Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

151–160 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#151

Post by cynicalbastard »

xbmcuser wrote: post #119
49531 wrote: post #65

A few months ago I took 3 of my 4 kids to a birthday party at a minigolf course. I played some holes with my youngest I had taken with me, and then left the two older ones at the birthday party with the understanding that their mother would pick them up (as we had discussed earlier) After leaving the party with my youngest, I went to the grocery store, and then on home. When I got home my wife was gone, which I expec…

In Singapore they give us a physical token. We have to enter the 2Fa we receive into it to receive a third code to enter into the website. Well I guess it's 3Fa. It is a bit of a hassle but better safe than sorry.

in the US, this is normal for business accounts, but not for personal. i believe you can get it if you request it though.

in either case, i keep as little cash in my personal bank accounts as possible.

i'm concerned about my parents as they get older though...

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#152

Post by PerfectElement »

altano wrote: post #137
PerfectElement wrote: post #128

Earlier quoted context omitted.

Is 2fa with SMS safer or less safe than no 2fa at all?

It's certainly safer than only using a password if you use the same password on lots of sites, since the odds of any password database being hacked are higher than the odds of your phone being targeted.

Thanks. This thread was giving me the impression that adding 2fa with SMS to a system would make it more vulnerable somehow.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#153

Post by pascalxus »

So, I've read the article a couple of times, It's pretty long. For those of you looking to get the most bang for your buck, I think the following advice is Golden:

1. Do NOT secure your sensitive accounts (facebook, primary email, bank accounts, twitter, etc) with your telco phone #. Telco Phone number is NOT secure!

"Create a brand new Gmail email account. Do not connect it to any of your existing email accounts. (When signing up for a new Gmail, you don’t need to enter a phone number or current email, although there are fields for you to do so. Leave them blank.) Once you’ve created the new island-unto-itself email address, create a new Google Voice number." Use this Google Voice # to secure your primary accounts, and don't have your telco # listed in any of those accounts.

But, make sure your New Gmail account is super secure, with a security key, as mentioned in the article.

2. Check the password recovery methods for all your sensitive accounts and make sure the answers aren't duplicated from any other site. Actually, it's best to remove them, if you can.

If any security experts want to chime in, please do.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#154

Post by PerfectElement »

noobermin wrote: post #7

NIST has already been discouraging the use of SMS for 2fa[0], but that apparently won't stop the subset of incompetent IPSec consultants who still recomment SMS based 2fa. [0] www.slate.com/blogs/future_tense/2016/07/26/nist_proposes_moving_away_from_sms_based_two_factor_authentication.html

Wouldn't SMS 2FA have a higher adoption rate among non-technical users, hence making it more suitable for certain types of systems?

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#155

Post by ktta »

gens wrote: post #144
adekok wrote: post #62

Earlier quoted context omitted.

> The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. Why would they care? It happens dozens of times a day, and the criminals are out of their jurisdiction. If only the police, FBI, politicians, etc. could go after the banks and telcos to improve their security. But no... they see it as their job to destroy security, in order to make you "safe".

> Why would they care? Because it is their job.

>criminals are out of their jurisdiction

We are in dire need of specific cyber security public divisions are people can go to. FBI I believe will have many problems to deal with, and as far as I know, there isn't any cyber-police division capable at the city/state level.

Atleast nothing capable of handling incidents like the one mentioned above. The debate of who's job it is can get hairy. Especially with the future where internet is becoming more pervasive, there can be more damage.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#156

Post by pishpash »

xbmcuser wrote: post #119
49531 wrote: post #65

A few months ago I took 3 of my 4 kids to a birthday party at a minigolf course. I played some holes with my youngest I had taken with me, and then left the two older ones at the birthday party with the understanding that their mother would pick them up (as we had discussed earlier) After leaving the party with my youngest, I went to the grocery store, and then on home. When I got home my wife was gone, which I expec…

In Singapore they give us a physical token. We have to enter the 2Fa we receive into it to receive a third code to enter into the website. Well I guess it's 3Fa. It is a bit of a hassle but better safe than sorry.

Seriously, I don't understand why physical tokens are not the norm and standardized on all devices, still. It isn't a new concept at all.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#157

Post by pishpash »

wapz wrote: post #148
Shank wrote: post #140

Earlier quoted context omitted.

Last week I walked into a T-Mobile store and asked for a new SIM card to replace one I lost. I gave them the phone number and apparently an invalid pin (the sales rep verified that I gave him the wrong PIN). I asked if I should do something else to verify it was my account and nothing. They didn't ask for name, ID, or anything else, and they didn't charge me for the SIM card. I went home and popped it in and my accou…

Your story reminds me of when I ordered a $200 video card from Staples ship to store. I went to the cashier and told them they should have a video card I ordered. They asked for my name and gave it to me (inside the shipping box so they didn't even know the contents). It's not as bad as getting your phone number stolen but it opened my eyes how easy it would be to "steal" a package.

The problem with all these stories is that there is a physical interaction. Maybe there is a video or whatever, but for some reason people easily let their guard down when transaction is conducted in person.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#159

Post by buyx »

These attacks have been going on for at least a decade in South Africa. The fact that it's still going on, and if the coverage is to be believed, spreading globally, is a pretty shocking indictment of the industry.

I wonder what other scams are being incubated in lesser-known parts of the world, that are waiting to be unleashed.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#160

Post by pascalxus »

legohead wrote: post #75

I read a blog where someone got hacked through a simcard clone, and they went into the details of how easy it was to do. This prompted me to enable 2fa on everything I could, but the funny thing is, a lot of the backup options for 2fa is -- you guessed it -- your cell phone number. Some of them don't even allow you not to use your cell phone as a backup. I think Github and Slack are like this, but I may be wrong, it…

The most important thing is: DONT use your telco phone number in any of your sensitive accounts. Replace that phone number with a Secure phone number: the article recommends using Google Voice -> since this can't be compromised in the same way that a telco phone # can be.
Post reply on HN