SMS-based authentication is inferior to the other commonly used factors for two reasons:

    1. SMS is not phishing resistant (same is true of all code-based factors)
    2. The SMS infrastructure is inherently insecure

    Phishing-Resistant Factors?

    If an authentication factor requires a human to enter a code into a text box, then that human can be tricked into entering that code into a malicious website, allowing the attacker to steal a sign-in session.

    How does this work?

    1. Attacker tricks user into following a phishing link that imitates some legitimate site
    2. User does not look up to the address bar, so does not see they are on a fake site
    3. User enters username and password, sending it to the attacker
    4. Attacker starts logging into the real website with those details, triggering a genuine SMS message to the user
    5. Attacker shows user a box to enter the code
    6. User still does not notice the address bar, and enters the code
    7. Attacker logs in to site as the user

    When this works, the attacker can be the user for one session. If the site makes you sign in again every hour, then the attacker is in every hour, but most sites let users stay logged in as long as they’re not idle for more than some amount of minutes, giving attackers effectively infinite opportunity for damage.

    None of this is unique to SMS. It’s true of codes sent by email, but also push notifications, and even codes generated by apps using the Timebased-One-Time-Password protocol, or TOTP (better known as Google Authenticator, even though it’s an open standard that works in just about any password manager). In fact, even hardware dongles that display a code that changes every 30 seconds are vulnerable to this kind of phishing attack!

    The only commonly used mechanisms that are not vulnerable to phishing are based on the FIDO protocol, such as FIDO-compliant hardware dongles and passkeys.

    Why SMS is Insecure

    What makes SMS even less secure than the many other non-phishing-resistant factors still used today is a fundamental weakness in how cellphones work — the entire global system is as weak as the least secure carrier anywhere on planet Earth!

    Similar to how the internet uses human-friendly domain names, while all the underlying traffic is addressed by IP addresses, SMS messages use human-friendly phone numbers, but the underlying messages are addressed by IMSI numbers. Every SIM card in the world (physical or virtual) has a unique ID, and there is a DNS-like system for mapping cellphone numbers to IMSI numbers. That system is known to be utterly insecure, and upgrading that system requires the cooperation of every single cellphone provider on earth. Realistically, it’s not going to change any time soon!

    And there’s also SIM-jacking, where someone tricks the carrier into giving them your phone number.

    Attacking SMS-based Authentication is an Economics Question, not a Technical One!

    The fatal flaws in the SMS system are well known, so the cybercriminals can exploit them easily. This means that you can buy SMS interception from Cybercrime-as-a-Service offerings on the dark web. Someone wishing to attack you on a site that uses SMS for authentication simply needs to:

    1. Get your username and password — usually from a data breach or key-logging malware, or simply purchased on the dark web
    2. Determine your Cellphone number — almost certainly available for a small fee on the dark web
    3. Pay a fee to reroute your cellphone number to their SIM card for an hour
    4. Log in as you (the code will go straight to their SIM card)

    If all that sounds like too much work, you can now buy fully packaged soup-to-nuts offerings that get you all the way in without having to do anything more than transfer a few fractions of a bitcoin to a Phishing-as-a-Service provider!

    All that means that the key question when evaluating the risk simply boils down to this — is an attacker’s expected gain from breaking into my account greater than or less than the price of the current Crimeware-as-a-Service offerings?

    If SMS is protecting your account on a banking website, a cryptocurrency exchange, a stock-trading account, a gambling account, or some kind of investment brokering account, then the math is obviously not on your side.

    If it’s just protecting your login to a hosting providers hosting your personal travel website, the economics are obviously on your side.

    As Flawed as SMS is, it’s Always Better than Nothing!

    The barrier to entry to attack SMS-based authentication may not be nearly as high as we like; it’s still non-zero! What that means is:

    1. If a site holds valuable data, and its use is in any way optional, don’t accept SMS-based authentication; move to an alternative provider that facilitates stronger security!
    2. When offered the choice between SMS and any other factor, choose the other factor!
    3. If you have no choice but to use a site that only offers SMS as a second factor, use it, because that’s still your least-bad option

    Deep Dive — More AI Escapes Disclosed

    More details continue to emerge of ‘lab leaks’ from the big AI companies.

    OpenAI Admits to Another Worrying Agent Escape

    Independent security researchers discovered another clandestine back channel rogue OpenAI agents were using to secretly coordinate their activities. In this case, agents discovered they could edit a German developer wiki on the public internet from inside their sandbox, even though their sandbox was trying to enforce read-only internet access on them.

    After the details were published, OpenAI admitted it knew about the event, and despite the fact that the bots abused a real-world website, decided not to classify it as a security incident because the agents didn’t compromise the site; they just used it illicitly. OpenAI classified it as an alignment problem instead, which they didn’t think needed public disclosure!

    OpenAI say they are developing new reporting processes, and will publish details in a few weeks.

    The Details

    Below are what I consider the most important snippets from the following reports:

    “[The agents were] using the site as a shared board to pool answers to a timed web task and pass around a way out of their sandbox.” — The Hacker News

    “The agents were supposed to have read-only Internet access but discovered they could write to an obscure German programming wiki, DSEWiki (or DeutschesSoftwareEntwickler). They turned it into a shared message board for pooling answers, cheating on tests, predicting future questions, and exchanging techniques for bypassing OpenAI’s sandbox restrictions.” — Bleeping Computer

    “OpenAI’s own wording suggests a wider footprint than the researchers documented, describing the episode as one ‘where our agents wrote to several internet sites.’” — Bleeping Computer

    Anthropic Disclosed a Fourth Escape with Real-World Damage

    This is a simpler story than the others, but you can find the full details here: Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 — thehackernews.com/…

    Here’s the opening summary:

    “Anthropic … disclosed a fourth incident in which its artificial intelligence model broke into real third-party systems” — The Hacker News

    This happened back in January, and it was not a case of the agents breaking out, but of Anthropic being careless with their sandbox and doing the digital equivalent of leaving the cage door open.

