Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T employees were bribed to install phone unlocking malware on company network

geekwire.com

Post reply on HN
Print view View original

141–150 of 157 posts

Re: AT&T employees were bribed to install phone unlocking malware on company network

#141

Post by lawnchair_larry »

55555 wrote: post #138

> The indictment doesn’t get into how Fahd was caught. He was arrested in Hong Kong in February 2018 at the request of U.S. authorities. Fahd was extradited from Hong Kong to the U.S. last week to face 14 different charges in federal court in Seattle, including wire fraud, violating the Travel Act and intentional damage to a protected computer. How was Edward Snowden allowed to chill in Hong Kong? Was it because the…

He wasn’t. That’s why he had to leave abruptly, and why he was stranded at his layover in Russia.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#142

Post by lawnchair_larry »

bitcurious wrote: post #105
kiallmacinnes wrote: post #11

> “Now he will be held accountable for the fraud and the lives he has derailed.” Whoa there. What? Yes, he's committed a crime and should be held accountable for that. But.. Who's lives has he derailed? If I was to accept a bribe to commit a crime, nobody is derailing my life but me - to say anything else suggests a level of intelligence bordering on inability to understand and take responsibility for my actions. Can…

If you profit off of a violent crime by making that crime more profitable, I believe you are morally culpable in that crime. This person made muggings more profitable, and profited from it. If there was even one concussion from a mugging that otherwise wouldn't have happened, I would say that's a life derailed. Not provable, but likely.

No, he made it so people could bring their property with them to other carriers and/or use their phone when they travel.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#143

Post by MertsA »

nathankunicki wrote: post #52
DaniloDias wrote: post #46

Earlier quoted context omitted.

Many of these devices are unlocked in bulk and sold overseas. This deprives them of the payments that they expected for fronting the cost of the device.

I still don't understand how. Regardless of who ends up using the phone, surely the original purchaser/signer is still on the hook for the monthly payments? ie. If I buy a contract iPhone from AT&T then unlock and sell on the phone, that doesn't nullify the fact that I still owe AT&T $100 a month for 24 months, regardless of where the phone is?

It's "collateral" for the contract. Locking the phone is their way of putting a "lien" on it. Taking people to court over relatively small unsecured debts will eat through a good chunk of the margin that telecom companies are making off of those contracts in the first place. A locked phone is a couple hundred dollars worth of extra leverage to get a debtor to not default on the contract.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#144

Post by therealx »

withinrafael wrote: post #21
JRKrause wrote: post #13

Earlier quoted context omitted.

I bought an ATT locked iPhone SE from Ebay just 2 months ago. The unlocking process was essentially just going to ATT website and typing in the IMEI and they unlock it within 15 minutes for free. I assume all the "pay $10 to unlock your phone" services are just counting on the average person being too lazy to discover your can just do the legwork yourself.

The mobile operator provided unlock only works on devices of a certain age. You can't typically, for example, purchase a new flagship device and unlock it on day one. The illegitimate methods bypass this restriction.

Theres a method of unlocking new/any iOS device using the GSX api that Apple maintains for the remaining list of Authorized Stores. Apple will not approve anyone new for the list, and they have changed up the requirements to connect to the API lately from just a username/password (which were often hacked or bribed), to client side certificates and blessed static ips (at a time when even the OS X networking libraries didn't support this), to a new version just now that I won't give the details but you can find if you do some github searching.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#145

Post by mcpherrinm »

HenryBemis wrote: post #130
dmix wrote: post #115

Earlier quoted context omitted.

> Fahd allegedly recruited AT&T “insiders” to install malware programs that gathered confidential information and submitted unlock requests using employee credentials via a remote server. These were probably 3rd party call centers or section of the company that ran their customer service lines which gave agents the ability to unlock devices. The amount of spin this article is using to associate locking devices to kee…

I cannot see how would his be profitable. Usually when a customer receives a new cellphone at a lower price, that comes with a 12-24 month extension of a proportionally expensive contract. After said contract expires, AT&T has already made its profit. Even if someone would want to take the device and use another company's SIM card, they would still have to honour the contract with AT&T. The only "free money" scenario…

Use a stolen credit card/identity to buy an iPhone on contract. You can walk out of the store with the phone that day and never pay AT&T another dime.

Use this shady service to unlock without paying off the contract, and resell on the second-hand market.

If an iPhone costs $1k, maybe you paid $100 to get it out the door, then you can still make hundreds of dollars selling it.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#146

Post by 3xblah »

deogeo wrote: post #14

1.) How is unlocking a phone "malware"? Isn't the lock malware, and the unlocking serves the owner of the device? Calling it malware reeks of regurgitating AT&T propaganda. 2.) How did this "deprive AT&T of the stream of payments it was owned under the customers’ service contracts and installment plans."? A phone getting unlocked doesn't void a contract, so those customers are still on the hook.

It is only an indictment, not a conviction.

Those are just allegations, not facts.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#147

Post by throwfDfZ9yPK »

Throwaway here. This bit me in the ass. (I think)

Quite a while ago I was on an AT&T family plan with my aforementioned family. An unexpected death in my family caused a falling out/estrangement situation which jeopardized our cellular service, along the lines of an intestate inheritance, forfeited property, decades of fraud/extortion...and my borderline personality mother becoming enraged at the fact that we would now be reassessing my family's troubled history in the wake of this tragedy. The result of these events were that my (quite old) AT&T smartphone service was unexpecgedly cancelled, leaving me out in the cold. I needed service fast, and got a sim card ASAP but I did not reckon that my (fully paid for) cellular device would be carrier locked.

