Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

211–220 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#211

Post by danShumway »

H8crilA wrote: post #47
ojosilva wrote: post #31

I'm still a big fan of passwords. Long, hard to guess passwords. More than one password/phrase as a failsafe, in case I lose it. I got my first iOS device 3 days ago as a gift, an iPad. During the excitement of the setup process, I was told to set up 2FA for my iCloud account, which I've never conscientiously used since I own no iOS devices. Now all my Apple ids, from my 2009 iMac to my macbook are tied to the darn 2…

Passwords don't work these days for sophisticated attacks. Phishing is too easy. I repeat, they don't work. No 2FA means you'll experience many successful account takeover attacks on your customers. 2FA does not mean you won't, though. Coinbase had a great talk about account takeover attacks on the recent DefCon. They receive some of the most sophisticated attacks, sometimes when attackers already have control of eve…

It's not clear to me how 2FA would help against a phishing attack. Is there something I'm missing?

My understanding is that 2FA helps protect against weak passwords and password leaks. That's it. If you give me your password via a phished site, then you'll also just as readily give me your 2FA code. Then I can log into your account and turn off 2FA, generate new login codes, or just keep the login session running indefinitely.

How does 2FA help prevent any of that?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#212

Post by danShumway »

darkhorn wrote: post #10

This is mobile operator problem, not Twitter. How on earth the mobile operator can hand a SIM card to someone else?!

Twitter is the service that accounts are being stolen from. There exists a trivial solution to the problem (stop allowing people to reset accounts via only SMS verification).

As a user, I'm at risk because Twitter is refusing to implement that trivial protection.

I don't care who's fault it is, but it is very much Twitter's problem.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#213

Post by badrequest »

driverdan wrote: post #202
lotsofpulp wrote: post #177

Earlier quoted context omitted.

It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.

While you're correct it's not fine, not everyone has a smart phone or a TOTP device. There are some cases where SMS makes sense as 2FA since it's a reasonable compromise between having no 2FA or a TOTP device.

You don't need a smartphone or 2FA device to generate TOTP codes, and in fact, can use applications like Bitwarden. SMS is obviously not adequate, or the Jack Dorsey wouldn't have been hacked.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#214

Post by dylan-m »

hprotagonist wrote: post #135

https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo... NIST has said that 2FA via SMS is bad and awful for at least 3 years now. Can we knock it off, already? This won’t stop SIM swaps, but it will blunt their impact by rather a lot.

The worst thing here is there are genuinely people who are afraid of 2FA because they see headlines about how 2FA over SMS is dangerous, and they (as well as the writers in some cases, to be fair) don't understand that the "over SMS" part is the crux of it, not the 2FA part. It doesn't even make sense. You don't even need extra infrastructure to do it properly. It costs you more money to send an SMS. Just don't!

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#215

Post by mikeash »

badrequest wrote: post #213
driverdan wrote: post #202

Earlier quoted context omitted.

While you're correct it's not fine, not everyone has a smart phone or a TOTP device. There are some cases where SMS makes sense as 2FA since it's a reasonable compromise between having no 2FA or a TOTP device.

You don't need a smartphone or 2FA device to generate TOTP codes, and in fact, can use applications like Bitwarden. SMS is obviously not adequate, or the Jack Dorsey wouldn't have been hacked.

Twitter doesn’t use 2FA over SMS. Dorsey’s hack doesn’t tell us anything about that.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#216

Post by [deleted] »

celticninja wrote: post #124
matwood wrote: post #112

Earlier quoted context omitted.

The problem is, I think a lot of these hacks have an internal connection. How much access do these 3rd party carrier stores have to transfer numbers?

It could be done remotely but only if the store had signed off that ID had been viewed and the port confirmed in person. Of course this could be gamed but an employee would need to put their name on the line to say they had met the person and viewed the ID

[deleted]

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#217

Post by danShumway »

Twitter is one of the largest social media networks on the market. It's not a bumbling startup, it's a mature tech company in the center of the tech space.

> Twitter said on Wednesday that it would stop allowing some users to post updates via text message, which made Twitter access particularly easy for SIM swappers. But that will not stop hackers who use the SIM swap to log in to a victim’s Twitter account. (Twitter said it was working to improve this.)

At the risk of jumping onto hot-takes, at what point is it reasonable to say that Twitter as a company just isn't taking security seriously? The first response from Twitter should have been, "we turned off SMS password resets immediately", not, "we're working on it." This is the kind of mistake I expect a technologically naive company to make. It's a mistake I would expect a bank to make, or a startup with 7 engineers total.

I don't understand how a company can brush aside an attack where attackers took over their CEO's account. I understand everybody does dumb things occasionally, but how big is Twitter's security team? Nobody thought this was a problem?

There must be some aspect to this I'm missing; how does doing password resets over SMS pass any security audit? This isn't new, even mainstream sources have been talking about SIM-swapping for years.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#218

Post by Kalium »

lotsofpulp wrote: post #177
mikeash wrote: post #172

Earlier quoted context omitted.

2FA over SMS is fine. It’s not a terribly strong second factor, but it’s decent, and far better than nothing. The problem is when companies implement 1FA over SMS and call it “2FA.” That is a catastrophically had idea, and unfortunately it confuses people into thinking that 2FA over SMS is somehow dangerous.

It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.

I can see more mundane reasons for SMS second factor.

In some places, SMS is simply what people are accustomed to, and the idea of using an app feels like a weird intrusion. Couple this with a PM saying "What if someone changes phones? SMS is more convenient and everyone already uses it anyway". Add a couple of years of SMS-factor, and it can quickly become considered good enough and no more work on MFA is required.

It doesn't take nefarious motives.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#219

Post by httpz »

I once walked into a T-mobile store, showed them my phone and claimed that the simcard is stuck and asked them to transfer it to a new simcard I brought with me. They asked for my phone number, scanned the barcode on the new simcard, done. I didn't have to provide any identity. I could have been anybody and the only trace would be the security camera in the store.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#220

Post by [deleted] »

Kalium wrote: post #218
lotsofpulp wrote: post #177

Earlier quoted context omitted.

It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.

I can see more mundane reasons for SMS second factor. In some places, SMS is simply what people are accustomed to, and the idea of using an app feels like a weird intrusion. Couple this with a PM saying "What if someone changes phones? SMS is more convenient and everyone already uses it anyway". Add a couple of years of SMS-factor, and it can quickly become considered good enough and no more work on MFA is required.…

[deleted]
Post reply on HN