Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

cnbc.com

Post reply on HN
Print view View original

71–80 of 137 posts

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#71

Post by marcosdumay »

bena wrote: post #27
jeanlucas wrote: post #19

Earlier quoted context omitted.

SMS is not exactly the most secure protocol. But you do not need to use SMS for 2fa, that's a misconception.

Isn't it effectively plaintext? I don't know too much about the SMS protocol. But I do know that most protocols do start out plaintext because programmers are lazy and optimistic.

It's not exactly plaintext. Last time I saw it was using broken crypto (may have changed since then, but I doubt it), and it encrypts the data hop by hop, so that if you insert yourself as a hop, you'll just have decrypt (with your keys), read and encrypt it.

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#72

Post by rubatuga »

tantalor wrote: post #52
axaxs wrote: post #14

I hope he wins, mainly so cell operators will perhaps take security more seriously. Not long ago, I was with T-Mobile. My username was my phone number, and the password, you could request and they'd send it to you in an email. With the climb of social media, our phone numbers are more a part of our identity than ever before, and carriers lack of security is being thrust into the spotlight.

I hope he loses, so financial services will stop supporting 2FA over SMS. Is that more or less likely than SMS providers fixing their security?

How about he wins, and then we slowly wean off a more secure SMS system for everybody?

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#73

Post by rubatuga »

avian wrote: post #68
tessi3r wrote: post #54

While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target. To thi…

> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?

Maybe he means phone -> google account -> android backup -> 2fa keys?

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#74

Post by perl4ever »

cjslep wrote: post #60
perl4ever wrote: post #53

I notice AT&T is quoted as saying "we dispute these allegations and look forward to presenting our case in court". It's interesting they didn't say "these allegations are baseless and without merit". I wonder if that means anything.

A "baseless allegation" is one with no evidence or reason. This guy has a reason and presumably evidence, so his allegations are not baseless. A baseless allegation would be if I were suing AT&T for losing all my crypto investments. I have none and am not an AT&T customer. An "allegation without merit" means no rational interpretation of the law would result in a guilty conviction of the allegations. Baseless ones ar…

You think that lawyers say an allegation is "baseless" iff it is baseless? That's an interesting epistemic outlook.

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#75

Post by koolba »

avian wrote: post #68
tessi3r wrote: post #54

While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target. To thi…

> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?

No that’s wrong. TOTP based 2FA is totally out of band with the only attack vectors being losing your physical device (or a device backup!) or leaking of the secret from the server side.

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#76

Post by aviv »

michrassena wrote: post #55
aviv wrote: post #9

Earlier quoted context omitted.

In the US it is trivial to hijack any mobile number's SMS traffic. It takes less than a minute. SMS as 2FA should never ever be used by anyone.

I see the advice not to use SMS for 2FA comes up a lot on HN, and understand the reasons why that is true. But I find that recommendation comes up short. What are the alternatives, and how can they be widely deployed for little cost?

Even 2FA that involves you receiving a call is more secure than 2FA that involves you getting a text, but of course that too should not be used, ever. It's just that SMS is that much worse. I wish I could share on HN the technique anyone anywhere can use to take over any mobile number's SMS traffic within a minute so we can discuss it at great detail, but obviously I know better and would never do it. Unfortunately this knowledge is not limited to myself and many people out there know this especially after being in telecom for a while.

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#77

Post by Alex3917 »

avian wrote: post #68
tessi3r wrote: post #54

While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target. To thi…

> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?

Google Authenticator doesn’t, Authy does. That’s why you’re not supposed to use Authy for crypto.

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#78

Post by nnash »

village-idiot wrote: post #7

I’m not sure if he has any legal recourse against AT&T, but it’s another example why sms based 2FA is a bad security scheme, especially if you’re a high value target.

FTA:

> After the first hack, Terpin alleged that an impostor was able to get his phone number from an "insider cooperating with the hacker" without an AT&T store employee requiring him to show valid identification or provide a required password.

If what he's alleging is true, then he certainly has a case against AT&T.

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#79

Post by guildenstern »

avian wrote: post #68
tessi3r wrote: post #54

While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target. To thi…

> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?

Authy specifically stores your account in the cloud and can be recovered using SMS. They have a 24 hour warning period during which the email address on file receives multiple notifications that a recovery is being attempted with the option to cancel but if someone has control over your phone number for an extended period of time they can absolutely take over your Authy account. I found this out when my Authy account was corrupted somehow and support said, hey no worries just go through the recovery process.

Google Authenticator is offline only and is not vulnerable.

Re: Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M

#80

Post by zchrykng »

avian wrote: post #68
tessi3r wrote: post #54

While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target. To thi…

> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?

Authy at least will let you "recover" your account by them sending a text message to the associated phone number. Tap the link in the message and presto, 2FA codes.
Post reply on HN