Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers claim they breached T-Mobile more than 100 times in 2022

krebsonsecurity.com

Post reply on HN
Print view View original

261–270 of 342 posts

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#261

Post by duckmysick »

thrashh wrote: post #173
duckmysick wrote: post #132

Earlier quoted context omitted.

Aviation industry can introduce new regulation fast. One example would be reinforced cockpit doors. Prompted by events in September 2001, new standards published four months later (January 2002), expected to be completed fifteen months after that (April 2003). https://avalon.law.yale.edu/sept11/faa_001.asp

It makes sense for a change about doors. Doors are old as time. Everyone understands how doors work. The impact of a door change is straightforward. There are relatively few moving parts involved in a self contained door (figuratively and literally).

It was a first example that I thought of. There are others, less straightforward changes in recent years. They involve safety teams, risk assessment, terrain awareness system, voluntary reporting programs, hazard recognition. They made commercial flights safer and we can measure it.

https://www.faa.gov/newsroom/out-front-airline-safety-two-de...

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#262

Post by Aeolun »

ravenstine wrote: post #171
ctvo wrote: post #65

I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both password…

> In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. I gotta admit, that's pretty clever. Crude, but effective.

To be honest, there is already zero way to distinguish between shipping and customer service messages from Amazon. If you order any appreciable amount of items you would have no idea they sent you any message.

Of course I only found this out after being burned by it. Turns out they’d sent me a message telling me the item I returned was not in the same condition it was sent in (it was), but the message was utterly lost in the flood of ‘order received/sent/delivered’ mails they send (with the same subject).

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#263

Post by duckmysick »

clintonb wrote: post #226
duckmysick wrote: post #132

Earlier quoted context omitted.

Aviation industry can introduce new regulation fast. One example would be reinforced cockpit doors. Prompted by events in September 2001, new standards published four months later (January 2002), expected to be completed fifteen months after that (April 2003). https://avalon.law.yale.edu/sept11/faa_001.asp

Was that the industry, or the government?

Both. My point was, with enough motivation and resources it can be done. I gave an example of such industry in the sense of a sector of an economy.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#264

Post by yborg »

jabroni_salad wrote: post #150
londons_explore wrote: post #45

Earlier quoted context omitted.

> those instances _should_ be easy to trace and prosecute I suspect that the employees aren't merely doing a sim swap attack with their work login credentials. Like you say, they'd clearly get fired/prosecuted for that. Instead, I suspect criminal X buys a nice thing delivered to employee Y's house. Then, criminal X phones the helpdesk repeatedly till they get connected to employee Y during working hours. Then, they…

On darknet diaries the stories told are a little more straightforward. They just walk in to the store, steal a tablet out of the manager's hands, run away with it, and make all the changes they can with the logged-in session until corporate locks out the device.

Maybe T-Mo should consider using hardwired terminals again if they can't figure out how to geofence their POS tablets. This also might help with employee job satisfaction since they are less likely to be assaulted at work.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#265

Post by welder »

mrb wrote: post #242
ctvo wrote: post #65

I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both password…

As an InfoSec professional, what you describe sounds more like a device-level compromise of your iphone, perhaps through a malicious app, or link you clicked. What your experienced can't be done with just a sim swap attack, as you would have lost access to your phone number. And it can't be done with the described T-Mobile hack, as it would have given the hackers silent access to your texts, so they could have reset…

That assumes their password wasn't already compromised. If they re-used their Gmail password somewhere else, the attacker could have already had their Gmail password and only needed the SIM-swap to verify the login.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#266

Post by at-fates-hands »

kkielhofner wrote: post #253
ctvo wrote: post #65

I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both password…

There must be something especially lucrative about GoPros as stolen devices. I’ve heard multiple independent stories from a few friends in Law Enforcement about cases involving trafficking of large quantities of stolen GoPros (obtained via methods not unlike what happened to you). Interesting you mention NYC - at least one of these cases involved a very high volume fencing syndicate operating as a legitimate storefro…

If you go on ebay, you can find tons of shady gopro listings.

They'll have all the original packaging and put it up as a "pre-owned" unit, but then you open the listing and they have 20 of them for sale.

We also had a local hotel/waterpark that was running a burglary/fencing operation in the mid aughts. The room cleaners would look for gopros, iphones and other electronics. If they found anything, they'd take it and hand it over to the two managers, who then fenced it out to local guys who'd either pawn them or sell it on Craigslist and they'd split the money.

Customers routinely complained to the managers who were the fences so they'd tell the customer they'd fill out a complaint form and send in a police report to the local PD. Obviously, that never happened. This went on for about two years until people on social media and review sites like Yelp started discovering what was happening was not an accident. They finally busted the ring and within a few weeks, the waterpark and hotel were shut down for various other repeated OSHA and other infractions that went unfixed. The local paper reported even though they busted the ring, the money and the goods were long gone, leaving the victims with little recourse.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#267

Post by computing »

wnevets wrote: post #237
computing wrote: post #228

Earlier quoted context omitted.

they pay-off / trick a T-Mobile employee into re-assigning your Google Voice number to them. It's happened before with Google Fi, but I haven't seen any public information about this happening with Google Voice (yet)

> they pay-off / trick a T-Mobile employee into re-assigning your Google Voice number to them. Are you saying the Google Voice phone number lock is useless and that any carrier can just steal Google Voice numbers regardless of the lock status?

here is a link to a report of that happening to a Google Fi customer:

https://old.reddit.com/r/GoogleFi/comments/10pjtie/google_fi...

I don't work at Google and don't know if this is possible with Google Voice. However, Google Fi is their paid service, so I would assume that's the one they'd want to protect the most.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#269

Post by zippergz »

ctvo wrote: post #65

I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both password…

Something doesn't add up here because last I checked Amazon made you put the credit card number in again if you want to ship to a new address. Just breaking in to your amazon account wouldn't be sufficient to ship stuff to random addresses using your credit card.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#270

Post by px43 »

mrb wrote: post #242
ctvo wrote: post #65

I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both password…

As an InfoSec professional, what you describe sounds more like a device-level compromise of your iphone, perhaps through a malicious app, or link you clicked. What your experienced can't be done with just a sim swap attack, as you would have lost access to your phone number. And it can't be done with the described T-Mobile hack, as it would have given the hackers silent access to your texts, so they could have reset…

Read up on credential stuffing, this is increasingly common. With all the recent breaches, there are groups that use old passwords to quickly identify MFA locked accounts behind re-used passwords. These lists are then sold to people who will, one at a time, pay about 10k for a SIM swap on individually targeted users.

There are lists floating around with 10s of thousands, or hundreds of thousands of users with known passwords in Google, Amazon, Paypal, Coinbase, etc.

Episode 112 of Darknet Diaries (March last year) has a really good breakdown of these markets: https://darknetdiaries.com/episode/112/

Post reply on HN