Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former telecom manager admits to doing SIM swaps for $1k

bleepingcomputer.com

Post reply on HN
Print view View original

51–60 of 87 posts

Re: Former telecom manager admits to doing SIM swaps for $1k

#51

Post by peeters »

baerrie wrote: post #49
kevincox wrote: post #44

Earlier quoted context omitted.

What do you mean by "dl the totp authenticator"? But the answer is no. Without the TOTP secret no one else can generate valid codes. If you sync your secrets to some cloud service then yes, you are trusting that cloud service. And if you let your TOTP cloud service reset your account with an email then it probably isn't the most secure option. But the important thing here is that the user is in control. They can memo…

I meant “download the totp generator”. Correct me if I’m wrong but the totp generator has to linked with some account, the security of which is not managed by you, and is just as vulnerable as that account

TOTP is a completely offline protocol. Basically you scan a QR code which is a signing key that is saved to your phone. Then all your phone needs is an accurate time source, and periodically signs the current time with that key to produce a 6-digit code.

As such, no, it's not associated with anything from the source account. It is not challenge/response, and you can scan the QR code with 10 different phones and they will all produce the same codes at the same time.

Re: Former telecom manager admits to doing SIM swaps for $1k

#52

Post by chankstein38 »

cynicalsecurity wrote: post #35

The two factor authorization using a phone number isn't such a strong protection after all, is it. I wonder who thought it was a good idea in the first place. Maybe their real intent was to collect people's phone numbers instead of protecting their accounts.

Right? And now my message history is the occasional conversation littered with hundreds of "Your six digit code is _____"

Re: Former telecom manager admits to doing SIM swaps for $1k

#53

Post by kevincox »

baerrie wrote: post #49
kevincox wrote: post #44

Earlier quoted context omitted.

What do you mean by "dl the totp authenticator"? But the answer is no. Without the TOTP secret no one else can generate valid codes. If you sync your secrets to some cloud service then yes, you are trusting that cloud service. And if you let your TOTP cloud service reset your account with an email then it probably isn't the most secure option. But the important thing here is that the user is in control. They can memo…

I meant “download the totp generator”. Correct me if I’m wrong but the totp generator has to linked with some account, the security of which is not managed by you, and is just as vulnerable as that account

No, TOTP is a cryptographic protocol for generating One Time Passcodes (OTP) based on a seed. Frequently this seed is displayed to the user as a QR code, but it is just a random string. The user will then somehow save this seed (usually by scanning the QR code with their TOTP app). When a password is required you just use the seed and the current time to generate a code. No accounts are required, just the current time and the seed.

You may be confusing TOTP with proprietary app-based 2FA solutions which just send the token in a push notification or similar.

Re: Former telecom manager admits to doing SIM swaps for $1k

#54

Post by Saris »

baerrie wrote: post #38
ssklash wrote: post #8

This is a good example of why SMS 2-factor is far less secure than TOTP or other methods. You do what everyone tells you, add 2-factor to your account, and then some rando at the local T-Mobile store enables SIM swapping for peanuts, and your whole digital life goes up in smoke.

If you have access to someone’s email account can’t you dl the totp authenticator and bypass this? Effectively that makes email the authenticator which isn’t better than a phone number and device

Nope, email access won't allow you to bypass TOTP 2FA.

Re: Former telecom manager admits to doing SIM swaps for $1k

#55

Post by the-chitmonger »

arusahni wrote: post #25
the-chitmonger wrote: post #7

Man... on top of the obvious moral issue with enabling this hack, I'm astounded that someone would do this for $1k per person. Putting my freedom on the line would be so much more expensive than that. On a more technical note, is there any safeguard against SIM swaps? Something like a fingerprint scan that's tied to your SIM. I'm not familiar with phone hardware at all but I'd love to hear if someone's working on thi…

> For carrying the unauthorized number porting, Katz received $1,000 in Bitcoin per SIM swap (total of $5,000), plus an (unspecified) percentage of the profits earned from the illicit access to the victims' devices. So, a little more than $1k pp

Fair point, I guess shame(?) on him for not being smarter with the proceeds

Re: Former telecom manager admits to doing SIM swaps for $1k

#56

Post by baerrie »

kevincox wrote: post #53
baerrie wrote: post #49

Earlier quoted context omitted.

I meant “download the totp generator”. Correct me if I’m wrong but the totp generator has to linked with some account, the security of which is not managed by you, and is just as vulnerable as that account

No, TOTP is a cryptographic protocol for generating One Time Passcodes (OTP) based on a seed. Frequently this seed is displayed to the user as a QR code, but it is just a random string. The user will then somehow save this seed (usually by scanning the QR code with their TOTP app). When a password is required you just use the seed and the current time to generate a code. No accounts are required, just the current tim…

Okay, thanks, now i get it i think

Re: Former telecom manager admits to doing SIM swaps for $1k

#57

Post by Scoundreller »

Simple solution (with some obvious tradeoffs):

You can’t receive shortcode or other SMSs for X hours after porting/doing a SIM replacement. Maybe just block everything with numbers in it, or “code” or “security” for this time.

Now if your phone goes dark, you get some notice to take action before your world falls apart.

Re: Former telecom manager admits to doing SIM swaps for $1k

#58

Post by bonton89 »

ssklash wrote: post #8

This is a good example of why SMS 2-factor is far less secure than TOTP or other methods. You do what everyone tells you, add 2-factor to your account, and then some rando at the local T-Mobile store enables SIM swapping for peanuts, and your whole digital life goes up in smoke.

I prefer TOTP for privacy and control reasons, but I think you're overselling the disadvantages of SMS here. If you have to find and pay an inside guy to do SIM swaps, they'll be limited in the number they can do before getting caught so it really will only be suitable to do targeted attacks on targets you're pretty sure have something worth stealing.

There was a DND that talked about how sim swaps used to be a cakewalk over the phone social engineering exercise but were now kind of expensive to pull off and required a man in a physical location, with T-mobile remaining the easiest target. The black hat guy they were talking to said his first steps were finding a target worth swapping, usually some one that bragged a lot about bitcoin or some other crypto currency on twitter. And getting the phone number was usually really easy to do with a combination of OSINT and abusing the fact services will give you a partially masked phone number when you try to login.

Re: Former telecom manager admits to doing SIM swaps for $1k

#60

Post by playingalong »

peeters wrote: post #47
ssklash wrote: post #8

This is a good example of why SMS 2-factor is far less secure than TOTP or other methods. You do what everyone tells you, add 2-factor to your account, and then some rando at the local T-Mobile store enables SIM swapping for peanuts, and your whole digital life goes up in smoke.

My favourite is TD Bank in Canada, who started supporting an authenticator app (but it had to be theirs) because it was more secure than SMS. Except...they also don't allow you to disable SMS as an option for 2FA. So whoever is logging in gets to choose whether to use the secure authenticator app, or SMS.

This might be temporary as part of some rollout, e.g. they might disable the choice in a year, etc. Banks evolve slowly.
Post reply on HN