Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former telecom manager admits to doing SIM swaps for $1k

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Former telecom manager admits to doing SIM swaps for $1k

#41

Post by runjake »

Tarball10 wrote: post #19
runjake wrote: post #15

Earlier quoted context omitted.

Telecom in New Jersey is code for Verizon Wireless[1]. If I were the Verizon Wireless CEO, I'd own it and pledge to resolve as best I can. And maybe they have, I haven't looked yet. Edit: I had it backwards. Not AT&T, but rather Verizon. Changed. "Telecom in Georgia" would allude to AT&T. "Telecom in Kansas (or maybe Bellevue, WA now)" to T-Mobile, etc. 1. https://en.wikipedia.org/wiki/Verizon_(mobile_network)

AT&T is headquartered in Dallas, TX. Verizon Wireless headquarters is in New Jersey.

AT&T Mobility (AT&T's wireless subsidiary) is headquartered in Georgia, unless they moved to the conglomerate's Dallas HQ in the past few months.

Re: Former telecom manager admits to doing SIM swaps for $1k

#42

Post by ryandrake »

cjrp wrote: post #23
the-chitmonger wrote: post #7

Man... on top of the obvious moral issue with enabling this hack, I'm astounded that someone would do this for $1k per person. Putting my freedom on the line would be so much more expensive than that. On a more technical note, is there any safeguard against SIM swaps? Something like a fingerprint scan that's tied to your SIM. I'm not familiar with phone hardware at all but I'd love to hear if someone's working on thi…

> On a more technical note, is there any safeguard against SIM swaps? The only solution is to refuse to use SMS for 2FA. If a service requires it, use a different service.

This works if you know about SIM swapping on day one of your life on the Internet, and refuse from day one. I probably have hundreds of Internet accounts, and no straightforward way to know which ones use SMS for 2-factor without trying to log in to them all. Further, many don’t use SMS for login but they do use it for password resets. So my only hope, if I want to clean house, is to sit down and try resetting my password on 400+ accounts one by one.

Re: Former telecom manager admits to doing SIM swaps for $1k

#43

Post by justinclift »

the-chitmonger wrote: post #7

Man... on top of the obvious moral issue with enabling this hack, I'm astounded that someone would do this for $1k per person. Putting my freedom on the line would be so much more expensive than that. On a more technical note, is there any safeguard against SIM swaps? Something like a fingerprint scan that's tied to your SIM. I'm not familiar with phone hardware at all but I'd love to hear if someone's working on thi…

> ... I'm astounded that someone would do this for $1k per person.

It's entirely possible some of the brighter ones have gotten their co-workers username/password combinations, and are using those when doing dodgy stuff.

Re: Former telecom manager admits to doing SIM swaps for $1k

#44

Post by kevincox »

baerrie wrote: post #38
ssklash wrote: post #8

This is a good example of why SMS 2-factor is far less secure than TOTP or other methods. You do what everyone tells you, add 2-factor to your account, and then some rando at the local T-Mobile store enables SIM swapping for peanuts, and your whole digital life goes up in smoke.

If you have access to someone’s email account can’t you dl the totp authenticator and bypass this? Effectively that makes email the authenticator which isn’t better than a phone number and device

What do you mean by "dl the totp authenticator"? But the answer is no. Without the TOTP secret no one else can generate valid codes.

If you sync your secrets to some cloud service then yes, you are trusting that cloud service. And if you let your TOTP cloud service reset your account with an email then it probably isn't the most secure option.

But the important thing here is that the user is in control. They can memorize their secret if they want to an no one can take it from them. Or they can publish it online if they don't like security. With SMS 2FA you need to trust your telecom provider, I very much don't.

Re: Former telecom manager admits to doing SIM swaps for $1k

#45

Post by techsupporter »

Another reason in an increasingly long list of reasons that being a T-Mobile postpaid customer is frustrating: Customers haven't been able to manage our own physical or electronic SIMs for almost two years. T-Mobile shut down the online self-service process with the claim of making it "more secure".

