The Most Expensive Lesson of My Life: Details of SIM Port Hack
1–10 of 251 posts
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#2Although very sad for this person, his warnings aren't correct. SIM porting is one avenue of attack, but TOTP can also be phished through a http reverse proxy. Push based 2fa is better, U2F based hardware keys are the gold standard today.
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#3SMS should not be used for anything even remotely related to security. If you still need to be convinced, the Reply All episode about it[0] is eye opening while being entertaining.
[0] https://gimletmedia.com/shows/reply-all/v4he6k/130-the-snapc...
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#4[deleted]
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#5This is frightening. If you're using texts for 2-factor auth you're at the mercy of your phone service provider's customer service. And they're trying to balance being helpful with security, which can be in opposition. Losing $100,000 with no hope of recovery is the kind of thing that could sink many people's finances.
His summary of how to avoid having this happen to you:
* Use a hardware wallet to secure your crypto
* SMS-based 2FA is not enough
* Reduce your online footprint
* Use Google Voice for 2FA
* Create a secondary email address
* Use an offline password managerRe: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#6> Do not leave funds idle on exchanges or fiat on-ramps.
This warning has been publicly repeated hundreds of times since 2010, yet people still insist on ignoring it.
The author didn't lose anything. He gave Coinbase his bitcoin in exchange for a promise to pay it back. That deal backfired.
> I knew the risks better than most, but never thought something like this could happen to me.
There's knowing the risk, and then there's knowing the risk. I'd suggest that the author didn't really know the risk, or he would never have considered leaving such a valuable asset in the care of an organization so ill-equipped to safeguard it.
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#7How can a mobile carrier operate like this?? No authentication that the request isn't fraudulent?
In Sweden I switched to another carrier, still keeping the number in the same name. To do that I got a text message with a code I had to input to initiate the process.
When I ported my phone number from my father to me within the same carrier when I turned 18 that required the same confirmation to initiate the process and signed request/approval both from me and my father posted to the company, with associated emails about the process.
This isn't even hard? This is just basic steps to prevent identity theft....
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#8> Do not leave funds idle on exchanges or fiat on-ramps. This warning has been publicly repeated hundreds of times since 2010, yet people still insist on ignoring it. The author didn't lose anything. He gave Coinbase his bitcoin in exchange for a promise to pay it back. That deal backfired. > I knew the risks better than most, but never thought something like this could happen to me. There's knowing the risk, and the…
Honestly, put it into Coinbase's vault (locked for 48 hours).
People want the convenience of being able to trade while also wanting security. Eat the cost of transferring from a hardware wallet.
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#9How can a mobile carrier operate like this?? No authentication that the request isn't fraudulent? In Sweden I switched to another carrier, still keeping the number in the same name. To do that I got a text message with a code I had to input to initiate the process. When I ported my phone number from my father to me within the same carrier when I turned 18 that required the same confirmation to initiate the process an…
This is not about porting the number to a different carrier or even a different owner though. It's more analogous to getting a replacement SIM card.
The last time I had a phone stolen, I went to the carrier's store, they checked my ID, and gave me a replacement SIM. And the things is, if the customer service representative is empowered to do that, they could also be bribed by the attacker.
Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack
#10How can a mobile carrier operate like this?? No authentication that the request isn't fraudulent? In Sweden I switched to another carrier, still keeping the number in the same name. To do that I got a text message with a code I had to input to initiate the process. When I ported my phone number from my father to me within the same carrier when I turned 18 that required the same confirmation to initiate the process an…
In your case, a dedicated attacker could socially engineer the carrier into changing you and your father's contact details and then port the number.
$100k is a lifetime's worth of money in some countries, and it can justify a few months worth of recon.