Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

221–230 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#221

Post by penagwin »

fulafel wrote: post #159
zaroth wrote: post #146

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…

It's really ½FA, worse than 1FA authentication because it's sufficient to clear any 1 of the 2 factors.

I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck.

If you had parts of either, or a hint, maybe a previously used password works for "verifying your ID" then I'd call that 1/2FA

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#222

Post by kyrra »

miles wrote: post #209
kyrra wrote: post #206

Earlier quoted context omitted.

I remember that story. It was talked about a lot here: https://news.ycombinator.com/item?id=18886804 The Fi team cares a long about these kinds of issues and does what they can to solve them. I cannot comment on specific cases, but as someone that works on Payments @ Google, I've seen the Fi team advocate for their users a lot to get things running smoothly. They deeply care about good experiences and do what they ca…

Thanks for your reply, kyrra. Sadly, I've experienced the same steep drop in Google support of late (twice in the past week in fact) working with G Suite support agents. Just yesterday, I was helping a client troubleshoot a week-long issue with Drive File Stream ("Can't reach Google Drive") that remains unresolved for three of their users. Despite repeated phone calls and a promised callback from a "Drive engineer",…

Transparency is hard for some reason at large companies. I think it's a mixture of wanting to maintain an image, plus complexity of systems that don't always make it easy to get information to end-users about issues.

For your Drive FS issue, I assume you're on Windows? I have no clue if this is backend or client, but watch for a new version: https://support.google.com/a/answer/7577057 Maybe that will fix your issues. I'm not sure how to check your Drive FS client version sadly.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#223

Post by tialaramex »

zeveb wrote: post #102
neflabs wrote: post #92

It's not just SMS 2FA causing this issue, it's the entire premise that a phone number is equivalent to identity. https://neflabs.com/article/sim-swapping-attacks/

Note that Signal, everyone's favourite secure SMS replacement, also conflates phone numbers and identity!

Not exactly true.

Signal doesn't really care about identity at all, it leaves it up to the users to decide if "Steve" in their contacts is who they thought it should be, if they're happy to accept that without proof or if they've verified it was who they expected in person or out of band.

Modern Signal lets users put together a profile, like a Twitter profile, and like the Twitter profile you might know somebody whose profile name is "Grim Reaper" and whose profile photo is the Discworld Death, without you believing that is their real name or appearance. Maybe you decide that's enough reason not to mark your friend Suzie ("Grim Reaper") as Verified in Signal. Most likely not. Other Signal users aren't informed of this decision and Signal itself doesn't know what you decided.

But it does default bind your contacts to Signal users based on a telephone number they've proved control of at some point. So if you don't verify anything, a message from you to "Steve" could be received by somebody who registered the phone number you've associated with the contact "Steve". Signal's creators rationalise that this is what an ordinary phone user expects to happen.

If it's important to you that "SIM Swap" isn't used to create an imposter Signal account with your phone number - a reasonable concern for some people, you can set a "Registration Lock PIN" for the phone number. Anybody else in the future who wants to use Signal with that telephone number will need the PIN or their registration fails.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#224

Post by nandipmakwana »

firasd wrote: post #30

Someone was telling me that here in India authorities clone SIM cards to eavesdrop on WhatsApp conversations. I don't know if that's accurate, but it's becoming clear that SIMs in general are a vulnerable form of ID. I've seen US-based IT-security-minded people saying on Twitter for a long time that SMS based 2fa is bad, but the problem with hardware dongles is that they can be too secure. I don't want to lock myself…

> Someone was telling me that here in India authorities clone SIM cards to eavesdrop on WhatsApp conversations.

source? There is lot of wrong with our authorities but I really really doubt about what you just said. I mean the way you have written it is giving wrong impression that authorities can clone any sim at their whim just like china or other authoritarian government.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#225

Post by tialaramex »

u801e wrote: post #115

The second factor for authentication is best handled by having it under the account holder's control. Either a client side TLS certificate or a Yubi key. The former is better in my opinion since it's compatible with application level protocols other than HTTP.

A client side TLS key has some properties plenty of people don't want because it specifically assures the remote party of your identity.

