Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

221–230 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#221

Post by downandout »

MichaelGG wrote: post #124
adekok wrote: post #62

Earlier quoted context omitted.

> The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. Why would they care? It happens dozens of times a day, and the criminals are out of their jurisdiction. If only the police, FBI, politicians, etc. could go after the banks and telcos to improve their security. But no... they see it as their job to destroy security, in order to make you "safe".

They won't go after an attacker if there's not a high amount of damage, like $250K or more. FBI guys are swamped with people calling, and there's just not enough agent time to go around. Same for bank fraud. Ever wonder how people get away with popping someone's bank account, transferring to another local account, and walking off with the cash? For a couple grand, no one's gonna spend the time and effort to track you…

And yet then you see things like this [1], where the 4 year old case of a very minor eBay scammer is personally prosecuted by a state Attorney General. I guess it depends on who has time to kill. These two guys are looking at decades in prison for a scam that looks to have netted about $3K.

[1] http://ag.nv.gov/News/PR/2017/Attorney_General_Laxalt_Announ...

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#222

Post by kbart »

weinzierl wrote: post #203
pascalxus wrote: post #153

So, I've read the article a couple of times, It's pretty long. For those of you looking to get the most bang for your buck, I think the following advice is Golden: 1. Do NOT secure your sensitive accounts (facebook, primary email, bank accounts, twitter, etc) with your telco phone #. Telco Phone number is NOT secure! "Create a brand new Gmail email account. Do not connect it to any of your existing email accounts. (W…

> When signing up for a new Gmail, you don’t need to enter a phone number This is not true in general. It probably at least depends on the country you try to sign-up from probably other factors.

Gmail didn't mandate phone number the last time I created dummy account (~1 month ago). I don't have phone number linked even with my primary account.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#223

Post by microtonal »

gambiting wrote: post #214
csomar wrote: post #196

Earlier quoted context omitted.

> someone went into a T-Mobile store and somehow convinced the associate that my number was theirs. The fact that the T-Mobile employees can get hold of your mobile phone number is disturbing and a red flag for using your phone number for sensitive stuff (such as money). You should always assume malice from unknown actors.

I don't know where OP is from, but over here(Poland) you need two forms of ID(Passport/national ID/driving licence) if you want the T-Mobile clerk to do anything for you in-store. I got quite annoyed once because I needed a new sim-card for my company phone, but despite having two forms of ID confirming that I am the company owner, they also wanted to see the incorporation papers saying so.

I think the point of the grandparent is that the T-Mobile clerk has the power to register a new SIM card for your account. That makes them an extremely weak link (easy to blackmail, corrupt, etc.).

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#224

Post by csomar »

microtonal wrote: post #223
gambiting wrote: post #214

Earlier quoted context omitted.

I don't know where OP is from, but over here(Poland) you need two forms of ID(Passport/national ID/driving licence) if you want the T-Mobile clerk to do anything for you in-store. I got quite annoyed once because I needed a new sim-card for my company phone, but despite having two forms of ID confirming that I am the company owner, they also wanted to see the incorporation papers saying so.

I think the point of the grandparent is that the T-Mobile clerk has the power to register a new SIM card for your account. That makes them an extremely weak link (easy to blackmail, corrupt, etc.).

Yes. If the compensation (reward) from the theft is big enough, there will be always a guy who will do it.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#225

Post by sverhagen »

lrem wrote: post #212
antimatter wrote: post #192

Earlier quoted context omitted.

You are 100% correct. But I'm genuinely curious why institutions such as banks/telcos couldn't spare the resources to offer both SMS 2FA and more secure options for those who do care. I can't imagine it's a matter of technical resources as it wouldn't take much. Is it institutional inertia? technical debt?

Security model of banks is completely different from everything else. They will only consider 2FA if the total calculated cost /to them/ becomes significant if they don't.

...and if they were to offer a more advanced 2fa option, it'd possibly only appeal to a niche of users that wouldn't significant change (improve) their calculated cost?

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#226

Post by sverhagen »

foepys wrote: post #181
PerfectElement wrote: post #152

Earlier quoted context omitted.

Thanks. This thread was giving me the impression that adding 2fa with SMS to a system would make it more vulnerable somehow.

It does if the provider uses the phone number to reset the password.

...in which case it becomes an "alternative factor" instead of a "second factor".

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#227

Post by lrem »

sverhagen wrote: post #225
lrem wrote: post #212

Earlier quoted context omitted.

Security model of banks is completely different from everything else. They will only consider 2FA if the total calculated cost /to them/ becomes significant if they don't.

...and if they were to offer a more advanced 2fa option, it'd possibly only appeal to a niche of users that wouldn't significant change (improve) their calculated cost?

That's why they probably wouldn't roll out to a voluntary subset on regular accounts.

Tbf, I've had a handful accounts in a few different countries. I've had proper 2FA in most of them (the one I've started with around 2005 uses printed one use codes), SMS codes in one and no 2FA in one.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#229

Post by disiplus »

pseud0r wrote: post #218

Where I live you need a copy of your passport to port a number, in addition the new sim can only be sent to your government registered address, I think that would be quite hard to game. Even so, hackers can still use SS7 to hijack phone numbers.

SS7 is harder to obtain and alot of good operators have now protectons for hiacking via SS7.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#230

Post by occamrazor »

Thriptic wrote: post #86
occamrazor wrote: post #45

Would this attack be neutralized by a mandatory waiting period of a few weeks for number porting? I recently ported my number to another operator (in a European country), I had to wait for a month and received at least two warning SMS.

It would but the average user would be pissed if they went into a retail store and were told that they had to wait weeks to use their new phone. They might decide to abort the purchase.

I didn't think about that, because all phones here have a removable SIM card.
Post reply on HN