Meanwhile, SIM swaps continue by malicious actors with seemingly nothing that can be done to stop them. So I can't swap my own SIM without waiting on hold for an hour or two, either by chat or on the phone, but the scammers can do it with apparent impunity. (I have tried messaging T-Mobile's help group on Twitter but they seem to be the only competent support available and thus are also incredibly backlogged.)

I get that providers have to cater to the lowest common denominator but I wish there was a MVNO or similar who would allow use of authenticator keys and maximum level self service, with the understanding that if I break or lose my authentication methods, I am out of luck. Right now, my current carrier seems the worst of both choices.

Re: Former telecom manager admits to doing SIM swaps for $1k

#46

Post by kevincox »

cynicalsecurity wrote: post #35

The two factor authorization using a phone number isn't such a strong protection after all, is it. I wonder who thought it was a good idea in the first place. Maybe their real intent was to collect people's phone numbers instead of protecting their accounts.

Many people reuse passwords. Forcing SMS 2FA is something that they can feasibly do, because almost everyone can receive SMS and greatly raises the difficulty of credential stuffing (from just stuffing to needing to do a SIM swap). This solves a lot of problems for service providers.

Another benefit is that they can block duplicate accounts with the same phone number, this effectively adds a cost to account creation which can help to reduce spam.

And yes, some will then use it to spam or sell.

I don't think anyone ever thought that SMS 2FA was strong protection. It mostly benefits the service operators by reducing spam and stolen accounts.

Re: Former telecom manager admits to doing SIM swaps for $1k

#47

Post by peeters »

ssklash wrote: post #8

This is a good example of why SMS 2-factor is far less secure than TOTP or other methods. You do what everyone tells you, add 2-factor to your account, and then some rando at the local T-Mobile store enables SIM swapping for peanuts, and your whole digital life goes up in smoke.

My favourite is TD Bank in Canada, who started supporting an authenticator app (but it had to be theirs) because it was more secure than SMS. Except...they also don't allow you to disable SMS as an option for 2FA. So whoever is logging in gets to choose whether to use the secure authenticator app, or SMS.

Re: Former telecom manager admits to doing SIM swaps for $1k

#48

Post by emgeee »

cynicalsecurity wrote: post #35

The two factor authorization using a phone number isn't such a strong protection after all, is it. I wonder who thought it was a good idea in the first place. Maybe their real intent was to collect people's phone numbers instead of protecting their accounts.

It was a useful tool to better verify identity vs relying solely on email addresses, which were substantially easier to create at the time.

Kinda like SSNs though, I think it's way past the point when a better designed system should have been developed. Sadly, that costs a lot of money.

Re: Former telecom manager admits to doing SIM swaps for $1k

#49

Post by baerrie »

kevincox wrote: post #44
baerrie wrote: post #38

Earlier quoted context omitted.

If you have access to someone’s email account can’t you dl the totp authenticator and bypass this? Effectively that makes email the authenticator which isn’t better than a phone number and device

What do you mean by "dl the totp authenticator"? But the answer is no. Without the TOTP secret no one else can generate valid codes. If you sync your secrets to some cloud service then yes, you are trusting that cloud service. And if you let your TOTP cloud service reset your account with an email then it probably isn't the most secure option. But the important thing here is that the user is in control. They can memo…

I meant “download the totp generator”. Correct me if I’m wrong but the totp generator has to linked with some account, the security of which is not managed by you, and is just as vulnerable as that account

Re: Former telecom manager admits to doing SIM swaps for $1k

#50

Post by slt2021 »

josh2600 wrote: post #33

I worked in telecom for many years. Retail employees would perform sim swaps at locations I worked at for about $250-300. This was circa 2006 so I’m not surprised that people do it for $1000 with inflation. The reality is that cell phone employees are paid just above minimum wage, so asking them to protect a system that has the capacity for multiple millions of fraud by simply changing a sim is hard. The good news is…

last 4 digits of SSN are regularly found in data leaks.

what is worst is you CANNOT change it if your data is leaked from 3rd party site.

conclusion: NEVER use phone number as 2FA, Always assume your cell number will be swapped, always use other more secure factor, especially if it has anything to do with money $$$

Post reply on HN