If I use a client TLS key with (examples are hypothetical) GitHub for my work as "Fast Jack The Javascript Hack" and Twitter as "Aunty Fa" to write posts calling out Nazis, then the effect is that data from GitHub and Twitter can be used to find out that "Jack" and "Aunty" are one and the same. Maybe they both give the data to cops who are actually Klan members, maybe it's stolen, maybe some goof uploads it to Pastebin. Doesn't matter, now my day job is destroyed because I used a TLS client certificate.

If I use FIDO keys for U2F/ WebAuthn then nobody knows Jack and Aunty are the same person, unless they suspect this and they deliberately arrange for Twitter and GitHub to work together to test this /specific/ hypothesis, in which case frankly I'm probably screwed anyway.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#226

Post by miles »

kyrra wrote: post #222
miles wrote: post #209

Earlier quoted context omitted.

Thanks for your reply, kyrra. Sadly, I've experienced the same steep drop in Google support of late (twice in the past week in fact) working with G Suite support agents. Just yesterday, I was helping a client troubleshoot a week-long issue with Drive File Stream ("Can't reach Google Drive") that remains unresolved for three of their users. Despite repeated phone calls and a promised callback from a "Drive engineer",…

Transparency is hard for some reason at large companies. I think it's a mixture of wanting to maintain an image, plus complexity of systems that don't always make it easy to get information to end-users about issues. For your Drive FS issue, I assume you're on Windows? I have no clue if this is backend or client, but watch for a new version: https://support.google.com/a/answer/7577057 Maybe that will fix your issues.…

> For your Drive FS issue, I assume you're on Windows? I have no clue if this is backend or client, but watch for a new version: https://support.google.com/a/answer/7577057 Maybe that will fix your issues.

Thank you. Yes, they're Windows clients. We've tried downloading the latest version (as of yesterday) on completely new Windows 7 and 10 machines on a completely separate network and still have the same issue for the same 3 users every time. The other users don't have any problem with File Stream. We've checked and rechecked all of the settings available to us via the G Suite Admin Dashboard.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#227

Post by nullc »

zaroth wrote: post #146

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…

My experience is that after you give your phone number to most companies it effectively becomes a single factor: it's trivial to get them to change passwords with that alone. AFAICT, the only protection is to not give them your phone number in the first place.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#228

Post by floatboth »

anticensor wrote: post #82
floatboth wrote: post #77

Earlier quoted context omitted.

Porting takes over a week in Russia. You get a new SIM instantly, but it has a temporary number. Then you get notifications via SMS on your old SIM, you usually get a call from your old carrier trying to get you to stay, offering discounts and shit. Then after 7-14 days the new SIM gets the old number and the old SIM stops working. The U.S. system sounds horrifically irresponsible. // Replacement with the same carrie…

Same in Turkey (takes 2-6 days), but you get your replacement SIM after the transfer is cleared, you still use your old carrier and SIM during porting porting. Old one simply gets inoperable by a remote command.

Yeah, you can use the old SIM during porting here too, but you can also use the new one with a temp number.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#230

Post by ergothus »

ender89 wrote: post #181
excalibur wrote: post #179

Earlier quoted context omitted.

> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud This would work to the thief's advantage in the case of physical device theft. The notification should definitely be a thing, but it should not be possible to cancel the process without talking to the carrier directly and verifying your identity to them.

Fun fact, the person who stole the sim probably worked for the carrier, or used someone who worked at the carrier that they either knew or had leverage over. You already have to verify your identity to the carrier if you want to make changes to your account, and while you might be able social-engineer your way past it, but I would be shocked if someone like Jack Dorsey didn't have a password associated with his accou…

> while you might be able social-engineer your way past it,

My personal experiences and various accounts I've heard make this "might" shift to "fairly easily". Why are you so confident that it has to be someone with inside knowledge?

> I would be shocked if someone like Jack Dorsey didn't have a password associated with his account that is required to make changes

I do not share your trust. I'd be shocked if he didn't NOW, but you are basing your assumption off of what...that he recognized his status as a high profile target? Were that the case I doubt this vulnerability would have existed.

Post reply on HN