Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Woman loses over $44k after downloading third-party app to buy fish

straitstimes.com

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Woman loses over $44k after downloading third-party app to buy fish

#31

Post by amelius »

xioxox wrote: post #18

I've been seriously thinking of getting a separate phone which would just be used for financial apps. It seems apps are now required to log into a few of the institutions I use, and you can do virtually everything with their apps. Two factor seems to edging towards one factor, when a fingerprint can do everything.

Sadly, the banking apps always require new and up-to-date phones (for security reasons), yet most phones have a limited lifetime from a security pov, so you'd have to keep buying a new second phone.

Re: Woman loses over $44k after downloading third-party app to buy fish

#32

Post by rikthevik »

wiradikusuma wrote: post #15

My mom always says no to any marketing offers. Last time I thought she was stupid for missing out on deals, but now I think she's a genius for having a strong spam filter and delegating the rest to her "IT" son. The amount and sophistication of scam is very worrying.

My parents have always had the policy of, "if I didn't call you, I don't want it." I didn't understand it as a kid (being told to hang up the phone a lot), but the policy has saved us all a lot of heartache and I've adopted it for myself.

Re: Woman loses over $44k after downloading third-party app to buy fish

#33

Post by izacus »

vegetablepotpie wrote: post #16
post_break wrote: post #8

Earlier quoted context omitted.

This is a social problem. She was instructed to do xyz over whatsapp. Any device can be compromised. It’s all about informing people what not to do. Like how very slowly old people are starting to wake up to the idea that you don’t pay the IRS with google play gift cards.

Totally agree that it’s a social problem. But it’s getting worse, not better. There are hard security rules that you should always follow, for example, never click on links from an unknown sender. In the last five years I’ve noticed a trend of bureaucracies in every institution now want you to violate generally accepted security rules for their own convenience. For example, I got a text from a new number saying (sic)…

Did you try getting your government to prosecute those scammers? I'm always confused by Americans inventing 100 different software ways to try to lockout people from their devices for "security", but noone wonders why exactly this kind of egregious scammage isn't actually punished and money retured?

Re: Woman loses over $44k after downloading third-party app to buy fish

#34

Post by xyst »

I would like to see an analysis of this third party Android app the victim downloaded.

It seems like the creators of this malicious app found a way to break out of the app sandbox [1] and obtain root access. From there getting access to other apps was trivial. Why the Hong Kong bank fraud detection did not block these transactions or freeze the account for suspicious activity is another issue.

I think Google should reach out here and get more information. Perhaps give this woman a lifeline. Something like this shouldn’t be possible.

[1] https://source.android.com/docs/security/app-sandbox

Re: Woman loses over $44k after downloading third-party app to buy fish

#35

Post by izacus »

jjtheblunt wrote: post #14
yokairider wrote: post #2

I wonder how best to solve this from a software or hardware POV, rather than from a policy standpoint. It seems so easy to take full control of phones these days.

> It seems so easy to take full control of phones these days. What? The lady agreed to install and run an app, because someone asked her to do so. She literally handed over control of her phone with its bank account accesses, essentially. Also, that's an Android phone, which might or might not matter, but i imagine this social engineering (as if) scam would work in general. In the words of Laocoon, "quidquid id est,…

I think the OP implies that she should not be allowed to control her own phone to the point where she can't do that - more corporate control and more corporate baby sitting.

Re: Woman loses over $44k after downloading third-party app to buy fish

#36

Post by siva7 »

csomar wrote: post #12

I find it interesting that many people lament crypto about lack of transparency and how we went through this and that and that's why we have these sort of regulations in the legacy banking system, etc.. etc.. The reality is that, these regulations mostly exist in the US (through credit card protection), and some in the EU. For the rest of the world, if you got your account siphoned, you are mostly on your own. And ab…

It’s highly functional because your account savings are backed by laws and strict regulations. It’s not about the tech.

Re: Woman loses over $44k after downloading third-party app to buy fish

#37

Post by worksonmine »

fbdab103 wrote: post #17
csomar wrote: post #9

Earlier quoted context omitted.

I don't know. But if you have $870K in crypto and don't use a hardwallet, I kind of don't feel bad for you.

"Look, idiot, if you do not perfectly follow all of this op sec, your money could disappear at literally any moment. In which case, sucks to be you. Oh, and also those crypto exchanges where people leave their money - those also have a good chance of disappearing in the night. Best to keep it under the digital equivalent of your mattress." I will stick with a bank which is regulated to protect my money, and heads wil…

> I will stick with a bank which is regulated to protect my money, and heads will roll if funny business happens.

When did that ever happen? Did even a single head roll for the bullshit with subprime mortgages? Some people get a bonus when the scam is big enough.

Re: Woman loses over $44k after downloading third-party app to buy fish

#38

Post by keyme »

crazygringo wrote: post #24

Can someone explain how a third party app is getting access to her banking information on Android? Aren't apps sandboxed? Was this using regular Android security permissions, or was this relying on security vulnerabilities? And if vulnerabilities, is the problem that Androids often stop getting updates, so a large proportion of phones are sitting ducks?

The bit about the phone getting hot and crashing hints at a vulnerability being used.

I would consider an android app sandbox escape bug to be the lowest level of difficulty in mobile phone exploit chains.

Re: Woman loses over $44k after downloading third-party app to buy fish

#39

Post by dguest »

rikthevik wrote: post #32
wiradikusuma wrote: post #15

My mom always says no to any marketing offers. Last time I thought she was stupid for missing out on deals, but now I think she's a genius for having a strong spam filter and delegating the rest to her "IT" son. The amount and sophistication of scam is very worrying.

My parents have always had the policy of, "if I didn't call you, I don't want it." I didn't understand it as a kid (being told to hang up the phone a lot), but the policy has saved us all a lot of heartache and I've adopted it for myself.

I broaden this rule to everything:

- If you approach a random person on the street for help, etc, 99 times out of 100 they will be helpful or at least not malicious.

- If one out of the 100 people on the street approaches you, there's a decent chance they are that 1 in 100 people looking to take advantage of you.

Bad people are the exception, there are just a lot of people.

Re: Woman loses over $44k after downloading third-party app to buy fish

#40

Post by josu »

maccard wrote: post #20
csomar wrote: post #12

I find it interesting that many people lament crypto about lack of transparency and how we went through this and that and that's why we have these sort of regulations in the legacy banking system, etc.. etc.. The reality is that, these regulations mostly exist in the US (through credit card protection), and some in the EU. For the rest of the world, if you got your account siphoned, you are mostly on your own. And ab…

> I have a debit card from an EU bank. It's barely usable because every time I need to make a purchase, it has to go through 3DS and 50/50 the transaction gets rejected I have 2 debit cards and two credit cards from UK banks, and my partner has the same. I genuinely don't think I've ever had 3DS reject a transaction for either of us. > a fully dysfunctional system and yet somehow it has become solid because a "less"…

>I have 2 debit cards and two credit cards from UK banks, and my partner has the same. I genuinely don't think I've ever had 3DS reject a transaction for either of us.

I get a 50/50 rate with local businesses in Mexico when paying online with European cards. I don't even bother with foreign cards for local government portals, the success rate is close to 0% when paying online.

Also, many payments have to be authenticated with a SMS, which is sent to my European number. Thankfully some banks allow to add a US Google Voice number.

I'm talking about normal banks, fintech banks, such as Revolut, are actually pretty good. But I still can't pay the water bill with it.

Post reply on HN