Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

271–280 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#271

Post by avip »

wobbly_bush wrote: post #250
zaroth wrote: post #146

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…

Indian laws require a police report before telecom operators can transfer a line to a new SIM card. I was always surprised how easy it is in US to transfer in comparison.

In India I had to give a photocopy of my passport, my permanent address in India, and a letter of referral from an Indian citizen to get my Airtel sim card. It was one of the weirdest experiences I've had in the country.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#272

Post by icebraining »

iamnotacrook wrote: post #249
nullc wrote: post #227

Earlier quoted context omitted.

My experience is that after you give your phone number to most companies it effectively becomes a single factor: it's trivial to get them to change passwords with that alone. AFAICT, the only protection is to not give them your phone number in the first place.

Maybe it's time to reconsider phone numbers. Think about it. There's already a divide between phones on one side, and tablets/laptops/pcs etc on the other. You can only use whatsapp on a phone (or a laptop connected to a phone). You need a special phone contract to make phone calls. You can make voice calls via voip/whatsapp/whatever but you have to understand what network the person is on. Then there's this security…

> you just placed a voice call with someone else

That "just" is doing a lot of legwork, though. How do you identify and find that someone else, so you can call them? Generally, you need some sort of unique identity. And how do you make sure that unique virtual identity connects to the correct physical person? Once you solve that, you can probably apply the solution to phone numbers.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#274

Post by vxNsr »

zaroth wrote: post #146

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…

> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud (e.g. whoever made the request on the carrier side should be flagged, to fish out compromised support reps).

Better yet, a YES text should be required with a port

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#275

Post by hirsin »

vxNsr wrote: post #274
zaroth wrote: post #146

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…

> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud (e.g. whoever made the request on the carrier side should be flagged, to fish out compromised support reps). Better yet, a YES text should be required with a port

You've led a fortunate life, if you've never had a phone utterly and completely destroyed or lost. Having the SIM ruined is a rough time.

I believe t-mobile has a nice requirement of being able to mark you number as "show up in the store and show your ID"

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#276

Post by andromeduck »

narrator wrote: post #273

This is why I use Google Voice with 2 factor authentication for my SMS. Google has no customer service to socially engineer.

This is my solution as well since it lets me indirectly secure everything with a physical second factor and not worry about migrating things when changing phone numbers such as when moving countries but some services don't accept gvoice numbers.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#277

Post by drewmol »

zaroth wrote: post #146

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to…

There's an MVNO owned by the Canadian ISP tucows called Ting, I used them for my primary mobile service for some time (I would still but I wanted access to Verizon's 700 and 800 Mhz bands for better coverage at my residence so I switched). Anyhow last time I checked they've since added several awesome (and self configurable via their account dashboard) features like multi factor auth settings for # porting, comprehensive forwading options, port locking, locking a line to a sim or device, among other security related overlays to their service some assible via REST API, IIRC. They offer live, immediatly accessable by phone call, north american based (US/Canada), friendly, usually native english spreaking knowledgable support agents and start their minimum service tier pricing at $6/line/month with the ability to toggle (block) voice, sms and data services for each line. For < $90/yr you can configure a pretty secure dedicated line for 2FA.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#278

Post by alistairSH »

lotsofpulp wrote: post #253
alistairSH wrote: post #252

Earlier quoted context omitted.

But phone numbers are not unique. They are regularly re-assigned to new customers.

It’s a good enough solution. Especially for those with disposable income, they’re not changing numbers often, if ever.

Good enough, as long as you don't get assigned a number that previously belonged to a porn-addicted weirdo, or criminal, or dead-beat who doesn't pay their bills, or any number of other not-nice things that can turn your life into a hot mess despite never doing those things yourself.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#279

Post by legohead »

Spivak wrote: post #258
legohead wrote: post #173

Earlier quoted context omitted.

SMS is only as good as the cell providers security, which has been shown over and over again to be terrible. It should never be used in any ongoing authentication.

It may very well be bad in absolute terms but compared to a single weak password it’s a huge improvement. I would bet on “log in with phone number” being better than “log in with password” across a population any day.

It's less secure than even passwords.

Beyond SIM card cloning, I could sit behind a target, initiate a SMS auth, and simply wait for the guy to look at his phone. Most of the time it will pop up right on the front screen even if locked. If he misses it, I just wait for him to unlock the phone and look at his SMS. How would you like it if passwords just popped up visible to all on your phone?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#280

Post by cortesoft »

8ytecoder wrote: post #267

Both mobile number portability and SIM swap are stupidly insecure in the US. In every other country, you need to initiate the port with your current provider - usually by sending a text from your phone. Over here, I can do it from the receiving provider and that makes it really easy to bypass security checks. Similarly for SIM swaps - there's very little security and social engineering will do the job of bypassing it…

> In every other country, you need to initiate the port with your current provider - usually by sending a text from your phone

How does this work if your phone is lost/stolen?

Post reply on HN