Listen to a SIM-Jacking, Account-Stealing Ransom • Hacker News Board

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#71

Post by narrator » Thu, Oct 11, 2018, 11:58 PM UTC

phire wrote: post #63

themagician wrote: post #25

This is something that really worries me. I use token based 2FA when I can but the reality is that I have like 50 accounts with 2FA and I forget which ones have SMS as a backup. I'm sure there's an account in there somewhere that's at risk. I have AT&T and use the extra security PIN code, but I know it's not 100% guaranteed. The other day I got a robocall asking for my PIN and last for of my social. I didn't do it, b…

I talked to my cell phone provider and asked them if there was anything they could do to prevent transfering of my number. They said the best they could do was to add a note to my file to check id in store before transferring . This is better than nothing, but relies on the CS representative actually seeing the note on my file. Even then, there might be ways around it. And more importantly, it does noting to stop som…

Running it through google voice will make it subject to your google 2fa.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#72

Post by walrus01 » Fri, Oct 12, 2018, 12:14 AM UTC

exabrial wrote: post #7

Dear everyone at Apple, Facebook, Google, etc. Please stop and remove the ability to use texting as 2FA. The mobile telecom industry is not hardened.

> The mobile telecom industry is not hardened.

The PSTN and phone system telecom industry in general is not hardened. The more you see the underpinnings of it, as I have, the more it looks like a bunch of 30-year-old bullshit held together with the technological equivalent of duct tape and twine.

SS7 needs to be burnt to the ground, the ashes stomped around on a bit, and shoveled into a dustbin.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#73

Post by chris_mc » Fri, Oct 12, 2018, 12:54 AM UTC

crazysim wrote: post #52

chris_mc wrote: post #20

Earlier quoted context omitted.

Google has a new account setting called Advanced Protection. All it accepts is two hardware U2F keys (primary and backup) and your password. It supposedly makes your Google account pretty hardened. The only issue is that you can only use Chrome with U2F keys right now because Firefox U2F isn't fully baked yet. I'm using it with the Titan keys (they're not my favorite, but work) and it works pretty well. I can't do as…

Weird, I have U2F keys in my non-Advanced Protection account.

Maybe I was looking in the wrong place, good to know, thanks.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#74

Post by chris_mc » Fri, Oct 12, 2018, 12:57 AM UTC

cmg wrote: post #62

chris_mc wrote: post #20

Earlier quoted context omitted.

Google has a new account setting called Advanced Protection. All it accepts is two hardware U2F keys (primary and backup) and your password. It supposedly makes your Google account pretty hardened. The only issue is that you can only use Chrome with U2F keys right now because Firefox U2F isn't fully baked yet. I'm using it with the Titan keys (they're not my favorite, but work) and it works pretty well. I can't do as…

For what it's worth, I use a U2F key regularly with Firefox. Just enable the security.webauth.u2f flag under about:config. I realize that's not a good solution for everyone, but if you're just looking to do it for yourself it works.

You know, I figured out what the problem was and it works now. I had setup FF Sync on a PC that didn't have U2F turned on yet.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#75

Post by walrus01 » Fri, Oct 12, 2018, 1:57 AM UTC

For anyone who wants to know how easy it is to social engineer big-4 mobile phone carrier customer service people... I highly recommend reading Mitnick's "art of deception" book on social engineering in general.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#76

Post by toomuchtodo » Fri, Oct 12, 2018, 2:13 AM UTC

walrus01 wrote: post #72

exabrial wrote: post #7

Dear everyone at Apple, Facebook, Google, etc. Please stop and remove the ability to use texting as 2FA. The mobile telecom industry is not hardened.

> The mobile telecom industry is not hardened. The PSTN and phone system telecom industry in general is not hardened. The more you see the underpinnings of it, as I have, the more it looks like a bunch of 30-year-old bullshit held together with the technological equivalent of duct tape and twine. SS7 needs to be burnt to the ground, the ashes stomped around on a bit, and shoveled into a dustbin.

> The more you see the underpinnings of it, as I have, the more it looks like a bunch of 30-year-old bullshit held together with the technological equivalent of duct tape and twine.

This happens to every system eventually if it lives long enough.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#77

Post by [deleted] » Fri, Oct 12, 2018, 2:39 AM UTC

mherdeg wrote: post #49

The "OG account" stuff is fascinating. ( see e.g. https://waypoint.vice.com/en_us/article/43ebpd/the-long-weir... for screenshots of forum or https://medium.com/@N/how-i-lost-my-50-000-twitter-username-... ). Also fascinating is that the only functional support channel is "write a blog post and hope a lot of people upvote it on a news aggregator". Two really interesting trends there.

[deleted]

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#78

Post by Exuma » Fri, Oct 12, 2018, 3:47 AM UTC

Can someone please point out what is the solution to bypass all these headaches? Can I get a separate phone account that is under a business entity or something (not a personal name)? Would that work?

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#79

Post by psergeant » Fri, Oct 12, 2018, 3:47 AM UTC

jandrese wrote: post #68

palunon wrote: post #41

Earlier quoted context omitted.

You have no obligation to answer the secure questions truthfully, or not to write a long random string of text... Starting with "Do not accept the answer if I can't spell this exactly" in case a human gets involved...

Of course you'll be SOL if you legitimately lose your password and the answers to those questions.

Sounds like a good reason to use a password manager and good backups to store them?

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#80

Post by walrus01 » Fri, Oct 12, 2018, 4:35 AM UTC

toomuchtodo wrote: post #76

walrus01 wrote: post #72

Earlier quoted context omitted.

> The mobile telecom industry is not hardened. The PSTN and phone system telecom industry in general is not hardened. The more you see the underpinnings of it, as I have, the more it looks like a bunch of 30-year-old bullshit held together with the technological equivalent of duct tape and twine. SS7 needs to be burnt to the ground, the ashes stomped around on a bit, and shoveled into a dustbin.

> The more you see the underpinnings of it, as I have, the more it looks like a bunch of 30-year-old bullshit held together with the technological equivalent of duct tape and twine. This happens to every system eventually if it lives long enough.

My biggest takeaway from it is that many things standardized before a certain era are based entirely on two concepts of operations:

a) only a certain elite group of people or companies will be able to use it (in this case, PSTN operators)

b) total trust between all parties using it, so there's no need for provably-hardened cryptography.

both of which are now laughable in a modern network security threat environment.

In this case SS7 was just never designed with the concept that malicious third parties might get access to it, or that it would not be operated by RBOCs (regional bell operating companies), or the international equivalent thereof (national run telcos such as British Telecom, Telecom Italia, etc).