Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vitalik Buterin reveals X account hack was caused by SIM-swap attack

cointelegraph.com

Post reply on HN
Print view View original

121–130 of 187 posts

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#121

Post by aftbit »

FabHK wrote: post #104
lxgr wrote: post #68

Earlier quoted context omitted.

The EBA (the European banking regulator in charge of specifying the technical details of the PSD2 regulation, which covers secure cardholder authentication, among other things) also stated a while ago that only SMS-OTP is a "true" factor; Email-OTP isn't. Ironically, my email account is so much better protected than my mobile phone number. I'm trying very hard to believe that the SMS lobby (i.e. mobile phone operator…

Insofar as one of the factors should be something the user knows , and one factor something the user has , that makes perfect sense. You know your password (or the master password to your password manager), and you have your phone with the SIM card. With email (or Authy), the second factor is also something you know , thus it's not 2F anymore. Note that NIST also recommends against email as a factor in 2FA (A-B11 her…

What do you mean? I "have" access to my SMSes via my phone, and I "have" access to my email or my Authy also via my phone. If you get my phone, you can:

1. start password reset via email

2. confirm via SMS 2FA

So that makes this into 1FA not 2FA.

At least for TOTP secrets, I can store them securely, and attackers cannot convince a human support agent somewhere to hand them over.

If you want true 2FA, you need something like WebAuthn with hardware tokens where the private key is on the token, but then you need a recovery process, and that takes you right back to the lowest common denominator of SMS verification.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#122

Post by lxgr »

FabHK wrote: post #104
lxgr wrote: post #68

Earlier quoted context omitted.

The EBA (the European banking regulator in charge of specifying the technical details of the PSD2 regulation, which covers secure cardholder authentication, among other things) also stated a while ago that only SMS-OTP is a "true" factor; Email-OTP isn't. Ironically, my email account is so much better protected than my mobile phone number. I'm trying very hard to believe that the SMS lobby (i.e. mobile phone operator…

Insofar as one of the factors should be something the user knows , and one factor something the user has , that makes perfect sense. You know your password (or the master password to your password manager), and you have your phone with the SIM card. With email (or Authy), the second factor is also something you know , thus it's not 2F anymore. Note that NIST also recommends against email as a factor in 2FA (A-B11 her…

> you have your phone with the SIM card.

Yeah, or a fraudster that talked my provider in to SIM-swapping it or porting out my number (quite possible, since many phone providers don't have 2FA themselves!), or malware on my Android phone with access to incoming SMS, or (although much less likely) an SS7 attacker...

A SIM is indeed a smart card theoretically capable of acting as a true "possession" factor (e.g. using EAP-AKA/EAP-SIM, although almost nobody uses that) – but calling it a possession factor for SMS-OTP is at least as much as a stretch as calling an email inbox a knowledge-only factor: Accessing my inbox requires a FIDO authenticator and password.

> Note that NIST also recommends against email as a factor in 2FA

I guess bad decisions and/or lobbying aren't limited to European regulators/legislators then.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#123

Post by lxgr »

wakeywakeywakey wrote: post #103
lxgr wrote: post #47

Every time I hear about yet another SIM swapping attack, I feel confirmed in my decision to use Google Voice for SMS-2FA as much as possible (only for services that don't support an actually secure method, of course). Except for one certain bank that won't even accept my "real [cell] phone number" for identity verification purposes, because "it's not verifiable" (probably because it's not with the big three cell prov…

On their tech support page [1], Google Fi is said to be resistant/immune to SIM swap attacks because the attacker needs physical access to your device and Google account. Yet earlier this year [2], the Google Fi hack said to have exposed Fi users to SIM swapping. Can anyone shed light on how this can happen without someone having your phone? [1]: https://support.google.com/fi/answer/9834243?hl=en [2]: https://www.red…

Implementation flaws like that are always possible, but my concern is that in so many cases, SIM swaps are ridiculously easy by design (or more accurately, by absence) of the phone provider's security procedures.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#124

Post by mindslight »

mr_mitm wrote: post #116
mindslight wrote: post #110

Earlier quoted context omitted.

After the first sentence, there were two more sentences explaining that. "Bank balance" meaning the money in your bank account, as opposed to information about your transactions. I did forget to include that my comment was US-centric.

