Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

81–90 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#81

Post by drdaeman »

macintux wrote: post #60
awinter-py wrote: post #53

Earlier quoted context omitted.

I don't use real answers either because I'm paranoid about this stuff, but it always causes trouble when I have to interact with an institution. Examples: - I lost my health insurance for 6 months because I couldn't dig up my 'secret answer' in time to activate COBRA. - My credit card expired while I was traveling and I couldn't reactivate it because I didn't know what answer I had given to 'mother's maiden name'. (I…

I always, always store my bogus answers in 1Password. One of many reasons I love the tool. Most security questions are either trivial for someone else to figure out with a little research or I don't know what my real answer would be. Name of my first pet? Well, I had several that could meet that definition, and I definitely don't remember the name of the first one.

It's actually dangerous.

Consider what would happen if you're accidentally exposed to a malware that steals data from the password managers (by introspecting process memory after the data was already decrypted)

Better keep those eggs in the different baskets (Update: Point was, I think 1Password doesn't have multiple databases, does it?)

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#82

Post by [deleted] »

adekok wrote: post #62
TaylorSwift wrote: post #56

This happened to me. 1. I believe it began with the hacker getting DOB/SSN. 2. Called wireless provider, and hacker forward all calls and texts to a burn phone. Eventually, the hacker ported my wireless phone to another provider/number (not sure which), and the phone registered to my provider did not work anymore. The landline phone was also forwarding calls to another number.* 3. Hacker gained access to email (as th…

> The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. Why would they care? It happens dozens of times a day, and the criminals are out of their jurisdiction. If only the police, FBI, politicians, etc. could go after the banks and telcos to improve their security. But no... they see it as their job to destroy security, in order to make you "safe".

[deleted]

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#83

Post by averagewall »

drdaeman wrote: post #70

2FA (including U2F and whatever else) has one big problem that this article fails to mention. And when 2FA is suggested, this really should be said explicitly. Users aren't warned enough about the fact that everything fails, and they will have to go through 2FA deactivation/account recovery process sooner or later. They must be really reminded to DO BACK UP the recovery code(s). With "back up" as in "keep not just so…

This is what somehow doesn't get mentioned as much as security. It's a tradeoff between not getting hacked, not getting locked out by accident, and convenience. If you get locked out of Gmail, you're up the creek. Google won't help. It's just gone forever.

Having 2 factors increases the chance that you'll lock yourself out. If you've got two, then you really need 4:

1) Password

2) 2FA

3) Backup codes for when you lose the 2FA device/number

4) Phone number or email address for password recovery when you forget your password. Not the same number as 2 of course.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#85

Post by chrisper »

TaylorSwift wrote: post #56

This happened to me. 1. I believe it began with the hacker getting DOB/SSN. 2. Called wireless provider, and hacker forward all calls and texts to a burn phone. Eventually, the hacker ported my wireless phone to another provider/number (not sure which), and the phone registered to my provider did not work anymore. The landline phone was also forwarding calls to another number.* 3. Hacker gained access to email (as th…

So, how much money did you lose if any?

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#86

Post by Thriptic »

occamrazor wrote: post #45

Would this attack be neutralized by a mandatory waiting period of a few weeks for number porting? I recently ported my number to another operator (in a European country), I had to wait for a month and received at least two warning SMS.

It would but the average user would be pissed if they went into a retail store and were told that they had to wait weeks to use their new phone. They might decide to abort the purchase.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#87

Post by flurdy »

So 2FA reset via SMS is bad, which I agree but what are the alternatives to prevent a meltdown when your 2FA device dies?

I have had two phones die on me that was my 2FA device, plus OS upgrades, so I have gone through resetting 10-20 2FA accounts a few times. Though with upgrades usually I foresaw that and downgraded my 2FA before hand.

All I wish for was that resetting 2FA would be a very very slow step by step process and spammingly broadcasted to all emails, sms, postal etc associated with the account. But I know for cost cutting customer services departments that wont happen.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#88

Post by ddcc7 »

pricechild wrote: post #46
kuschku wrote: post #26

Earlier quoted context omitted.

There’s a far worse example: PayPal only supports SMS based 2FA, or, if you dig through their old website with archive.org, you can find a way to use one of their proprietary 2FA devices. Support for TOTP? HOTP? Nope.

Those proprietary 2FA devices are just TOTP with a weird provisioning system. You can use a tool such as https://github.com/dlenski/python-vipaccess to use google authenticator/freeotp etc. to access paypal. That said... I believe you still need a mobile number enrolled to enable a token.

The direct URL is https://www.paypal.com/us/cgi-bin/webscr?cmd=_setup-security... , it's no longer accessible from their new web interface.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#89

Post by chrisper »

The issue I have with 2FA without sms is that I need to also take care of recovery codes. Basically, it's like erasing all the benefits of going digital, since now I have to store (and take care of) paper copies of recovery codes.

If I use a 2FA app like the Google one and lose my phone, I need to have the codes ready. If I were to use my phone number, I kind of don't need that since I just get a new sim and a new phone. But at the same time that is not safe now.

So what is the solution here? I liked the idea of something like DUO but not enough places use it.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#90

Post by jeffwilcox »

legohead wrote: post #75

I read a blog where someone got hacked through a simcard clone, and they went into the details of how easy it was to do. This prompted me to enable 2fa on everything I could, but the funny thing is, a lot of the backup options for 2fa is -- you guessed it -- your cell phone number. Some of them don't even allow you not to use your cell phone as a backup. I think Github and Slack are like this, but I may be wrong, it…

With GitHub the SMS backup option is just a secondary choice, not required.

A UbiKey or similar device or just storing the recovery codes + using an app is the best route in that one.

Post reply on HN