Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Woman loses over $44k after downloading third-party app to buy fish

straitstimes.com

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Woman loses over $44k after downloading third-party app to buy fish

#21

Post by fbdab103 »

belltaco wrote: post #13
csomar wrote: post #9

Earlier quoted context omitted.

I don't know. But if you have $870K in crypto and don't use a hardwallet, I kind of don't feel bad for you.

To be fair, at Cuban scale that's your hot wallet.

Crypto aside, I have idly wondered how/where the mega rich keep their money.

Is there a money manager effectively controlling a Schwab account with $1+ billion dollars? How do you minimize the blast radius to prevent internal/external loss of control? Even sub-dividing a fortune across N investment managers still leaves enormous targets painted on those accounts.

Or is it the more implicit threat that you do not steal from these people or the full weight of the government will aid in recovering these funds?

Re: Woman loses over $44k after downloading third-party app to buy fish

#22

Post by maccard »

berkle4455 wrote: post #7
blamazon wrote: post #5

Mark Cuban recently lost $870k in crypto by a fake app scheme: > “I’m pretty sure I downloaded a version of MetaMask with some shit in it,” Cuban told DL News. He said he had searched for Circle on Google, not MetaMask. [1] [1]: https://www.dlnews.com/articles/people-culture/mark-cuban-lo...

It's mind boggling how crypto people still trust hot wallets that run as fucking browser extensions.

The reality is that relying on a cold storage wallet for security is just too much overhead when it's competing against a biometric scanner to authorisar a transaction that can be reversed with a phone call.

Re: Woman loses over $44k after downloading third-party app to buy fish

#23

Post by akyuu »

renewiltord wrote: post #6
kingforaday wrote: post #3

Earlier quoted context omitted.

On the front page of HN right now as you posted this: https://news.ycombinator.com/item?id=37623479

There’s a little bit of alert fatigue on this stuff. Online internet privacy/security folks kick up a fuss about a lot of things that I don’t think cause me any harm, and it’s reducing my ability to detect legitimate threats. I can’t constantly evaluate whether something is Google “spying on my web browsing” or “this guy can steal your money”. Fortunately, the solution of just sticking to mainstream platforms works.…

> Fortunately, the solution of just sticking to mainstream platforms works.

Well, it depends. For widespread non-targeted attacks, like the one mentioned in the parent comment, I think using a niche platform is a form of security through obscurity that can actually work, because it's possible the generic exploit you encounter is not designed to work on your non-standard system (like a virtual machine, a hardened configuration, a non-mainstream OS like OpenBSD...). Although this is more difficult on phones, because it's not possible to use some mainstream services on niche platforms due to attestation requirements.

Re: Woman loses over $44k after downloading third-party app to buy fish

#24

Post by crazygringo »

Can someone explain how a third party app is getting access to her banking information on Android?

Aren't apps sandboxed?

Was this using regular Android security permissions, or was this relying on security vulnerabilities? And if vulnerabilities, is the problem that Androids often stop getting updates, so a large proportion of phones are sitting ducks?

Re: Woman loses over $44k after downloading third-party app to buy fish

#25

Post by anonymousiam »

From one perspective, this crime makes the case for walled-garden app stores. From another perspective, it should shame the phone/OS producers for such awful security practices. If the phone/OS producers cannot protect users from these crimes, why should the users trust them and their "secure" app stores?

Re: Woman loses over $44k after downloading third-party app to buy fish

#26

Post by orbital-decay »

xioxox wrote: post #18

I've been seriously thinking of getting a separate phone which would just be used for financial apps. It seems apps are now required to log into a few of the institutions I use, and you can do virtually everything with their apps. Two factor seems to edging towards one factor, when a fingerprint can do everything.

That's how I deal with gaming and intrusive anticheat systems for a while now - we have a dedicated computer for gaming in our house, with the browser and most apps restricted. This is the only way to somewhat tolerate a ring0 spying system that also insists I have no hypervisors anywhere in sight.

Re: Woman loses over $44k after downloading third-party app to buy fish

#27

Post by uoaei »

fbdab103 wrote: post #17
csomar wrote: post #9

Earlier quoted context omitted.

I don't know. But if you have $870K in crypto and don't use a hardwallet, I kind of don't feel bad for you.

"Look, idiot, if you do not perfectly follow all of this op sec, your money could disappear at literally any moment. In which case, sucks to be you. Oh, and also those crypto exchanges where people leave their money - those also have a good chance of disappearing in the night. Best to keep it under the digital equivalent of your mattress." I will stick with a bank which is regulated to protect my money, and heads wil…

> heads will roll if funny business happens

To be fair, a lot of the crypto hype is predicated, if indirectly, on how few heads roll when (barely quasi-legal) funny business happens through official institutions.

Re: Woman loses over $44k after downloading third-party app to buy fish

#28

Post by dgacmu »

fbdab103 wrote: post #21
belltaco wrote: post #13

Earlier quoted context omitted.

To be fair, at Cuban scale that's your hot wallet.

Crypto aside, I have idly wondered how/where the mega rich keep their money. Is there a money manager effectively controlling a Schwab account with $1+ billion dollars? How do you minimize the blast radius to prevent internal/external loss of control? Even sub-dividing a fortune across N investment managers still leaves enormous targets painted on those accounts. Or is it the more implicit threat that you do not stea…

At that level you typically set up what's referred to as a "family office"

https://en.m.wikipedia.org/wiki/Family_office

The family office will manage the investment portfolio, typically across not only brokerages and banks but also direct investments / private equity/ vc / etc.

Re: Woman loses over $44k after downloading third-party app to buy fish

#29

Post by Izkata »

crazygringo wrote: post #24

Can someone explain how a third party app is getting access to her banking information on Android? Aren't apps sandboxed? Was this using regular Android security permissions, or was this relying on security vulnerabilities? And if vulnerabilities, is the problem that Androids often stop getting updates, so a large proportion of phones are sitting ducks?

Based on these lines:

> The seller texted Ms Khoo on WhatsApp and instructed her to download a third-party app called Grab&Go on her phone. The app prompted her to make a $5 payment through PayNow as a “deposit” before her order could be placed, but she asked if she could pay when her order arrived.

> The seller reassured her that he did not need her banking details and asked her to enter her name, address and phone number on the app to check out her purchase.

My guess would be the payment information combined with the personal information (and using that personal information to get more personal information online) was just enough to call the bank and impersonate her.

The app eating CPU and battery is definitely a red herring, even with a vulnerability that let it directly get at banking details there's no reason for it to do that. Probably just badly written.

Re: Woman loses over $44k after downloading third-party app to buy fish

#30

Post by majormajor »

csomar wrote: post #12

I find it interesting that many people lament crypto about lack of transparency and how we went through this and that and that's why we have these sort of regulations in the legacy banking system, etc.. etc.. The reality is that, these regulations mostly exist in the US (through credit card protection), and some in the EU. For the rest of the world, if you got your account siphoned, you are mostly on your own. And ab…

I think a society has to have a certain level of overall, widely-distributed, wealth for people to be willing to pay for the general protections from those sorts of regulations. The money to reimburse consumers doesn't come out of the air, it's a sort of ambient tax on people/the system in general that people are willing to pay since it's not that relatively large compared to the mean income/spending of people using the credit card system.
Post reply on HN