Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

351–360 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#351

Post by tomrod »

gambiting wrote: post #346
drewmol wrote: post #342

Earlier quoted context omitted.

No, they are not. But ideally the advantage the 'richer' party has in influencing the effort of the investigators/judiciary to put forth more effort on their behalf is not written policy, it is corruption/cronyism. Should we create policy that prioritizes investigating an auto theft of a $100,000 automobile with more resources and severity that the theft of a $20,000 one, simply because the value is larger, or weight…

I guess the theft of a more expensive car should be investigated with higher priority because selling it gives criminals more money to work with and leads to more severe crime. A group that can steal and sell a Lamborghini likely runs a much larger and more organized operation than a group which steals and sells old cheap cars. This is all guessing though, I'd love to see more data on it.

This assumes a linear margin on units of stolen cars to value. Smaller ticket items are easier to fence specifically because they are common. It's hard to sell the Mona Lisa. It's easy to sell a mass-produced TV. Cops would spot a stolen Lamborghini as soon as the APB comes in. Not so much for a Toyota Camry.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#352

Post by scott00 »

downandout wrote: post #221
MichaelGG wrote: post #124

Earlier quoted context omitted.

They won't go after an attacker if there's not a high amount of damage, like $250K or more. FBI guys are swamped with people calling, and there's just not enough agent time to go around. Same for bank fraud. Ever wonder how people get away with popping someone's bank account, transferring to another local account, and walking off with the cash? For a couple grand, no one's gonna spend the time and effort to track you…

And yet then you see things like this [1], where the 4 year old case of a very minor eBay scammer is personally prosecuted by a state Attorney General. I guess it depends on who has time to kill. These two guys are looking at decades in prison for a scam that looks to have netted about $3K. [1] http://ag.nv.gov/News/PR/2017/Attorney_General_Laxalt_Announ...

Why do you think he personally prosecuted it? His name's on the complaint, but it's on all the complaints referenced in their press releases. The press release says the case "was investigated and is being prosecuted by the Attorney General’s Fraud Unit".

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#353

Post by trentmb »

metafunctor wrote: post #52
awinter-py wrote: post #27

Not answering security questions truthfully is tricky. Yes, it's a problem that security questions turn hacking into a simple public records search. BUT most terms of service have a line like 'you warrant that you've been entirely truthful with us' or something. If you give the wrong security question to your bank, they potentially have grounds to freeze your money or screw you later. Why isn't the answer 'consumers…

I answer mandatory security questions with things like these: “This account must never be unlocked over phone, chat, or email.” “Never reveal any information about this account (such as address or CC numbers) via support channels” “The person you are discussing with is a hacker trying to illegally access this account” I expect to never, ever have to use the security questions myself. Sometimes, I enter random phrases…

> Sometimes, I enter random phrases.

Yeah, I just use a passphrase generator in keepass.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#354

Post by creepydata »

tomrod wrote: post #351
gambiting wrote: post #346

Earlier quoted context omitted.

I guess the theft of a more expensive car should be investigated with higher priority because selling it gives criminals more money to work with and leads to more severe crime. A group that can steal and sell a Lamborghini likely runs a much larger and more organized operation than a group which steals and sells old cheap cars. This is all guessing though, I'd love to see more data on it.

This assumes a linear margin on units of stolen cars to value. Smaller ticket items are easier to fence specifically because they are common. It's hard to sell the Mona Lisa. It's easy to sell a mass-produced TV. Cops would spot a stolen Lamborghini as soon as the APB comes in. Not so much for a Toyota Camry.

I remember reading somewhere the top car make/model stolen was the Honda Civic.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#355

Post by module0000 »

drewmol wrote: post #342
module0000 wrote: post #326

Earlier quoted context omitted.

> "That's not how modern Western societies work." Are you sure? Maybe you believe they shouldn't work that way, but do you believe they truly are blind to the net worth of the offended party?

