Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

wsj.com

Post reply on HN
Print view View original

51–60 of 138 posts

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#51

Post by NortySpock »

disintegore wrote: post #33
jvanderbot wrote: post #29

"A booming industry of cybersecurity consultants, software suppliers and incident-response teams have so far failed to turn the tide against hackers and identity thieves who fuel their businesses by tapping these deep reservoirs of stolen corporate data." Sure, blame the consultants with their "booming industry". I'm sure T-Mobile spent adequate amounts of money on securing their data, hired all the best people, and…

I'm sure it's both. As in, much of what they did spend likely went to snake oil salesmen. I've met lots of security consultants who did not have backgrounds in math or compsci.

What do you consider a background in compsci? A few years in the industry?

Because my degree is in Management Information Systems (MIS), but I've done troubleshooting on both performance problems of the O(n^5) variety and problems of the "not covered in the requirements document" variety... Not sure what else I need to understand, say, memory bounds-checking problems or firewall/ACL configuration problems.

EDIT: expanded acronym

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#52

Post by ldoughty »

spyder wrote: post #47
coldcode wrote: post #3

Everyone's security is awful, as the penalty for failure is less than the expense required to make it secure. Until the former becomes higher the latter will guarantee insecurity rules.

Does the basic security scanning the hacker was doing costs hundreds of millions for big companies? Because that's the fines some big companies are getting: https://www.csoonline.com/article/3410278/the-biggest-data-b... or at least tens of millions in the EU thanks to GDPR: https://www.enforcementtracker.com/ We understand it's nothing compared to their profits but is it nothing compared to the cost of basic securit…

Equifax agreed to pay 600 million, but still saw profits up 20% for the year... Sure they could have made 600 million MORE in profit, but that's still just 15% of their profits for the year.. sure they'll spend a few million in the area they need to shore up one time and wait for the next incident... It's just good for business... Invest enough to keep these incidents down to one every 5 years, pay fine, repeat.

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#53

Post by throwaway223252 »

steviedotboston wrote: post #11
post_break wrote: post #6

Been a T-Mobile customer for ages. Sim swaps are too easy. 2 factor is a joke. This is like the 3rd time my data has been lifted. But I stay with them, why? Because I have 3 free lines, unlimited everything, for $32 a month. They have crazy phone trade in deals from time to time, T-Mobile tuesday usually nets me 15c off per gallon at shell. Am I happy that they keep getting hacked? Absolutely not, but I'm happy prett…

how on earth do you have 3 lines with unlimited data for 32 a month?

not quite as good a deal, but you can get $15/month with mint mobile, which sits on top of t-mobile's network. supposedly low priority but i've never had a problem in the past twelve months: http://fbuy.me/siAKU

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#54

Post by missedthecue »

kerng wrote: post #46
missedthecue wrote: post #37

Earlier quoted context omitted.

I pay about $25 a month for unlimited everything with T Mobile.

How? I have limited data and pay $65? Part of a larger family plan?

Yes you have to go in with at least two other people. Looks like it's going for $30 a month/line right now.

https://www.t-mobile.com/cell-phone-plans/essentials

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#55

Post by zafiro17 »

siva7 wrote: post #43
steviedotboston wrote: post #11

Earlier quoted context omitted.

how on earth do you have 3 lines with unlimited data for 32 a month?

this is crazy what you pay in america, in europe the cheapest unlimited t-mobile plan goes with 90€

For that price (approx USD 120) I get 4 lines, so my whole family. I'm not happy about the data breach, but I'm very happy with TMobile otherwise, and I seem to have a better deal than my friends on AT&T and others here in the USA.

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#56

Post by heavenlyblue »

NortySpock wrote: post #51
disintegore wrote: post #33

Earlier quoted context omitted.

I'm sure it's both. As in, much of what they did spend likely went to snake oil salesmen. I've met lots of security consultants who did not have backgrounds in math or compsci.

What do you consider a background in compsci? A few years in the industry? Because my degree is in Management Information Systems (MIS), but I've done troubleshooting on both performance problems of the O(n^5) variety and problems of the "not covered in the requirements document" variety... Not sure what else I need to understand, say, memory bounds-checking problems or firewall/ACL configuration problems. EDIT: expa…

What’s MIS?

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#57

Post by woodruffw »

disintegore wrote: post #33
jvanderbot wrote: post #29

"A booming industry of cybersecurity consultants, software suppliers and incident-response teams have so far failed to turn the tide against hackers and identity thieves who fuel their businesses by tapping these deep reservoirs of stolen corporate data." Sure, blame the consultants with their "booming industry". I'm sure T-Mobile spent adequate amounts of money on securing their data, hired all the best people, and…

I'm sure it's both. As in, much of what they did spend likely went to snake oil salesmen. I've met lots of security consultants who did not have backgrounds in math or compsci.

> I've met lots of security consultants who did not have backgrounds in math or compsci.

My experience both working at and with higher end consultancies is that there is no correlation whatsoever between those degrees and any particular consultant’s competency. Some of the best people I’ve worked alongside have been college dropouts and Religion majors.

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#58

Post by yjftsjthsd-h »

throwaway223252 wrote: post #53
steviedotboston wrote: post #11

Earlier quoted context omitted.

how on earth do you have 3 lines with unlimited data for 32 a month?

not quite as good a deal, but you can get $15/month with mint mobile, which sits on top of t-mobile's network. supposedly low priority but i've never had a problem in the past twelve months: http://fbuy.me/siAKU

It would be polite to at least disclose that that's a referral link

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#59

Post by 8ytecoder »

dv_dt wrote: post #24
nullify88 wrote: post #13

Earlier quoted context omitted.

So what you are saying is that the overcall cost of doing business with tmobile (both monetary and your personal data being public) justifies the convenience?

When it’s really not clear if other options are any more secure then one might as well optimize for the visible features of convenience.

I'm surprised myself to say this - Xfinity Mobile had the best security of all the mobile phone providers. SIM Swap is via a generated code that you have to login to generate. Customer Service verifies a ton of information before they look into your account. It's also generally cheaper than TMobile - but some features are sorely missing/lacking - they're still new.

All that said, Comcast Internet's business practices is outright awful - they lied to me multiple times about my plan and discounts. And you need Comcast to use Xfinity - it's very expensive otherwise.

Re: T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

#60

Post by eli »

disintegore wrote: post #33
jvanderbot wrote: post #29

"A booming industry of cybersecurity consultants, software suppliers and incident-response teams have so far failed to turn the tide against hackers and identity thieves who fuel their businesses by tapping these deep reservoirs of stolen corporate data." Sure, blame the consultants with their "booming industry". I'm sure T-Mobile spent adequate amounts of money on securing their data, hired all the best people, and…

I'm sure it's both. As in, much of what they did spend likely went to snake oil salesmen. I've met lots of security consultants who did not have backgrounds in math or compsci.

I don't see the connection between a background in math or computer science and exposing unprotected internal network devices to the internet.
Post reply on HN