Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former telecom manager admits to doing SIM swaps for $1k

bleepingcomputer.com

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Former telecom manager admits to doing SIM swaps for $1k

#71

Post by Johnny555 »

catlikesshrimp wrote: post #64
Johnny555 wrote: post #18

Earlier quoted context omitted.

Does that help against an attacker determined enough to hack you that he'll pay $1000 for a SIM swap? Surely he has channels to figure out your "secret" phone number since you registered it with the service he's trying to hack into.

It is more difficult to sim swap a foreign number from another company. Not impossible, of course. There is also that some services don't accept foreign numbers for authentication. Nor virtual phone numbers. But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier.

But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier.

Is that really an additional layer of protection, or the same layer, slightly obscured? But probably not obscured from the attacker that managed to get your password and just needs the SMS verification code to get into your account.

Re: Former telecom manager admits to doing SIM swaps for $1k

#72

Post by FireBeyond »

ssklash wrote: post #8

This is a good example of why SMS 2-factor is far less secure than TOTP or other methods. You do what everyone tells you, add 2-factor to your account, and then some rando at the local T-Mobile store enables SIM swapping for peanuts, and your whole digital life goes up in smoke.

... AND because you have 2FA, everybody assumes "you MUST have shared credentials because using 2FA is secure...", including bank fraud departments.

Re: Former telecom manager admits to doing SIM swaps for $1k

#74

Post by slt2021 »

neon5077 wrote: post #68
slt2021 wrote: post #50

Earlier quoted context omitted.

last 4 digits of SSN are regularly found in data leaks. what is worst is you CANNOT change it if your data is leaked from 3rd party site. conclusion: NEVER use phone number as 2FA, Always assume your cell number will be swapped, always use other more secure factor, especially if it has anything to do with money $$$

Unfortunately the vast majority of services only support SMS or email 2FA. I've set up a real 2FA app for every site I use that supports it, and that number is four: gitlab, github, discord, and my domain name provider. My bank, my utilities, my insurance, everything only supports SMS if they support 2FA at all. Most just don't.

email is not bad option, at least you can harden your email to use normal 2FA instead of pathetic SMS

Re: Former telecom manager admits to doing SIM swaps for $1k

#75

Post by nickburns »

akamaka wrote: post #73

Has anyone created an ultra-secure VOIP service which would give people a secret phone number only to be used for 2FA?

wrong question imho. TOTP is current MFA industry-standard (again imo)—and their creation, storage, and management is trivial. pick your reputable tool.

the receipt of TOTP via SMS, regardless of telephony platform, however, is generally frowned upon by security heads.

Re: Former telecom manager admits to doing SIM swaps for $1k

#76

Post by neilv »

baerrie wrote: post #56
kevincox wrote: post #53

Earlier quoted context omitted.

No, TOTP is a cryptographic protocol for generating One Time Passcodes (OTP) based on a seed. Frequently this seed is displayed to the user as a QR code, but it is just a random string. The user will then somehow save this seed (usually by scanning the QR code with their TOTP app). When a password is required you just use the seed and the current time to generate a code. No accounts are required, just the current tim…

Okay, thanks, now i get it i think

The TOTP authenticator apps are usually initialized only once per account -- when the user first enables that 2FA for the account.

The system is designed to assume that the user doing the initializing that one time is the legitimate user.

(There's a bootstrapping problem for the authenticators, that the account provider needs to "trust once" that the user is legitimate. The best time to do that is as early as possible. Preferably when the account is set up, and before much value/dependence has been invested in the account.)

After that first initialization of an authenticator for an account, anyone trying to initialize another authenticator would have the burden of trying to prove to the account provider that they aren't just an illegitimate person trying to bypass the 2FA.

So, you probably can't just use email to do a "lost my authenticator lol", unless the account provider doesn't really care about 2FA, and has implemented it in a very weak way.

Re: Former telecom manager admits to doing SIM swaps for $1k

#78

Post by MichaelZuo »

ryandrake wrote: post #42
cjrp wrote: post #23

Earlier quoted context omitted.

> On a more technical note, is there any safeguard against SIM swaps? The only solution is to refuse to use SMS for 2FA. If a service requires it, use a different service.

This works if you know about SIM swapping on day one of your life on the Internet, and refuse from day one. I probably have hundreds of Internet accounts, and no straightforward way to know which ones use SMS for 2-factor without trying to log in to them all. Further, many don’t use SMS for login but they do use it for password resets. So my only hope, if I want to clean house, is to sit down and try resetting my pas…

That still sounds like much less pain and effort then if the worst case scenario happens?

Re: Former telecom manager admits to doing SIM swaps for $1k

#79

Post by elliottback »

slt2021 wrote: post #50
josh2600 wrote: post #33

I worked in telecom for many years. Retail employees would perform sim swaps at locations I worked at for about $250-300. This was circa 2006 so I’m not surprised that people do it for $1000 with inflation. The reality is that cell phone employees are paid just above minimum wage, so asking them to protect a system that has the capacity for multiple millions of fraud by simply changing a sim is hard. The good news is…

last 4 digits of SSN are regularly found in data leaks. what is worst is you CANNOT change it if your data is leaked from 3rd party site. conclusion: NEVER use phone number as 2FA, Always assume your cell number will be swapped, always use other more secure factor, especially if it has anything to do with money $$$

Completely agree using last-4 SSN is terrible, but some light in the tunnel exists. It is possible to change it, although it is as you would expect, quite annoying: https://faq.ssa.gov/en-us/Topic/article/KA-02220

Re: Former telecom manager admits to doing SIM swaps for $1k

#80

Post by MyFedora »

cynicalsecurity wrote: post #35

The two factor authorization using a phone number isn't such a strong protection after all, is it. I wonder who thought it was a good idea in the first place. Maybe their real intent was to collect people's phone numbers instead of protecting their accounts.

Never has been.
Post reply on HN