    Related News — Anthropic’s Latest Threat Report Reveals how their Services are Abused

    The opening of the Anthropic report explains the framing the company want to put on this abuse well:

    “Over the past eight months, our Threat Intelligence team identified and disrupted operations in which threat actors tried to use Claude for malicious activity. In this report, we share case studies from those operations and describe how malicious use of Claude has evolved since our previous threat reports in March, August, and November 2025. In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners, where appropriate.” — Anthropic

    The word disrupted might be a little misleading, it doesn’t mean they prevented these abuses, it means they noticed the and then intervened to stop them continuing. A lot of real-world harm was perpetrated before the disruptions!

    As well as the expected abuse of these services for crafting well tailored phishing lures, and the expected help with creating malware, the most notable detail was that Claude was abused to download and scan 1.8M Android apps, and extract all the hard-coded secrets their developers had left in those apps. This would generally be things like API keys. Claude was abused to stream all the secrets it found to Telegram in real time, broken into over 100 different channels for different types of secrets.

    Another point to note is that it’s not just cybercriminals abusing Claude, but Russian and Chinese state-linked hacking groups, so Anthropic is helping Russia and China spy on, and attack, the West!

    It’s good that Anthropic are open about these abuses, but the question is, are they moving forward too fast, and not putting enough efforts into addressing the abuses of their current models before releasing new ones?

    Links

    Related News — GPT-6 Astra is Better at Cybersecurity and More Difficult to Monitor

    Despite all the recent problems, OpenAI have gone ahead and released GPT-6 Astra anyway. Whatever lip service they paid to slowing down and taking stock, Allison’s scepticism about their seriousness appears to have been warranted 🙁

    You’ll find the full details in the following Bleeping Computer article, but I’ll quote the key points below — OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor — www.bleepingcomputer.com/…

    [GPT-6 Astra is the first model OpenAI have self-certified as reaching its Critical threshold for cybersecurity.] Under OpenAI’s own framework, a model reaches the Critical cybersecurity threshold if it can “identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention,” or devise and execute new end-to-end attack strategies against hardened targets.”
    …
    OpenAI has strengthened Astra’s jailbreak resistance, isolation, checkpoint encryption, monitoring, and internal deployment controls before release.
    …
    The company also claims Astra is better aligned than GPT-5.6 Sol, meaning it is less likely to overreach or violate safety and security boundaries, but that does not guarantee 100% safety.
    …
    One of the more unusual findings is that Astra appears better at controlling what it reveals in its own chain of thought.

    “GPT-6 Astra’s monitorability has decreased relative to GPT-5.6 Sol,” OpenAI acknowledged.

    In tests, OpenAI found that Astra could sometimes hide strategically poor performance and avoid internal monitors during certain sabotage tasks.

    ❗ Action Alerts

    Worthy Warnings

    • Reminder: it’s simply not safe to buy physical gift cards from retail outlets anymore: How organized crime steals millions through an Apple gift card scam — appleinsider.com/…
    • ⚠️ Android Users — beware a new attack technique: Google Play Early Access Abused to Push Thousands of Deceptive Android Apps — thehackernews.com/…
      • As Android tighten the rules on side-loading, attackers are shifting their focus
      • Early Access apps can be downloaded by users who have the link, but are not listed on the public store. They are intended for pre-release testing.
      • Early Access apps have reviews and ratings disabled, so the usual danger signs from the community are impossible
      • Best advice is not to download any early access apps unless you have some kind of relationship with a developer and are genuinely beta-testing an app
    • ⚠️ Travelers: 🇻🇳 220 million traveler records exposed in Vietnam-linked APIS leak — www.bleepingcomputer.com/…
      • The leaked data seems to cover all international passengers who flew to, from, or via Vietnam any time between January 2017 and April 2026
      • The leaked data includes names, dates of birth, flight details, and travel document (passport/ID Card) numbers
      • This was a cloud-hosted database accidentally left exposed, and it’s not even clear who the database belongs to!
      • No breach notifications have been sent
    • ⚠️ Skullcandy Earbud Users: Skullcandy earbuds flaw lets nearby attackers access the microphone — cyberinsider.com/…
      • Affects Skullcandy Dime 3 wireless buds
      • Allows nearby attackers to pair with the buds without putting them into pairing mode or getting the user to approve any prompts
      • No patch available
      • “Owners of affected Dime 3 earbuds should therefore be cautious when using them in public or other environments where unknown devices may be within Bluetooth range.” — Bleeping Computer
    • ⚠️ LG TV Owners: LG Smart TVs found scanning home networks for nearby devices — cyberinsider.com/…
      • Primarily a privacy breach, all the gathered information is being reported back to LG for user profiling
      • Also revealed some security issues
      • Yet more reasons never to connect a TV directly to your network, but to add smarts to TVs using trusted boxes like the Apple TV
    • 🇺🇸 The Florida DMV may to have lost hundreds of thousands of driver records — www.bleepingcomputer.com/…
      • Details still emerging; hackers claim 200,000. The existence of a breach has been confirmed, but not the actual scale
      • No notifications to affected users, at least not yet

    Notable News

    Palate Cleansers

    Legend

    When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top