Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers claim they breached T-Mobile more than 100 times in 2022

krebsonsecurity.com

Post reply on HN
Print view View original

221–230 of 342 posts

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#221

Post by alex_sf »

wmeredith wrote: post #213
thrashh wrote: post #84

Earlier quoted context omitted.

I think why regulation hasn’t happened is because the computer industry has changed so quickly. Two-factor auth wasn’t even a commonly accepted best practice two decades ago. And regulation takes a while to create and put into practice and with the rate things are going, by the time regulation has been out in place, the current best practices will have changed. Whereas writing regulation on building bridges is easy b…

> I think why regulation hasn’t happened is because the computer industry has changed so quickly. It also doesn't help that the US government is a barely-functioning kleptocracy. They're more concerned with passing legislation about transgender boogymen while they line their pockets than they are about ... well, anything else.

A more reasonable alternative view is that regulations are largely opposed by most in the industry for good reasons. Including the fact that the explicit absence of such is what allow for the internet to exist at all.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#222

Post by clintonb »

photon12 wrote: post #93
thrashh wrote: post #84

Earlier quoted context omitted.

I think why regulation hasn’t happened is because the computer industry has changed so quickly. Two-factor auth wasn’t even a commonly accepted best practice two decades ago. And regulation takes a while to create and put into practice and with the rate things are going, by the time regulation has been out in place, the current best practices will have changed. Whereas writing regulation on building bridges is easy b…

I agree completely. I didn't ask why government enforced regulation hasn't happened. I asked why industry self-regulation has failed. I've worked in a regulatory/security role for a major conglomerate before. I'm not saying I expected self-regulation to work. But, if you are in a position of customers seeing direct harm every day , it's not unreasonable to ask why there is a failure here.

What does it mean for the industry to self-regulate? How do you define industry? Is it telecoms, or all tech companies?

Self-regulation has failed because the cost of a data breach remains relatively low compared to implementing security measures, at least on the surface.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#223

Post by clintonb »

phaedrus wrote: post #163
azinman2 wrote: post #158

Earlier quoted context omitted.

That’s assuming you regulate a very specific thing versus the end goal. To me the appropriate regulation is to find a way to cause real harm to T-Mobile when they are breached. When repeated like this or if done through effectively negligence, then they shouldn’t be allowed to be in business anymore. We gotta stop the tiny fines.. jail, billions of dollars in fines, remove their business license… something large need…

One way to do so would be to make it so wireless companies can lose access to spectrum as a consequence of customer data breaches. Let someone else who can keep customer data secure have it instead.

That ultimately hurts customers more than the data breach. Limiting access means less availability for customers. If all the customers leave, you’ve just contributed to a monopoly/oligopoly.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#224

Post by 6ak74rfy »

livueta wrote: post #219
6ak74rfy wrote: post #207

Earlier quoted context omitted.

Both Fidelity and Schwab allow non-SMS 2FA. They both use Symantec VIP but it’s fairly easy (for developers at least) to export those tokens and import them into something like Authy, Google Authenticator etc. https://ketanvijayvargiya.com/257-symantec-vip-authy/

Do you happen to know if they allow you to also totally disable SMS 2FA? I know that Vanguard, for instance, supports non-SMS 2FA but doesn't let you disable SMS as a fallback (and I'd rather not just totally remove all phone numbers, but maybe I have to...).

Yeah, in Fidelity SMS 2FA is disabled for me. Fall back is to call them to get into my account. Don’t know about Schwab.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#225

Post by alex_sf »

vlovich123 wrote: post #134
UncleMeat wrote: post #88

Earlier quoted context omitted.

I have no idea what you are talking about here. SIM swap and spam texts/calls are entirely different issues.

If it's scalable to mass call a good chunk of the US population, I'm sure it's scalable to mass call providers to socially engineer a SIM swap.

That's.. not how social engineering works.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#226

Post by clintonb »

duckmysick wrote: post #132
thrashh wrote: post #84

Earlier quoted context omitted.

I think why regulation hasn’t happened is because the computer industry has changed so quickly. Two-factor auth wasn’t even a commonly accepted best practice two decades ago. And regulation takes a while to create and put into practice and with the rate things are going, by the time regulation has been out in place, the current best practices will have changed. Whereas writing regulation on building bridges is easy b…

Aviation industry can introduce new regulation fast. One example would be reinforced cockpit doors. Prompted by events in September 2001, new standards published four months later (January 2002), expected to be completed fifteen months after that (April 2003). https://avalon.law.yale.edu/sept11/faa_001.asp

Was that the industry, or the government?

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#227

Post by bearjaws »

xorcist wrote: post #122
thrashh wrote: post #84

Earlier quoted context omitted.

I think why regulation hasn’t happened is because the computer industry has changed so quickly. Two-factor auth wasn’t even a commonly accepted best practice two decades ago. And regulation takes a while to create and put into practice and with the rate things are going, by the time regulation has been out in place, the current best practices will have changed. Whereas writing regulation on building bridges is easy b…

> Two-factor auth wasn't even a commonly accepted best practice two decades ago. Maybe, had you said three decades? But not two. It was already mature by then. Two decades ago was 2003. Even consumer banking was online, and in many countries exclusively 2FA. I've worked the banking space then and we absolutely had smart cards. Military and defense had them everywhere. Proprietary solutions had already gone away repla…

I would bet most peoples first encounter with 2fa was 2013+, I didn't even have to use it at my job (in healthcare!) until 2015.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#228

Post by computing »

wnevets wrote: post #124
computing wrote: post #90

Earlier quoted context omitted.

why do you think that? Presumably Google Voice uses a phone company downstream, which means if that company is hacked they can reassign your number to someone else and thus you have the classic SIM jacking attack.

Which phone company does the hacker call to trick into believing they are Google?

they pay-off / trick a T-Mobile employee into re-assigning your Google Voice number to them. It's happened before with Google Fi, but I haven't seen any public information about this happening with Google Voice (yet)

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#229

Post by clintonb »

Buttons840 wrote: post #183
gjsman-1000 wrote: post #32

Earlier quoted context omitted.

You assume that regulation can just make security magically happen. I see no reason to assume that premise to be correct in practice. It's not like the US Government hasn't been breached countless times or had Supreme Court opinions leaked; and it's not like corporations that really tried and should be examples of best practice haven't also been breached. Also, what law can prevent insider attacks? There's already pl…

> There's no law that just "makes security happen" In another thread I proposed making white-hat hacking legally protected, even without permission from the company. If your system is constantly being tested by mostly white-hat hackers seeking their next responsible disclosure and bounty, then that's something. Bug bounties already exist, but they're opt-in, and companies that need them the most are not opting-in. We…

Legalizing hacking seems like a large loophole that will backfire. Where is the line between white-hat and black-hat?

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#230

Post by tpmx »

coreyog wrote: post #130

I worked for TMobile for 4 days in 2021. I don't usually apply to big companies but money was tight because pandemic and I needed a job quick. I was assigned to work on the config server (think in-house developed consul or etcd) and it was awful. "If this specific config value is being set by Service A then what is actually written should be twice the given value, but if Service B is reading the value, return 1/3 of…

> I don't usually apply to big companies but money was tight because pandemic and I needed a job quick.

So T-Mobile offered you a "quick job" that immediately gave you access to their inner sanctum?

These threads are a hoot.

Post reply on HN