Live data from Hacker News

Two Charged in SIM Swapping, Vishing Scams

krebsonsecurity.com

31–40 of 71 posts

Re: Two Charged in SIM Swapping, Vishing Scams

#31
post #15

It's insane to me that the only thing standing between me and having my life ruined is some minimum wage cell phone store employee. Text message based 2FA needs to die.

There are plenty of ways to ruin someone’s life with access to their phone number beyond compromising their accounts with 2FA. What really needs to die is giving privileged access to underpaid monkeys.

> What really needs to die is giving privileged access to underpaid monkeys.

This in uncalled for.

Re: Two Charged in SIM Swapping, Vishing Scams

#32
post #15

It's insane to me that the only thing standing between me and having my life ruined is some minimum wage cell phone store employee. Text message based 2FA needs to die.

There are plenty of ways to ruin someone’s life with access to their phone number beyond compromising their accounts with 2FA. What really needs to die is giving privileged access to underpaid monkeys.

Or they could pay workers with privileged access more.

Re: Two Charged in SIM Swapping, Vishing Scams

#33
post #31

Earlier quoted context omitted.

There are plenty of ways to ruin someone’s life with access to their phone number beyond compromising their accounts with 2FA. What really needs to die is giving privileged access to underpaid monkeys.

> What really needs to die is giving privileged access to underpaid monkeys. This in uncalled for.

You might reconsider this opinion once you or someone you know loses money and/or time because of some CS idiot. I’ve had my fair share of such incidents (so much that I’m paying 10x more for an enterprise-grade leased line just to not have to talk to them ever) and I no longer have any sympathy for those people.

Re: Two Charged in SIM Swapping, Vishing Scams

#34

Ah yes, of course they were only caught because the two had a falling out and then one swatted the other.

It’s the 21st century prisoners dilemma. You and your partner stole a bunch of Bitcoin via SIM swapping. If you split it, you each get half. If you don’t split it, the other one will SWAT you and you both go to jail.

Not to nitpick this brilliant comment, but it's more of an iterated prisoner's dilemma over multiple thefts. If one expected the charade to go on forever then the optimal strategy is indeed TFT (https://en.wikipedia.org/wiki/Tit_for_tat) but a criminal well-advised in game theory could calculate a threshold gain beyond which it is optimal to compete.

Re: Two Charged in SIM Swapping, Vishing Scams

#37
post #31

Earlier quoted context omitted.

There are plenty of ways to ruin someone’s life with access to their phone number beyond compromising their accounts with 2FA. What really needs to die is giving privileged access to underpaid monkeys.

> What really needs to die is giving privileged access to underpaid monkeys. This in uncalled for.

I worked for Software Etc. for a while. I remember thinking "they pay us peanuts and they expect monkeys".

This was demonstrated by the two fat binders filled with procedures for EVERYTHING that were supposed to followed to the letter.

Re: Two Charged in SIM Swapping, Vishing Scams

#38
Using phone numbers for verification is just stupid. I've switched phones a few times over the years and just got a new number rather than keeping my old one and i got locked out of my accounts because i didn't have access to the old number anymore. Stuff like Authy and Google Authenticator exist, I think it's time companies started using them.

Re: Two Charged in SIM Swapping, Vishing Scams

#39
post #8
post #4

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that. Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key…

(Googler, opinions on my own) This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.

> This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps.

Are you sure that this is the case? According to https://support.google.com/fi/thread/761170 there was at least one case where support agents moved a Fi number from a locked account to a newly reopened account, without the user being able to access the locked account:

> I call Google Support and the amazing Google Support rep I spoke to (The only good one I’ve talked to so far during this whole process) stayed with me for over an hour and worked with tier 2 support in getting my Project Fi number transferred to Account 2.

A SIM swap with Fi might be harder to accomplish than with a regular provider, but it looks like there's still the risk that someone manages to convince a support agent to move the number to a different account.

Re: Two Charged in SIM Swapping, Vishing Scams

#40
post #31

Earlier quoted context omitted.

> What really needs to die is giving privileged access to underpaid monkeys. This in uncalled for.

You might reconsider this opinion once you or someone you know loses money and/or time because of some CS idiot. I’ve had my fair share of such incidents (so much that I’m paying 10x more for an enterprise-grade leased line just to not have to talk to them ever) and I no longer have any sympathy for those people.

Heh.

I started my tech career in a call center. Were there people there that shouldn't have had that job? Sure. Do those people deserved to be belittled by calling them monkeys? No fucking way. Show some damn respect for your fellow man.

Post reply on HN