Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

211–220 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#211

Post by gambiting »

csomar wrote: post #195
MichaelGG wrote: post #124

Earlier quoted context omitted.

They won't go after an attacker if there's not a high amount of damage, like $250K or more. FBI guys are swamped with people calling, and there's just not enough agent time to go around. Same for bank fraud. Ever wonder how people get away with popping someone's bank account, transferring to another local account, and walking off with the cash? For a couple grand, no one's gonna spend the time and effort to track you…

Which is interesting because it should be the other way around. If you have $250k stolen, it is bad but you are probably wealthy enough you won't go in deep trouble stress. If your whole account is $2k it might be a different world for you and you might relying on these to pay rent, medical expenses which is more serious than an investor not having access to his $250k. Not meaning it is fine to steal $250k from wealt…

>> If you have $250k stolen, it is bad but you are probably wealthy enough you won't go in deep trouble stress.

Or it might be your entire life's savings and if you can't get it back you kill yourself from the stress of losing 40+ years of work. It's very dangerous to make assumptions about other people's money.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#212

Post by lrem »

antimatter wrote: post #192
lrem wrote: post #55

Earlier quoted context omitted.

Because their target markets contain both people who'll gladly spend 50 quid on the latest account security dongle, as well as people who have a Pentium 4 desktop and a 50 quid feature phone. The latter get much more secure when apart from a password, probably on a post it stuck next to the screen, they are inconvenienced to also type in a few digits from SMS.

You are 100% correct. But I'm genuinely curious why institutions such as banks/telcos couldn't spare the resources to offer both SMS 2FA and more secure options for those who do care. I can't imagine it's a matter of technical resources as it wouldn't take much. Is it institutional inertia? technical debt?

Security model of banks is completely different from everything else. They will only consider 2FA if the total calculated cost /to them/ becomes significant if they don't.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#213

Post by [deleted] »

antimatter wrote: post #192
lrem wrote: post #55

Earlier quoted context omitted.

Because their target markets contain both people who'll gladly spend 50 quid on the latest account security dongle, as well as people who have a Pentium 4 desktop and a 50 quid feature phone. The latter get much more secure when apart from a password, probably on a post it stuck next to the screen, they are inconvenienced to also type in a few digits from SMS.

You are 100% correct. But I'm genuinely curious why institutions such as banks/telcos couldn't spare the resources to offer both SMS 2FA and more secure options for those who do care. I can't imagine it's a matter of technical resources as it wouldn't take much. Is it institutional inertia? technical debt?

[deleted]

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#214

Post by gambiting »

csomar wrote: post #196
49531 wrote: post #65

A few months ago I took 3 of my 4 kids to a birthday party at a minigolf course. I played some holes with my youngest I had taken with me, and then left the two older ones at the birthday party with the understanding that their mother would pick them up (as we had discussed earlier) After leaving the party with my youngest, I went to the grocery store, and then on home. When I got home my wife was gone, which I expec…

> someone went into a T-Mobile store and somehow convinced the associate that my number was theirs. The fact that the T-Mobile employees can get hold of your mobile phone number is disturbing and a red flag for using your phone number for sensitive stuff (such as money). You should always assume malice from unknown actors.

I don't know where OP is from, but over here(Poland) you need two forms of ID(Passport/national ID/driving licence) if you want the T-Mobile clerk to do anything for you in-store. I got quite annoyed once because I needed a new sim-card for my company phone, but despite having two forms of ID confirming that I am the company owner, they also wanted to see the incorporation papers saying so.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#215

Post by gambiting »

itslennysfault wrote: post #77

I'm SHOCKED this wasn't a thing earlier. Spoofing a phone number is insanely easy. When I was in High School we figured out how to do it and used to prank call people from other peoples numbers. Eventually, we realized that if you call someone's cell from their own number it takes you directly into the voicemail admin menu. Fun times.

That's a bit different than receiving text messages aimed at a different number.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#216

Post by kbart »

49531 wrote: post #65

A few months ago I took 3 of my 4 kids to a birthday party at a minigolf course. I played some holes with my youngest I had taken with me, and then left the two older ones at the birthday party with the understanding that their mother would pick them up (as we had discussed earlier) After leaving the party with my youngest, I went to the grocery store, and then on home. When I got home my wife was gone, which I expec…

"Apparently after I had left, someone went into a T-Mobile store and somehow convinced the associate that my number was theirs."

How that can happen? When I visit my cell provider's store, nobody is going to talk about any account details while you haven't provided a government issued ID to prove that you are an account holder. Sure, it's not 100% bulletproof method, but if somebody went a great lengths to counterfeit my ID, phone number is the least of my worries then. I assume, this happened in USA, so is ID check so unpopular there or it's easily circumvented somehow?

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#217

Post by csomar »

gambiting wrote: post #211
csomar wrote: post #195

Earlier quoted context omitted.

Which is interesting because it should be the other way around. If you have $250k stolen, it is bad but you are probably wealthy enough you won't go in deep trouble stress. If your whole account is $2k it might be a different world for you and you might relying on these to pay rent, medical expenses which is more serious than an investor not having access to his $250k. Not meaning it is fine to steal $250k from wealt…

>> If you have $250k stolen, it is bad but you are probably wealthy enough you won't go in deep trouble stress. Or it might be your entire life's savings and if you can't get it back you kill yourself from the stress of losing 40+ years of work. It's very dangerous to make assumptions about other people's money.

Do you usually have your life savings in a checking bank account and not in an IRA account? Shouldn't that has more red-flags for the bank.

I'm not saying that investigating the $250k is not important; but just not more urgent than the $2k theft.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#219

Post by gambiting »

csomar wrote: post #217
gambiting wrote: post #211

Earlier quoted context omitted.

>> If you have $250k stolen, it is bad but you are probably wealthy enough you won't go in deep trouble stress. Or it might be your entire life's savings and if you can't get it back you kill yourself from the stress of losing 40+ years of work. It's very dangerous to make assumptions about other people's money.

Do you usually have your life savings in a checking bank account and not in an IRA account? Shouldn't that has more red-flags for the bank. I'm not saying that investigating the $250k is not important; but just not more urgent than the $2k theft.

Taking money out of an IRA into your checking bank account is usually two clicks with my bank, I'd get a warning about losing interest if I take the money out but I can do it anyway and the money is available instantly - for all intentions and purposes it might just as well be in a checking account, and it certainly won't make any different to an attacker who got into my account.

>>I'm not saying that investigating the $250k is not important; but just not more urgent than the $2k theft.

I'd argue that it's a lot more urgent. What if you were paying for a house tomorrow, and the money is gone, so you lose the house? Or you are a small company that has to pay its tax bill for the year, but the money is gone? Or you have to pay for an expensive operation that won't go forward otherwise?

2k is not as important in a way that if you are really short of 2k, then there is a plethora of options to come up with 2k on a short notice(some astonishingly bad like payday loans but there are options) - while if you are out of 250k and need 250k then most likely you are absolutely screwed.

Again, to repeat my final point - don't make assumptions about people's money.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#220

Post by microtonal »

lonewolf_ninja wrote: post #191
msh wrote: post #169

Earlier quoted context omitted.

Authenticators are fine but u2f keys are better because they protect against phishing.

What is a good u2f key you'd recommend?

I have used Yubico's U2F key since shortly after they came out (Nov 2014). They are very robust and relatively cheap. Moreover, in contrast to some cheaper keys, they require physical confirmation by a finger press.
Post reply on HN