No, they are not. But ideally the advantage the 'richer' party has in influencing the effort of the investigators/judiciary to put forth more effort on their behalf is not written policy, it is corruption/cronyism. Should we create policy that prioritizes investigating an auto theft of a $100,000 automobile with more resources and severity that the theft of a $20,000 one, simply because the value is larger, or weight…

We disagree then, I think they absolutely should prioritize that because of the tax contribution of the victim. If I pay someone $1000 for a job, and you pay the same person $100 for an opposing job - you should lose. That's only my capitalist opinion, but I don't think it's an unpopular one.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#356

Post by dx034 »

jessaustin wrote: post #348
llukas wrote: post #172

Earlier quoted context omitted.

Why they keep that system? In most of Europe you got "normal" banking system where you can give everyone your account number and worse thing they can do is to put some money there. In US it seems #freemarket is putting externalities (security) on the customer.

I never experienced this directly, but when Chip'n'Pin first came out, wasn't it the case that some European banks held customers responsible when it got hacked? The theory was apparently that it was "impossible" to hack Chip'n'Pin so something must have been the customer's fault...

Isn't it still impossible? You can only hack it if you can guess the PIN or in cases where the victim wrote it on the card. The latter happens quite often and this is where banks sometimes refuse to pay.

If you keep your PIN secret it's a very secure system (unless the attacker is very lucky).

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#357

Post by creepydata »

ktta wrote: post #155
gens wrote: post #144

Earlier quoted context omitted.

> Why would they care? Because it is their job.

>criminals are out of their jurisdiction We are in dire need of specific cyber security public divisions are people can go to. FBI I believe will have many problems to deal with, and as far as I know, there isn't any cyber-police division capable at the city/state level. Atleast nothing capable of handling incidents like the one mentioned above. The debate of who's job it is can get hairy. Especially with the future…

The FBI claims jurisdiction on crimes committed by foreign national against Americans. It's just hard to investigate and arrest individuals who aren't on US soil, but not absolutely impossible. They arrested a Russian ID theft a while back, but they had to lure him out of Russia to do so, as the Russian authorities didn't cooperate.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#358

Post by dx034 »

0898 wrote: post #198
llukas wrote: post #172

Earlier quoted context omitted.

Why they keep that system? In most of Europe you got "normal" banking system where you can give everyone your account number and worse thing they can do is to put some money there. In US it seems #freemarket is putting externalities (security) on the customer.

Jeremy Clarkson made a similar argument and even published his bank details. Then this happened: http://news.bbc.co.uk/1/hi/7174760.stm

So what? Someone set up a direct debit, he can just cancel it and get the money back. Of course it will take a bit (a few seconds with online banking nowadays) but you wouldn't lose any money. There's no way someone can get money from a UK bank account by just knowing the account number, assuming that you check your account regularly.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#359

Post by creepydata »

aptwebapps wrote: post #150
closeparen wrote: post #121

Earlier quoted context omitted.

The ACH model is fundamentally insecure: anyone who knows your account number can pull money from it, and the protocol makes no allowance for the bank to check with you first. I don't think choice of bank matters very much. You can manage your risk somewhat by: 1) Using credit and not debit cards for day to day spending. 2) Maintaining your long term wealth in separate accounts at separate institutions and not linkin…

I read somewhere that companies that do a lot of ACH payments use different accounts for receiving and sending payments. The receiving account is locked so that it can't send and the sending account is supposed to stay secret. I don't know if that actually works in practice, though.

If you give someone a paper check you are giving them your account number in plain text. I don't see how they can make that "secret."

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#360

Post by creepydata »

dx034 wrote: post #356
jessaustin wrote: post #348

Earlier quoted context omitted.

I never experienced this directly, but when Chip'n'Pin first came out, wasn't it the case that some European banks held customers responsible when it got hacked? The theory was apparently that it was "impossible" to hack Chip'n'Pin so something must have been the customer's fault...

Isn't it still impossible? You can only hack it if you can guess the PIN or in cases where the victim wrote it on the card. The latter happens quite often and this is where banks sometimes refuse to pay. If you keep your PIN secret it's a very secure system (unless the attacker is very lucky).

Man in the middle https://arstechnica.com/tech-policy/2015/10/how-a-criminal-r...
Post reply on HN