Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vitalik Buterin reveals X account hack was caused by SIM-swap attack

cointelegraph.com

Post reply on HN
Print view View original

161–170 of 187 posts

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#161

Post by msm_ »

yyyk wrote: post #160
yyyk wrote: post #62

Earlier quoted context omitted.

$700k in NFTs I recall. Isn't that more like $70?

Downvote all you like. NFTs have no real liquidity (or usecase), the 'price' is just wash trading.

You may or may not be right (I don't know enough about cryptocurrencies to know), but I think people don't like your snark. Some people lost a lot of money - they are victims of a scam. Now how much the attacker will actually earn from this is another matter, but your original post was not a very welcoming start of a discussion.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#162

Post by guiambros »

lr1970 wrote: post #157
f0e4c2f7 wrote: post #73

Earlier quoted context omitted.

It's pretty wild how baked into modern life insecure 2fa is. Especially with the prevalence of sim swapping. I more or less model most auth as trivially insecure at this point. You think about someone like Vitalik of all people, if he can't keep his account secure...average person has their work cut out for them. Private key auth systems have security challenges of their own (losing access forever when you lose your…

> It's pretty wild how baked into modern life insecure 2fa is. And a solution to this is very simple. Make telcos legally liable for losses due to SIM-swap attacks and before the ink is dry on such a law, Telcos will ban using phone numbers for authentication in their TOS. The banks and alike will be forced to come up with another, hopefully, better auth system.

Not sure why you're being downvoted; I think this is pretty reasonable idea.

Of course, there's zero chance of this happening in the US, given telcos would lobby heavily against it. But as a thought experiment, I think that's exactly what should happen: telcos should be held liable for their piss-poor security practices against SIM swapping.

And you never know what's going to come up from EU from a regulatory perspective.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#163

Post by msm_ »

londons_explore wrote: post #75
lxgr wrote: post #63

Earlier quoted context omitted.

Really? I'd imagine you'd need two codes (one for the login, one for access to your 2FA settings), but not being able to recover at all using them seems horrible!

It just gives some error like "this login method is not allowed for this action" or similar.

Interesting. I can't confirm though - I personally changed my 2FA device 2 weeks ago using a backup code. I couldn't find old yubikey that I used as 2FA for google, decided to regain access with a backup code and add my new yubikey, and it worked flawlessly. It probably helped that I used the same machine as always. Google does a lot of undocumented heuristics in the background, and you either get additional verification or not.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#164

Post by qingcharles »

rhaps0dy wrote: post #85
mmmmmbop wrote: post #78

Earlier quoted context omitted.

As someone who has been moving countries and subsequently changing phone numbers, every couple of years, SMS 2FA is such a pain. It's hard to recall all services that have your phone number for migrating them, and even if you do, many won't accept a foreign number. I've resorted to holding on to my old phone numbers by transferring them to prepaid SIMs.

Be careful with this, if you don’t use the prepaid sim for too long, it’ll get cancelled and you will lose access to all these accounts.

I've lost access to my near-twenty-year-old Google account this way.

I have the username, password and recovery email, but because I can't receive an SMS, I'm dead.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#165

Post by qingcharles »

twothamendment wrote: post #29
TheDong wrote: post #26

Earlier quoted context omitted.

Every competent TOTP implementation has backup codes. Use one of your backup codes when your phone breaks. You did write them down like the site told you to, right? Even if a site doesn't offer backup codes, you can extract the TOTP secret from the QR code, or most authenticator apps, quite easily, and then write it down. It's more secure to only save the backup codes though since they have a limited number of uses,…

I know you said competent, so this doesn't apply to the service I used yesterday, but it blew my mind. I lost access to TOTP for a service, but no big deal, I'm a good person who kept the backup codes. The codes are all 4 digits and the service wants a 6 digit code! Luckily it is some lame work account that someone else can unlock to get me back in. I couldn't believe that the backup codes provided are now obsolete!

Damn, you're lucky it's not something important. Especially with accounts for things like Google or Facebook/Instagram where they boast about not having any human support and you are totally shit-out-of-luck if you can't get in.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#166

Post by qingcharles »

msm_ wrote: post #163
londons_explore wrote: post #75

Earlier quoted context omitted.

It just gives some error like "this login method is not allowed for this action" or similar.

Interesting. I can't confirm though - I personally changed my 2FA device 2 weeks ago using a backup code. I couldn't find old yubikey that I used as 2FA for google, decided to regain access with a backup code and add my new yubikey, and it worked flawlessly. It probably helped that I used the same machine as always. Google does a lot of undocumented heuristics in the background, and you either get additional verifica…

Yes, same machine helped, it's definitely one of the factors it uses.

I have a near-20-year Google account I can't access because I lost the 2FA number. I have the username, password and recovery email. But that isn't enough, apparently.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#167

Post by slashdev »

qingcharles wrote: post #164
rhaps0dy wrote: post #85

Earlier quoted context omitted.

Be careful with this, if you don’t use the prepaid sim for too long, it’ll get cancelled and you will lose access to all these accounts.

I've lost access to my near-twenty-year-old Google account this way. I have the username, password and recovery email, but because I can't receive an SMS, I'm dead.

That’s horrific. My wife lost her Instagram account the same way. Really ruined part of our vacation in Paris. Looking back on it though, maybe that was worth it.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#168

Post by j0hnyl »

macNchz wrote: post #5

When I read that once they got into the account all the attacker did was post a link to a crypto giveaway scam, I briefly wondered why someone who managed to get into an account like this wouldn’t try to pivot it into something more sophisticated. Then in the next sentence we learn they made $700k off of the scam! I’ve seen these giveaway scams on hacked popular Twitter accounts for years, I’m surprised they’re still…

Given Vitalik's following this was a squandered opportunity. Just a little bit more effort could have netted many millions of dollars.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#169

Post by j0hnyl »

yyyk wrote: post #160
yyyk wrote: post #62

Earlier quoted context omitted.

$700k in NFTs I recall. Isn't that more like $70?

Downvote all you like. NFTs have no real liquidity (or usecase), the 'price' is just wash trading.

Big ticket NFTs are worth a lot of money and highly liquid. Also drainers will siphon eth and erc20 tokens as well.

Re: Vitalik Buterin reveals X account hack was caused by SIM-swap attack

#170

Post by gmerc »

lcnPylGDnU4H9OF wrote: post #146
gmerc wrote: post #106

Earlier quoted context omitted.

If you believe there is signal value in having consumed reddit content - or see a Soros conspiracy behind every criticism of certain idols, I have some crypto coins to sell you too. Speaking of Soviet Russia - the FSB has fascinating manuals on exactly this topic, how to break down people’s ability to trust systematically to make them vulnerable to ideological hijacking via authority figures and contrarian messages.…

> Highly recommended reading. If one were interested in finding these to read where or how might they be found?

Google is surprisingly shit today, actively pushing current events over historic ones despite search filters (weirdly reminiscent of LLM attention issues and biases to recency).

I’ll see if I can find the primary ones, they are from the archives after the Soviet collapse.

Secondary reading:

Adrian Chen, “The Agency,” New York Times Magazine, June 2, 2015, and Peter Pomerantsev and Michael Weiss, The Menace of Unreality: How the Kremlin Weaponizes Information, Culture and Money, New York:

https://tnsr.org/2022/09/whats-old-is-new-again-cold-war-les...

Institute of Modern Russia and The Interpreter, 2014.

https://css.ethz.ch/content/dam/ethz/special-interest/gess/c...

Post reply on HN