Live data from Hacker News

NY Man Pleads Guilty in $20M SIM Swap Theft

krebsonsecurity.com

61–70 of 176 posts

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#61
post #43

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

cough national id scheme, anyone? Thinking of E-Estonia here.

My National ID is valid for 10 years, but certificates expire 3 years after issue. Can only renew face to face, but I’m approx 30hours of flight time away from home, lol.

But I agree - NFC passports are already kinda doing that, but there isn’t enough services that support it.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#62
post #59

I don't think people appreciate just how big the crypto fraud problem is, and how much bigger it will get. Crypto is so big, to put it in perspective, the gambling sector worldwide was estimated to be worth roughly $265 billion U.S. dollars in 2019. That is just 2/3 the market cap of Ethereum alone. Crypto is bigger than pretty anything right now. Bigger than pro sports. bigger than the entertainment industry. Only t…

SIM swapping has really nothing to do with crypto per se, people use it to steal identities/fiat all the time. Crypto is big, but to be fair "just" Apple is bigger than crypto. Compared to the NYSE or Nasdaq, it's small, and when compared to forex (maybe a more apt comparison), it barely registers. Incidentally, I think this is why crypto's here to stay (probably forever): it's huge and growing, very popular, and the…

crypto is money. So you got $2.2 trillion of money lying around. So of course criminals are going to go through any means to get some, including sim swaps, but soo much more. You cannot steal stock or real estate in the same way you can steal crypto. Crypto by definition is irreversible and unbreakable. SO even way more attractive to criminals just for that property.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#63
post #43

Earlier quoted context omitted.

cough national id scheme, anyone? Thinking of E-Estonia here.

I lived in the Netherlands and admired how they offer a SSO service called DigiD for most—if not all—national and municipal services: personal tax, business tax, healthcare, pension, water, garbage, police and many other service portals. Yes, there is a nice online police portal where you can digitally file a police report, get a declaration for insurance, and ask questions. You also get a digital inbox—Berichtenbox—…

Not having to depend on phone numbers would be so good, especially for citizen mobility.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#65
post #59

I don't think people appreciate just how big the crypto fraud problem is, and how much bigger it will get. Crypto is so big, to put it in perspective, the gambling sector worldwide was estimated to be worth roughly $265 billion U.S. dollars in 2019. That is just 2/3 the market cap of Ethereum alone. Crypto is bigger than pretty anything right now. Bigger than pro sports. bigger than the entertainment industry. Only t…

SIM swapping has really nothing to do with crypto per se, people use it to steal identities/fiat all the time. Crypto is big, but to be fair "just" Apple is bigger than crypto. Compared to the NYSE or Nasdaq, it's small, and when compared to forex (maybe a more apt comparison), it barely registers. Incidentally, I think this is why crypto's here to stay (probably forever): it's huge and growing, very popular, and the…

>I don't think governments care to (or can) regulate it

China has literally banned Bitcoin. Their approach is to roll out their own digicoin.

Governments have been very slow to figure out how to approach crypto, but the current Wild West of tax evasion, money laundering and virtual bank robberies won't go on forever. Just like counterfeiting and money laundering exists today, there will continue to be exploitation of the financial system, but it will be explicitly criminalized.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#66

Earlier quoted context omitted.

There are already standard ways of doing brick and mortar identity verification, and in somewhat surveillance-resisting ways even! The most common is "notarization" - a state-deputized "notary" verifies that you are who you say you are, and then endorses your signed document with a special stamp and a signature. Another common one used for financial transactions is a "medallion stamp", wherein not only do they verify…

Yes, but notarization feels like a much more cumbersome process, designed for more like "once in a lifetime" transactions (house purchase, will, etc). It also feels more like a proof, only needed if a transaction is disputed in court etc, it can be investigated back to the source. I mean the every day kind of verification that fuels our daily transactions and benefits from instantaneous info being transmitted back an…

The cumbersome part of notarization is having to physically go to the bank, which would be the same for the post office. The performance of showing up in person, and showing a physical hard-to-forge ID, is exactly what drastically raises the bar for an attacker.

Doing this instantaneously implies skipping the heavyweight process. Which I assume means doing something like a one time (or periodic) cumbersome in-person process, and then repeating a quicker online process. Any private company could create such a system right now, bootstrapping off the notarization framework to do the heavy lifting.

But credit cards and other traditional financial institutions don't actually care about identity in such a strong sense. The standard process for setting up online access for a new account at a brick and mortar bank involves leaving the bank, going to their website from home, and entering your not-particularly-private information to sign up. That could be easily modified to setting up initial access credentials right in the bank if they wanted to, but the traditional financial system is pretty forgiving for the most part.

So we're really talking about custodians of new bearer instruments (eg cryptocurrency), which are more like cash. Hence my reference to these new holding companies being the ones that should be integrating notarization into their exceptional account access methods. Of course they could also just insist on the use of real security tokens, require a second one for backup purposes, and simply not use SMS at all.

FWIW another more convenient way of doing brick and mortar verification is to snail mail out a letter with a code on it to the address of record. It obviously doesn't have super security properties (anyone can steal mail), but it's much better than electronic-only non-verification and much nicer than surveillance database verification.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#67
post #29

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

the USPS could be doing this and so much more for citizens. But lawmakers in this country are allergic to having the government manage anything

Here's my Senator on the subject of postal banking:

> “You would have to work very hard to come up with a worse idea than having the government become a national bank executed through the post office,” [Sen. Pat Toomey, a Pennsylvania Republican] said. “Even if the U.S. Postal Service was the most competent, professional and best-run organization on the planet, they should not be in the business of banking.

> “We have banks,” Toomey continued. “The idea that the government is going to do a better job is just laughable.”

What a moron.

https://www.oleantimesherald.com/news/gop-senators-oppose-id...

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#68
post #25

Earlier quoted context omitted.

> Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there. Have any suggestions for a bank that supports TOTP? I have yet to find a decent bank in the US that supports this.

First Tech Federal Credit Union and Fidelity both support time/token based auth although it's Entrust or Symantec VIP, not open TOTP

I really wish there was some bank would support plain TOTP. I don't want 5 different solutions to managing my TOTP tokens. I already have one.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#69
post #65
post #59

Earlier quoted context omitted.

SIM swapping has really nothing to do with crypto per se, people use it to steal identities/fiat all the time. Crypto is big, but to be fair "just" Apple is bigger than crypto. Compared to the NYSE or Nasdaq, it's small, and when compared to forex (maybe a more apt comparison), it barely registers. Incidentally, I think this is why crypto's here to stay (probably forever): it's huge and growing, very popular, and the…

>I don't think governments care to (or can) regulate it China has literally banned Bitcoin. Their approach is to roll out their own digicoin. Governments have been very slow to figure out how to approach crypto, but the current Wild West of tax evasion, money laundering and virtual bank robberies won't go on forever. Just like counterfeiting and money laundering exists today, there will continue to be exploitation of…

> China has literally banned Bitcoin. Their approach is to roll out their own digicoin.

China "banning" cryptocurrency is a meme at this point (I think they've banned it 4 times now).

> Wild West of tax evasion

You literally cannot evade taxes, so I'm not even sure what this means. All US exchanges report everything to the IRS/SEC. And if the exchanges don't, your bank certainly will. Moving money in your bank account and not reporting it as income is a big no-no so good luck to anyone that tries to do this.

> Just like counterfeiting and money laundering exists today

This is kind of a faulty analogy, it's not like cash is banned, and most of those things are done with cash. People seem to like crypto markets as a speculative instrument. Is that good/bad? I don't know, but it's probably here to stay.

Post reply on HN