Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’ • Hacker News Board

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#251

Post by blackflame7000 » Wed, Sep 11, 2019, 8:18 PM UTC

whywhywhywhy wrote: post #185

cat199 wrote: post #157

Earlier quoted context omitted.

hugely important point. helped a less-tech-savvy neighbor 'reset her skype' account that was tied to 'her phone number', only to find that the account bound to that phone number, which she had recently acquired, was publically searchable and connected with some sort of anime sex fetish subculture, presumably from a previous owner of that phone number.. she was using this phone / skype account for a job interview. nee…

Never really made any sense to me whatsoever why we all switched over from having to use phone numbers instead of email addresses as sign in over the past few years. I get why businesses want to harvest peoples phone numbers and phone books but you'd hope at least some would think of the implications to users first.

It's much easier to create additional emails than phone numbers so if you are trying to cut down on fake accounts phone number makes more sense.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#252

Post by alistairSH » Wed, Sep 11, 2019, 8:18 PM UTC

lotsofpulp wrote: post #205

whywhywhywhy wrote: post #185

Earlier quoted context omitted.

Never really made any sense to me whatsoever why we all switched over from having to use phone numbers instead of email addresses as sign in over the past few years. I get why businesses want to harvest peoples phone numbers and phone books but you'd hope at least some would think of the implications to users first.

Using phone numbers as authentication is a cheap and effective way to prevent spam, as well as track users with a unique ID.

But phone numbers are not unique. They are regularly re-assigned to new customers.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#253

Post by lotsofpulp » Wed, Sep 11, 2019, 8:22 PM UTC

alistairSH wrote: post #252

lotsofpulp wrote: post #205

Earlier quoted context omitted.

Using phone numbers as authentication is a cheap and effective way to prevent spam, as well as track users with a unique ID.

But phone numbers are not unique. They are regularly re-assigned to new customers.

It’s a good enough solution. Especially for those with disposable income, they’re not changing numbers often, if ever.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#254

Post by r1nkgrl » Wed, Sep 11, 2019, 8:23 PM UTC

choward wrote: post #248

penagwin wrote: post #221

Earlier quoted context omitted.

I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck. If you had parts of either, or a hint, maybe a previously used password works for "verifying your ID" then I'd call that 1/2FA

It's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code that is sent via SMS. However, since you don't really even need access to the phone and can easily social engineer access to messages sent to the phone, it's not really a full one factor.

Using your logic, doesn't the ability to social engineer access to a password make passwords less than 1 FA as well?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#255

Post by mceachen » Wed, Sep 11, 2019, 8:26 PM UTC

WorldMaker wrote: post #242

WorldMaker wrote: post #239

Earlier quoted context omitted.

Most feature phones can also easily run a TOTP application (and have/do). There are J2ME TOTP applications that will run on hardware far back into the ancient past. There are all sorts of fun TOTP apps in the AdaFruit, Arduino, RPi hacking worlds. The algorithm is rather straightforward. The "hardest" part is the SHA1 hashing algorithm and people have written versions of that for just about every hardware under the s…

Just noticed the tab I had opened mentioning 6502 SHA1 hashing was to do it on old Tamagotchi hardware. Forgot that was also a 6502. Wonder if that person ever finished a TOTP Tamagotchi.

we call them TOTPagotchis these days

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#256

Post by mceachen » Wed, Sep 11, 2019, 8:28 PM UTC

mikeash wrote: post #215

badrequest wrote: post #213

Earlier quoted context omitted.

You don't need a smartphone or 2FA device to generate TOTP codes, and in fact, can use applications like Bitwarden. SMS is obviously not adequate, or the Jack Dorsey wouldn't have been hacked.

Twitter doesn’t use 2FA over SMS. Dorsey’s hack doesn’t tell us anything about that.

Yes, they do. 2FA is via SMS or TOTP.

Frustratingly, you can't enable TOTP without a phone number, and if you remove your phone number, you disable 2FA.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#257

Post by alexeiz » Wed, Sep 11, 2019, 8:28 PM UTC

I once lost my phone (with a SIM card in it). So I went to a store that served my operator, asked to give me a new SIM. They promptly gave me a new SIM and activated it on the spot. The only piece of information I gave them was my phone number. No other verification such as name, ID or SSN was required. This is how easy it is to hijack your cell phone number. It's basically trivial and there is absolutely no risk to it.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#258

Post by Spivak » Wed, Sep 11, 2019, 8:29 PM UTC

legohead wrote: post #173

zaroth wrote: post #146

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…

SMS is only as good as the cell providers security, which has been shown over and over again to be terrible. It should never be used in any ongoing authentication.

It may very well be bad in absolute terms but compared to a single weak password it’s a huge improvement.

I would bet on “log in with phone number” being better than “log in with password” across a population any day.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#259

Post by mceachen » Wed, Sep 11, 2019, 8:29 PM UTC

jandrese wrote: post #232

dev_dull wrote: post #162

Earlier quoted context omitted.

That’s the problem. Twitter requires you to add a phone number (even if you sign up without one, eventually you’ll be locked out and requires to add one). Then, once you add a number to unlock your account you’re left exposed.

Can't you add a number, verify the account, then delete the number?

Nope, that disables 2FA.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#260

Post by dboreham » Wed, Sep 11, 2019, 8:30 PM UTC

celticninja wrote: post #124

matwood wrote: post #112

Earlier quoted context omitted.

The problem is, I think a lot of these hacks have an internal connection. How much access do these 3rd party carrier stores have to transfer numbers?

It could be done remotely but only if the store had signed off that ID had been viewed and the port confirmed in person. Of course this could be gamed but an employee would need to put their name on the line to say they had met the person and viewed the ID

We have a rep (as a business customer) and he will port our lines and change SIMs for me based on an email. However I noticed the last time I initiated one of these requests there was a confirmation step that involved an email sent to me with a URL I had to click to approve. From memory I don't believe that URL needed authentication so the email was a bearer instrument. An attacker would need to both fake my outgoing email (easy) and also intercept incoming email (not so easy). There was also a confirmation email sent advising that the request had been approved and processed.

I can imagine however that an admin at a reasonably large business would receive several of these emails per day and may just reflexively click on them all. Note these emails are sent to the business account admin, not the end-user. I happen to be both so can see both sides of the process.

Edit: I should also add that I have never met this rep and so he has definitely not looked at my government ID. The process is secured only by receipt of email.