Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

101–110 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#101

Post by alpaca128 »

tiku wrote: post #8

How does this work? The sim-card is sent to your own address, in a plain white envelope.They have to steal that envelope to gain physical access to the sim. Why is it so hard to stop sending sim-cards to different addresses than the main address where it was registered?

It's much simpler. The attackers simply go to the service provider, claim they lost the sim card/phone and provide your details. If they're convincing enough the provider will deactivate your SIM and activate theirs within 10 minutes or so and by the time you notice your mobile connection doesn't work anymore they're already busy entering TANs sent to your number.

Now I don't know how easy that is to pull off in the US, but it varies in different countries. In some it takes a day to switch to a new SIM, in some you only need the real owner's name and a codeword and it'll get switched within minutes, for free and no questions asked.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#102

Post by zeveb »

neflabs wrote: post #92

It's not just SMS 2FA causing this issue, it's the entire premise that a phone number is equivalent to identity. https://neflabs.com/article/sim-swapping-attacks/

Note that Signal, everyone's favourite secure SMS replacement, also conflates phone numbers and identity!

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#103

Post by Eldt »

2rsf wrote: post #86
firasd wrote: post #30

Someone was telling me that here in India authorities clone SIM cards to eavesdrop on WhatsApp conversations. I don't know if that's accurate, but it's becoming clear that SIMs in general are a vulnerable form of ID. I've seen US-based IT-security-minded people saying on Twitter for a long time that SMS based 2fa is bad, but the problem with hardware dongles is that they can be too secure. I don't want to lock myself…

eavesdrop ? the WhatsApp I use agrees to work only on one phone, if yo move it it stops working on the original.

Is that not per-phone number? The cloned SIM would have the same one

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#104

Post by Slimbo »

tialaramex wrote: post #14
aikah wrote: post #5

Earlier quoted context omitted.

You didn't provide a secure and practical alternative, please enlighten people unaware of them.

The most secure alternative, which should be the choice for anyone who actually cares, and an option anywhere that thinks _any_ of their users might care is WebAuthn (U2F is roughly the same thing but obsolete, no reason to deploy more of it) WebAuthn uses FIDO Security keys, relatively cheap USB or Bluetooth devices or sometimes just a built-in feature of a smartphone, to authenticate. They are Something-You-Have, b…

With all of these, you're often kicking the vulnerability down to the enrollment step. You've still got to find a way of assigning the authentication device/key generator to the users account in a secure way and dealing with losing the device.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#105

Post by Eldt »

Klathmon wrote: post #66
nailer wrote: post #61

Earlier quoted context omitted.

How could one save a TOTP code in a password manager and use it later? It would be useless in 30 seconds time. Am I misunderstanding something? Or did you mean OTP rather than TOTP?

The setup string which generates the time codes is basically a second password. If something can read that setup string, they can generate their own TOTP codes for your account whenever they want.

So you're not actually talking about the TOTP codes that are generated?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#106

Post by iicc »

Svip wrote: post #9

Does anyone know how common or easy SIM swapping elsewhere in the world? The SIM swapping stories I've seen on HN mostly focus on US users. I remember reading an article years ago, about banks combating SIM swapping in Africa, where a lot of transfers are done by SMS, by forcing a cooldown. But I wonder, besides the US and Africa, where is SIM swapping prevalent? NYT says I'm at risk too. I'm in Europe -- am I?

UK 2016:

https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud...

>When Sims rang EE, it soon emerged that someone posing as his wife had managed to persuade the mobile network to activate a new sim card

>Sims says that when he contacted his bank, Halifax, the call centre told him it is handling hundreds of sim scams every day, making it the fastest growing fraud in the country – although Halifax later disputed this figure.

On the other hand I'm sure I saw something about banks etc being able to subscribe to services that would give them background information about a mobile number (ie if the number has been recently ported).

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#108

Post by eswat »

nailer wrote: post #61
Klathmon wrote: post #54

Earlier quoted context omitted.

Don't save your TOTP codes in your password manager if you are going for the "best" security. That turns multi-factor auth back into "single factor auth" and leaves you one exploit away from having your password and TOTP code from getting stolen.

How could one save a TOTP code in a password manager and use it later? It would be useless in 30 seconds time. Am I misunderstanding something? Or did you mean OTP rather than TOTP?

The main benefit behind TOTP is that you can tie its value creation to a second factor, such as something you own like a device (instead of something you know like a password).

It’s arguable that you’re removing that second factor when you store the parameters needed to create the TOTP in the same place as you store your passwords.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#109

Post by matwood »

ninjaoxygen wrote: post #59
anticensor wrote: post #24

Earlier quoted context omitted.

Or do it like Turkey, and require central clearance with physical SIM replacement (this is required both for ownership and porting transfers). One of the few things we got right.

I feel like a time delay would help with this too. If it takes an extra 24 hours and you get notifications by SMS and email during that period with the chance to call "fraud" it stops most of these attacks which take control of e-mail and phone simultaneously. I get that makes life much more difficult when you are travelling and have your phone (and therefore SIM) stolen, but given the severity of the current issues…

> I feel like a time delay would help with this too.

It used to take a long time and the carriers caught grief for making it hard for people to port out to another carrier.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#110

Post by georgeam »

tialaramex wrote: post #72
rmtech wrote: post #58

Earlier quoted context omitted.

There are still ways to make the system more secure. For example, you have to physically go to a store to port the number unless you have the old SIM. Then it's not done immediately - there's a 72 hour period in which multiple texts and calls are sent to the old SIM asking for confirmation. If you physically have the old SIM this is instant, but if you claim to have lost it you need to wait 72 hours and provide a sig…

Sure, you could have a national "reality" TV show, everybody who lost their SIM has to go on the TV show for six months with it showing on screen which number they claim is theirs - so this way there's no chance they're a crook. Or make anyone who claims they lost their SIM wrestle a bear first before they get a replacement. Won't see many crooks take that on. But, I put it to you that this all seems very disproporti…

I'm a strong believer in solving problems at the single point of failure. If you solve it at the Twitter level, what about any other internet/cloud based service that is designed just like Twitter? It would still be a problem. If you solve it at the phone company level, all the companies that operate like Twitter are protected.

Even better still, solve it at both levels, but definitely don't let phone companies off the hook.

Post reply on HN