51–60 of 60 posts
Hi HN, the author of the article here. Can someone explain how Telegram 2FA, Yahoo 2FA and Apple 2FA were bypassed? Especially Apple 2FA - I received a 2FA call from Apple, picked it up, and the attacker logged in right after. Please note, this was not a (typical) SIM swap. I was still receiving SMS and calls during the attack. p.s. thanks for all the comments!
Hi HN, the author of the article here. Can someone explain how Telegram 2FA, Yahoo 2FA and Apple 2FA were bypassed? Especially Apple 2FA - I received a 2FA call from Apple, picked it up, and the attacker logged in right after. Please note, this was not a (typical) SIM swap. I was still receiving SMS and calls during the attack. p.s. thanks for all the comments!
Did you have more than one trusted number for Apple MFA? Trusted devices you don’t control?
Earlier quoted context omitted.
I don't think there is anything wrong in particular with using Chrone's browser sync or password management system at all. That is so long as the linked account is secure. The problem here is the weakest link which I imagine is the recovery email assigned to his google account (ie probably the Yahoo account). That was likely compromised because of the phone/SMS-based 2fa. That is nothing to do with Google as users sh…
Yahoo account wasn't a recovery account for Gmail.
1) Use something like a Microsoft/Google as a recovery email. 2) Setup TOTP 2fa and monitor regularly account access. 3) Don't leak your password.
If a google account is hacked, it's almost certainly caused by some fault by the user.
So, what does this say about Apple security? There's a lot of speculation and insinuation that all the security lapses started with the purchase of a refurbished MacBook, but there's zero evidence other than some coincidental timing. The author clearly wasn't using many security precautions prior to being compromised. They had many interconnected accounts; reused passwords; limited use of 2FA; phone/SMS-based 2FA in…
Your comment doesn't add any value to uncovering the root of the issue and just blaming the author without having the full picture.
> The author clearly wasn't using many security precautions prior to being compromised ...
Just because I don't mention the exact security precautions I use in the article, doesn't mean that I don't actually use them.
I spent 12+ years in tech. And started off my career by specialising in networks and security. And all my life I exhibited as much confidence as you are in your comment.
The moral of the story, is that if you are in tech, a security professional, or work in crypto - don't take for granted your security. No matter where you are in your career, what's your salary, or how many people report to you. Take time annually, bi-annually, or quarterly to review your online security. Especially if you've been on the internet since 90s. You might not even remember the websites you've sign up and emails you have.
> So, what does this say about Apple security?
If you can explain how Apple 2FA call was bypassed that you be helpful. What wasn't mentioned in the article is that I spoke with two Senior Advisors from Apple and they've haven't been taking this very seriously, to say the least. "Consider reinstalling the OS" and suggestions alike. It's an obvious next step to take, but it doesn't answer the question of how 2FA was breached. Reinstalling the OS or taking any other common measures in such sophisticated incidents don't prevent future incidents alike.
So, what does this say about Apple security? There's a lot of speculation and insinuation that all the security lapses started with the purchase of a refurbished MacBook, but there's zero evidence other than some coincidental timing. The author clearly wasn't using many security precautions prior to being compromised. They had many interconnected accounts; reused passwords; limited use of 2FA; phone/SMS-based 2FA in…
Hey @caymanjim, author here. Your comment doesn't add any value to uncovering the root of the issue and just blaming the author without having the full picture. > The author clearly wasn't using many security precautions prior to being compromised ... Just because I don't mention the exact security precautions I use in the article, doesn't mean that I don't actually use them. I spent 12+ years in tech. And started of…
it can be anyone of course but after briefly looking in to u and what u said about everything I have a weird suspicion
Have u ever knowingly talked with someone or talked about maybe a site U were competing with at one point whether recently or years ago just at all? Especially related to crypto because I see too many similarities with something I was researching through a lot recently and found exciting info to say the least
Anyway gl with investigation. Be cautious ur other devices are not infected with something crazy
www.activebonorum.com
It’s time to recover the money you lost with Binary Options!
If the company does not return your money, you should approach your credit card company or issuing bank and fill out the paperwork for a chargeback, citing fraud, misrepresentation and breach of contract as the reasons or you can seek the assistance of a private investigator and asset recovery expert, former industry insiders said. (binary options brokers routinely lie about their identity, location and financial experience) www.activebonorum.com