This security feature might not be so secure after all.
Apple and Android users have been urged to stop receiving two-factor authentication codes via text after government officials revealed a massive telecom breach could expose non-encrypted messages to malicious actors.
Earlier this month, the FBI implored smartphone users to use encrypted messaging platforms such as Signal or WhatsApp after the bad actors, suspected to be from China, hacked into AT&T, T-Mobile, Verizon and five other networks to spy on customers.
On Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) released a new memo outlining best practices for mobile communication in the wake of the network hack, advising people to stop using SMS as a second factor for authenticating online accounts.
“SMS messages are not encrypted — a threat actor with access to a telecommunication provider’s network who intercepts these messages can read them,” the CISA declared.
Receiving codes via SMS are “not phishing-resistant,” meaning it is not a secure method of verification for high-profile targets.
Instead, the agency encouraged the use of authentication apps — although those are still subject to breaches — or FIDO authentication and passkeys, which are considered the most secure method of verification.
While some services online may not have another option for two-factor authentication, the agency urged users to use alternative methods when possible to minimize the risk of being hacked. They also recommended using a password manager, using strong passwords, setting a PIN when possible and keeping personal devices up to date.
The advisory follows the news earlier this month of network breaches, dubbed Salt Typhoon, which experts speculate is “ongoing and likely larger in scale than previously understood.”
Officials were unable to declare with certainty that the malicious actors had been successfully eradicated from the networks.
“We cannot say with certainty that the adversary has been evicted,” Jeff Greene, the executive assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency (CSIA), told Politico.
“We’re on top of tracking them down… but we cannot with confidence say that we know everything, nor would our partners.”