Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

101–110 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#101

Post by macintux »

drdaeman wrote: post #81
macintux wrote: post #60

Earlier quoted context omitted.

I always, always store my bogus answers in 1Password. One of many reasons I love the tool. Most security questions are either trivial for someone else to figure out with a little research or I don't know what my real answer would be. Name of my first pet? Well, I had several that could meet that definition, and I definitely don't remember the name of the first one.

It's actually dangerous. Consider what would happen if you're accidentally exposed to a malware that steals data from the password managers (by introspecting process memory after the data was already decrypted) Better keep those eggs in the different baskets (Update: Point was, I think 1Password doesn't have multiple databases, does it?)

I would expect greater risk if I spread that information around more. Is it really better if only 1/3rd of my passwords are stolen, at least relative to the 3x risk I face by using multiple sources?

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#102

Post by zkms »

Years ago, when SMS 2FA first became a thing, I remember people familiar with telecom stuff pointing out SS7 vulnerabilities and porting/SIM takeover issues. People shouted them down and claimed that they were being too paranoid and exaggerating the risk, or that most people aren't attractive-enough targets for someone to dedicate so much effort for hacking their accounts (and that SMS 2FA was thus good enough for most people).

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#104

Post by devuo »

Last year when I upgraded my phone I was amused — but mostly horrified — by how easily one could get a SIM card for my own phone number with less than a modicum of information on me.

As I required to upgrade my Micro SIM to a Nano SIM, I went to one of my provider's shops and asked for a Nano SIM for phone number X. I was then asked to verbally confirm my name and address — and that's it. No ID card confirmation, no nothing. "Here you go sir, your new SIM card will be active within a few minutes. Can I help you with anything else?". What. the.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#106

Post by sillysaurus3 »

e79 wrote: post #98

You should also make sure providers like Google don't fall back to less secure account recovery methods. I blogged about this here, after I realized that I was still vulnerable even while using real 2FA: https://ericrafaloff.com/google-account-security-and-number-...

Regarding the $8k of bitcoin stolen (https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoi...), that's what you get for storing your coin in Coinbase or someone else's service. If you're not in control of your keys, you don't own the coins. This uncomfortable truth has a way of occasionally poking out, like that story.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#107

Post by lordvon »

TaylorSwift wrote: post #56

This happened to me. 1. I believe it began with the hacker getting DOB/SSN. 2. Called wireless provider, and hacker forward all calls and texts to a burn phone. Eventually, the hacker ported my wireless phone to another provider/number (not sure which), and the phone registered to my provider did not work anymore. The landline phone was also forwarding calls to another number.* 3. Hacker gained access to email (as th…

It seems this was a popular hack at one time. I hope this no longer happens. Anyway it's great that you were able to "shake it off", so to speak.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#108

Post by clebio »

prebrov wrote: post #91
flurdy wrote: post #87

So 2FA reset via SMS is bad, which I agree but what are the alternatives to prevent a meltdown when your 2FA device dies? I have had two phones die on me that was my 2FA device, plus OS upgrades, so I have gone through resetting 10-20 2FA accounts a few times. Though with upgrades usually I foresaw that and downgraded my 2FA before hand. All I wish for was that resetting 2FA would be a very very slow step by step pro…

I use 2FA code generator in cloud-synced 1Password. That endures all software upgrades, unlike Google Authenticator or Authy.

TIL. Thank you.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#109

Post by CamperBob2 »

awinter-py wrote: post #27

Not answering security questions truthfully is tricky. Yes, it's a problem that security questions turn hacking into a simple public records search. BUT most terms of service have a line like 'you warrant that you've been entirely truthful with us' or something. If you give the wrong security question to your bank, they potentially have grounds to freeze your money or screw you later. Why isn't the answer 'consumers…

I always answer security questions with a known grammatical transformation of the question's sentence structure. That way, as long as they use the same parts of speech in the question to prompt me, I'll never forget an answer or have it guessed by an attacker.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#110

Post by femto »

mtgx wrote: post #63

Remember this the next time you may tend to agree with governments' push for backdoors. If they get their way even Google Authenticator won't be safe, just as SMS isn't anymore for 2FA, all because the surveillance agencies preferred to keep the SS7 vulnerability and others like it so they can exploit it ( outside of the "rule of law", as otherwise they wouldn't need it).

But...if a public that doesn't understand the nature of backdoors is fearful of the consequences of backdoors being cracked, it's a short step to turn attempts to crack the backdoor into something terrifying, in which case an attempt to crack the backdoor becomes a justification for its existence.

Yes, I'm cynical on this matter.

Post reply on HN