Sorry, I still don't follow. With SMS 2FA the attacker needs strictly more information as compared to just a password. It doesn't matter if you log into your bank account or twitter. Did you mean a TAN for protecting individual transactions? I file this under authorization instead of authentication. But even then a SMS TAN is better than no TAN. I cannot see a scenario where adding SMS authentication makes things les…

You're focusing on an imagined attacker performing a single type of attack, and losing sight of more significant avenues for damage. When talking about the possibility of losing money, the main thing you need to do is check your account transactions within 30 days of being issued a statement. This is required so that you can report unauthorized transactions in a timely manner, so that they can be reversed. Transaction authentication essentially doesn't matter, especially in the consumer market - remember banks are still happily chugging along printing a withdrawal key on the front of every check. Any impediment to verifying your transactions in a timely manner, including for example discontinuing OFX Direct Connect access in the name of "2FA", increases the chance that you might miss the dispute period and actually lose money.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#125

Post by Scoundreller »

lxgr wrote: post #71
slashdev wrote: post #64

Earlier quoted context omitted.

I try to avoid giving my cell number, precisely because it’s not secure, but also because it changes or I travel, and then I’m locked out of my own account.

It's not a real vacation if you don't get locked out of at least one bank account or credit card for the crime of accessing your balance from a foreign IP, with no way to recover :)

Works great for my buy-and-hold portfolio.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#126

Post by lxgr »

JimDabell wrote: post #120
lxgr wrote: post #47

Every time I hear about yet another SIM swapping attack, I feel confirmed in my decision to use Google Voice for SMS-2FA as much as possible (only for services that don't support an actually secure method, of course). Except for one certain bank that won't even accept my "real [cell] phone number" for identity verification purposes, because "it's not verifiable" (probably because it's not with the big three cell prov…

> Except for one certain bank that won't even accept my "real [cell] phone number" for identity verification purposes, because "it's not verifiable" (probably because it's not with the big three cell providers). It’s common for organisations to blacklist VOIP-based numbers for 2FA. There’s more discussion about this, including some solutions, here: https://news.ycombinator.com/item?id=36909505

Yes, a horrible antipattern that's spreading rapidly.

I really hope that security researchers will demonstrate that trusting phone providers as the gatekeepers of modern digital identity is a bad idea – otherwise, fraudsters (and consumer frustration, in case of getting locked out arbitrarily) will.

My phone provider recently switched to SMS-OTP as a mandatory (and so far their only) 2FA method, including for SIM replacements. I guess I'm just supposed to start my life over on a new number if I ever lose my SIM card...?

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#127

Post by lxgr »

theolivenbaum wrote: post #102
buildbuildbuild wrote: post #93

Earlier quoted context omitted.

Be careful, I trace cryptocurrency for scam and hack victims and have personally seen GV transfers used in attacks. The lack of a physical SIM does not give more safety. "SIM Swap" means "convincing a system or human to transfer a phone number." A GV number is just as easy to transfer as any other phone number.

The only time where Google's absolute lack of customer service for end users might pay off

True – can't social-engineer a person if there's no person!

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#128

Post by lxgr »

dylan604 wrote: post #113
hammock wrote: post #101

Earlier quoted context omitted.

Which bank?

Wells Fargo is one. You cannot unlock a card suspended for suspicious activity with the app. You must call the automated line and listen to the 5 most recent transactions. You can confirm you made them or deny you made them. If you deny, the card is immediately revoked, and a new card is issued. If you confirm, the suspension on your card is immediately removed. Maybe the don't let you unlock on the app in case someo…

> Just trying to find some logic

My suggestion as somebody working in an adjacent industry, to protect your own sanity, is to not attempt that.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#129

Post by delfinom »

tyrfing wrote: post #91
kotaKat wrote: post #9

I thought T-Mobile significantly cracked down on SIM-swapping internally so this couldn't happen again? I know there's still no patch for human stupidity, but I really am concerned that T-Mobile still apparently seems to be the carrier of choice for easy SIM-swap attacks.

A few years ago, my phone completely died. I walked into a store with it and my new phone, and got them to port the number to a new SIM without providing any information like the account PIN which I had set but didn't remember. It's good customer service, and even if they're supposed to check a bunch of info, that's still just a bit of social engineering to get around. The only solution is to not allow those lower le…

_Many_ complaints. People have to realize that people working in tech that can tolerate 2FA jumps are a small minority of people in the general population. Not to mention, the scenario of "person losing their 2fa device" will happen thousands of times more frequently across 300+ million people than the one person a month in a corporate environment.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#130

Post by delfinom »

mr_mitm wrote: post #48
sammy2255 wrote: post #17

Ironically SMS 2fa is less safer than just using a password

That's not true. SMS 2FA may be the weakest form of 2FA, but it cannot be weaker than just using a password, because you always also need the password. As someone else pointed out, SMS based account recovery is the culprit.

Not to worry, great companies like Google harass you to set a recovery phone number /s

No seriously, it is aggravating how much SMS account recovery is a thing. Google even displays banners of "You are missing recovery information" because you set a recovery email but not a recovery phone.

Post reply on HN