Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Most Expensive Lesson of My Life: Details of SIM Port Hack

medium.com

Post reply on HN
Print view View original

241–250 of 251 posts

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#241

Post by Gwypaas »

knorker wrote: post #236
Gwypaas wrote: post #71

Earlier quoted context omitted.

Googled. Is it regarding using social engineering to enable call forwarding last autumn? Can't find anything else.

Yeah. Which is how this guy got hacked, too. Whether it's by forwarding or new sim card is a detail. It's the same social engineering vulnerability.

And reading the article everyone was already at the time working on preventing it, because any unauthorized change is illegal.

The prevention seems to be either through BankID authentication or actually calling/texting the number being forwarded to make sure the request is legitimate.

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#242

Post by basch »

arcticbull wrote: post #230
basch wrote: post #224

Earlier quoted context omitted.

a signature doesnt stop the transaction from going through. if i dispute a transaction, I can go "thats not my signature." do most people sign their name on those digital pads, or do they scribble random patterns? a signature is not a pre-authentication factor, a PIN is.

There are three security elements aspects to the EMV standard: card duplication (your card is the real deal), cardholder verification (you are the real deal), and lending (that you still have available credit). Having a chip prevents (or at least is intended to prevent) card skimming. EMV payments cannot be re-played, cards cannot be duplicated and neither the card nor the reader can be tampered with. The magstripe o…

I was under the the understanding that

1) readers can be tampered with - https://www.creditcards.com/credit-card-news/new-card-skimmi...

and

2) there was some ability to clone the cards https://www.kaspersky.com/blog/chip-n-pin-cloning/21502/

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#243

Post by codedokode »

brianwawok wrote: post #219
asdfasgasdgasdg wrote: post #205

Earlier quoted context omitted.

The banks know this, and they don't like losing money, so they have made most of their transactions reversible. There was an article on this a few years ago exploring why bank account credentials are worth little on the black market. Basically, there isn't an easy, safe way to just steal money out of a bank account.

Also caps. My debit card is capped at $400? Cash a day. So cool you get $400 if you steal it. Very different from 100k

There are ways to withdraw money from the card indirectly, for example: ordering expensive goods or betting on sport events.

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#244

Post by vsl »

zaarn wrote: post #191
lixtra wrote: post #165

Earlier quoted context omitted.

Traditional financial regulation and compliance is a joke and mostly security theatre from the perspective of a security engineer or cryptographers. - credit cards with secrets printed and shared in plain sight - hacked banks - hacked atms It only works because most involved are somewhat trustworthy and the damages are small enough that it’s still worth to have the system. But the latter also seems to be true for cry…

In Europe it's more common to have an EC card, which doesn't have any necessary secrets printed in plain sight (you need a TAN to complete a transaction over 25€ or total 100€ per day). We also have SEPA Inst which allows me to send people money instantly for no fees (atleast at my bank), faster than Bitcoin ever could. I'm insured against the bank being hacked. I'm also insured against the ATM's being hacked. If I'd…

> In Europe it's more common to have an EC card, which doesn't have any necessary secrets printed in plain sight

This is not true. All you need to do online transactions is the number, expiration and CCV, all of which is printed on EC cards.

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#245

Post by zaarn »

vsl wrote: post #244
zaarn wrote: post #191

Earlier quoted context omitted.

In Europe it's more common to have an EC card, which doesn't have any necessary secrets printed in plain sight (you need a TAN to complete a transaction over 25€ or total 100€ per day). We also have SEPA Inst which allows me to send people money instantly for no fees (atleast at my bank), faster than Bitcoin ever could. I'm insured against the bank being hacked. I'm also insured against the ATM's being hacked. If I'd…

> In Europe it's more common to have an EC card, which doesn't have any necessary secrets printed in plain sight This is not true. All you need to do online transactions is the number, expiration and CCV, all of which is printed on EC cards.

You think of CC cards but an EC card is connected to your bank account, so you require the bank account number on the card plus a valid TAN number or the pin number of the card.

Alternatively you need a SEPA merchant account, but running fraud on that gets you sued to hell and back.

EC cards do not have a CCV number.

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#246

Post by brianwawok »

codedokode wrote: post #243
brianwawok wrote: post #219

Earlier quoted context omitted.

Also caps. My debit card is capped at $400? Cash a day. So cool you get $400 if you steal it. Very different from 100k

There are ways to withdraw money from the card indirectly, for example: ordering expensive goods or betting on sport events.

Sure. Both of those would likely raise a fraud check, and my bank would call me before releasing money.

Spending 100 crypto coins? Not so much.

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#247

Post by stephanietos »

I really loved him until he proved himself not worthy, i had to contact an hacker to help me get access to his whatsApp messages and track his phone. I didn't get what was expected as i got a lot worse for loving a man,i was depressed but it is okay now. Am really glad i listened to my sister and spied on him before it becomes too late. If you need help in your relationship, you can contact my hacker waynecyberghost @gmail.com

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#248

Post by stephanietos »

There are so many fake hackers and perverts online who extorts people off their hard earned money from the basement of their mother. it took me several months to find a genuine hacker who is trustworthy. Thanks, wayne you are simply the best, no doubt, hey guys if you ever need to track down your cheating boyfriend or girlfriend or improve your credit score, school grade, or clear criminal records. The man is genius and gifted hacker. he can hack into all social networking site Facebook, twitter, Instagram, snap chat, hot mail, yahoo mail, AOL, etc. he also does credit score, credit and debit card top ups as well. he's a top class hack tool,highly secretive and discreet. Dudes kinda picky so make mention of the reference and you will thank me later. you can contact him via his mail -waynecyberghost@gmail.com Tell him stephanie refer you

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#249

Post by jjeaff »

dontbenebby wrote: post #213
jjeaff wrote: post #166

Earlier quoted context omitted.

Any carrier will allow you to change your password or pin using other information . Otherwise, what would happen in the frequent case where users forget their pin?

> Any carrier will allow you to change your password or pin using other information . If by "other information" you mean "come into a store and show a government issued photo ID" you are correct. That's a fairly high bar to clear. That's the way my carrier does it, and I assume if they violate their own procedures I could evaluate my legal options... though as a practical matter I use a VOIP # which requires a 2FA pr…

Which carrier is that?

Re: The Most Expensive Lesson of My Life: Details of SIM Port Hack

#250

Post by StreamBright »

2819b wrote: post #124

It's an extremely odd decision by the author to publish this piece. Port attacks on cryptocurrency accounts is nothing new, and outside of publishing the number ($100k!) there is nothing special about this account of events vs the countless other near identical articles that have been published on Medium on the same old attack. The reason I say it's odd is that he's an engineering manager at BitGo, which is a leading…

He just proved how secure most of crypto solutions really are.
Post reply on HN