Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vitalik Buterin reveals X account hack was caused by SIM-swap attack

cointelegraph.com

Post reply on HN
Print view View original

51–60 of 187 posts

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#51

Post by ticoombs »

pimlottc wrote: post #42
hospitalJail wrote: post #20

Earlier quoted context omitted.

I'm a bit paranoid about 2FA ever since my charging port got damaged and I literally couldn't charge my phone to get to authentication. Scary stuff, had to give sooo much personal information over the course of months to recover a single account. Not sure a solution, maybe have a wifi only phone that I only turn on for Auth?

You can enroll multiple devices using the same TOTP QR code, just scan it more than once. They will generate the same code sequence and the site won’t know the difference. You can even save the QR code and enroll a new device later if you want.

> You can enroll multiple devices using the same

You could even save it in an application like KeepassXC. Then you turn on the TOTP mode and presto, you have another TOTP device

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#52

Post by skdk »

londons_explore wrote: post #41
baybal2 wrote: post #31

Earlier quoted context omitted.

Ironically, every SIM card is a cryptographic secure element, and it would've been ideal to do public key login. If you plug SIM card into desktop, you can actually do signing with it, and TLS authentication. I recall, only Nokia S60 series, and A200 had a SIM card API exposed to apps. Ios does not give you access to SIM, Android does only for system apps.

Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.

The API could return different identifiers per app

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#53

Post by cdchn »

macNchz wrote: post #5

When I read that once they got into the account all the attacker did was post a link to a crypto giveaway scam, I briefly wondered why someone who managed to get into an account like this wouldn’t try to pivot it into something more sophisticated. Then in the next sentence we learn they made $700k off of the scam! I’ve seen these giveaway scams on hacked popular Twitter accounts for years, I’m surprised they’re still…

If there is a sophisticated attack pivot that is as profitable, quick, proven and safe, I don't think anybody knows what it is.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#54

Post by eli »

netsharc wrote: post #44
macNchz wrote: post #5

When I read that once they got into the account all the attacker did was post a link to a crypto giveaway scam, I briefly wondered why someone who managed to get into an account like this wouldn’t try to pivot it into something more sophisticated. Then in the next sentence we learn they made $700k off of the scam! I’ve seen these giveaway scams on hacked popular Twitter accounts for years, I’m surprised they’re still…

$700k? I see that human idiocy is a large untapped source of wealth...

And all those people had crypto wallets ready to go. Go figure.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#55

Post by eli »

skdk wrote: post #52
londons_explore wrote: post #41

Earlier quoted context omitted.

Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.

The API could return different identifiers per app

While it's also signing things for you? That seems rather hard to implement.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#56

Post by cdchn »

netsharc wrote: post #44
macNchz wrote: post #5

When I read that once they got into the account all the attacker did was post a link to a crypto giveaway scam, I briefly wondered why someone who managed to get into an account like this wouldn’t try to pivot it into something more sophisticated. Then in the next sentence we learn they made $700k off of the scam! I’ve seen these giveaway scams on hacked popular Twitter accounts for years, I’m surprised they’re still…

$700k? I see that human idiocy is a large untapped source of wealth...

The crypto "degens" are pretty much the perfect cohort for pulling these kind of scams on. They're driven by fast money, unearned profit, and the premise of investment despite all rational signals pointing to it being a bad idea. Its a Condensation of Rubes.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#57

Post by doogieboo »

ticoombs wrote: post #51
pimlottc wrote: post #42

Earlier quoted context omitted.

You can enroll multiple devices using the same TOTP QR code, just scan it more than once. They will generate the same code sequence and the site won’t know the difference. You can even save the QR code and enroll a new device later if you want.

> You can enroll multiple devices using the same You could even save it in an application like KeepassXC. Then you turn on the TOTP mode and presto, you have another TOTP device

bitwarden has TOTP built in as well. Apple has it built into their platform, but its tougher to use and only works with Chrome if you use windows too.....

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#58

Post by lxgr »

otterpro wrote: post #39

I've been using Google Voice free phone number if I need to give out phone number for verification, and I hope it mitigates the possibility of SIM-swapping. Also I have another burner phone number using Hushed on my phone. Does anyone know if there's vulnerability using these burner numbers?

I'd say that depends entirely on the security of whatever "burner phone" (these are just a different marketing term for texting-capable VoIP- lines, right?) service you use.

Depending on how careful they are about account login and recovery as well as port-out procedures, it can be much more or less secure than a "real" mobile line.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#59

Post by simiones »

theblazehen wrote: post #25
hospitalJail wrote: post #20

Earlier quoted context omitted.

I'm a bit paranoid about 2FA ever since my charging port got damaged and I literally couldn't charge my phone to get to authentication. Scary stuff, had to give sooo much personal information over the course of months to recover a single account. Not sure a solution, maybe have a wifi only phone that I only turn on for Auth?

Have a paper backup of the codes?

And carry it with you at all times, of course.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#60

Post by slashdev »

skdk wrote: post #52
londons_explore wrote: post #41

Earlier quoted context omitted.

Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.

The API could return different identifiers per app

That’s meaningless if you can also use it to compute a signature. Just use the signature of a constant string as the id.
Post reply on HN