This is my mistake of course, but the result is that I was, late at night, caught out with no functional device to use with my sim card, and a brand new MVNO service agreement. I took to the internet in order to find a solution, and ended up using my privacy.com account to pay for a rather sketchy Samsung unlock service, which worked like a charm.

Eager to forget this entire affair, I moved on with my life.

One day about a month or two ago, my Samsung handset began demanding a carrier unlock code. Confused, and in need of service, I shelled out for the nearest used smartphone thing I could find.

This was rather alarming as I was cut off, yet again, and until this day I had no idea how my handset had relocked itsself! my MVNO CSR couldn't help, bless his/her soul, insisting I would need to contact the carrier for the unlock code. Instead, I hit that thing with a hammer and called it a night.

After I used the dodgy unlock software which I paid a 20 for, I had monitored my handset for malicious activity via my personal security gateway but could never identify anything unusually malicious.

Now I have a backup plan, and carry a spare flip phone.

If your mother has access to lexisnexis, I might consider a restraining order if your situation sounds familiar.

I concluded that AT&T has rescinded these unlock codes, leaving untold numbers of legitimate users without a way to conduct business.

Carrier locked devices should be outlawed. AT&T appears to my naive eyes as a malevolent shitshow, much like verizon and comcast and other rent seeking walled garden extortionists. The history of these telephone companies precedes them, but gosh i wish that my real life didn't feel like it existed in Eve Online.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#148

Post by JCharante »

mcpherrinm wrote: post #145
HenryBemis wrote: post #130

Earlier quoted context omitted.

I cannot see how would his be profitable. Usually when a customer receives a new cellphone at a lower price, that comes with a 12-24 month extension of a proportionally expensive contract. After said contract expires, AT&T has already made its profit. Even if someone would want to take the device and use another company's SIM card, they would still have to honour the contract with AT&T. The only "free money" scenario…

Use a stolen credit card/identity to buy an iPhone on contract. You can walk out of the store with the phone that day and never pay AT&T another dime. Use this shady service to unlock without paying off the contract, and resell on the second-hand market. If an iPhone costs $1k, maybe you paid $100 to get it out the door, then you can still make hundreds of dollars selling it.

AT&T also asks for your ID, so since they're using a stolen credit card I presume they're also committing identity fraud. Is this really wide spread issue though? Since they must be on the CCTV how many times can a scammer use the same human agent?

Re: AT&T employees were bribed to install phone unlocking malware on company network

#149

Post by throwfDfZ9yPK »

_bxg1 wrote: post #32
gear54rus wrote: post #28

Earlier quoted context omitted.

Why is illegal scheme necessary to create derivative works of Mickey mouse? Because this world, while being peaceful, is overrun with hostile actors at every corner.

No, I mean, you can literally ask AT&T and they'll unlock your phone. Or if this was before that was possible, you could still just root it yourself. I don't see why the network or its employees had to be involved at all.

NO! Rooting your phone will not result in a carrier unlock. I am not aware of the specific technical details, but there are mechanisms in place which RMS would call "Negative in the freedom dimension."

In my case I followed your advice, thinking like a logical human, that rooting my phone could allow myself to unlock my device (which I paid retail price from their walled garden market for pre-locked devicess, no subsidy and also following years of service) but i discovered many many months after the fact that the cellular megacorp can use their OTA update service in some instances to reverse your assertion of control over your device somehow.

I used a dodgy unlock service in a time of desperation, and would later find myself locked out from my fully paid device yet again. The handset cost as much as a crappy but roadworthy car and was paid in full.

These convoluted service lock agreements do nothing at all but ensure paying customers are beholden to the capricious will of these amoral corporate entities. The marketing and lobbying makes us think this is a good deal.

EDIT: I used an opensource rooting method, and later used a dodgy unlock service which i believe this person may have been involved in reselling.

Re: AT&T employees were bribed to install phone unlocking malware on company network

#150

Post by throwfDfZ9yPK »

a3n wrote: post #120
belltaco wrote: post #59

Earlier quoted context omitted.

Same with Comcast, if not worse. For some reason their systems appear to take forever to load a customer account. One could probably find and pull a physical file of a user account faster in the pre-computer days out of a huge room full of wall to wall filing cabinets. I am not sure if it's ineptness or they pretend to take long to make support calls as frustrating as possible.

> or they pretend to take long to make support calls as frustrating as possible. Doubtful. Support staff are graded in part on how quickly they can get you off the call.

This is not quite the case.

If you would like to learn a little bit more about the economics and operations of CSR call centers I can refer you to August 5 interview with Emily Guendelsberger on Sam Seder's show entitled "On the Clock: How Low-Wage Work Drives America Insane"[0] This link is timestamped to the relevant segment, but I can't isolate one phrase to demonstrate some of these operations. She employed herself in these locations to learn about how they operate, and the conditions. The TL;DR is that the outsourced companies bill on a per-minute basis, not on any actually useful metrics, in her experience.

[0] https://youtu.be/_9GGT05MAOY?t=3224

EDIT:I forgot to metion that she does discuss how poorly integrated the CSR software is, and the absurdly cumbersome user interfaces which they are forced to operate.

Post reply on HN