Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers claim they breached T-Mobile more than 100 times in 2022

krebsonsecurity.com

Post reply on HN
Print view View original

241–250 of 342 posts

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#241

Post by aaronmdjones »

TeMPOraL wrote: post #239
crazygringo wrote: post #169

Earlier quoted context omitted.

Simjacking. https://en.wikipedia.org/wiki/SIM_swap_scam

Wait. Isn't it painfully obvious when you've been simjacked? If your phone suddenly loses signal and refuses to register with the network, you know something is up. You may think it was a malfunction of your phone or your network, but it's pretty much a definition of a modern-day "drop everything you're doing and deal with it" emergency. You can't not be aware of it, or be unsure if it happened to you.

By the time you notice and can react it's too late. There have also been many prominent examples of people who got their cryptocurrency exchange accounts broken into with SIM hijacking which was conducted while the victim was asleep.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#242

Post by mrb »

ctvo wrote: post #65

I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both password…

As an InfoSec professional, what you describe sounds more like a device-level compromise of your iphone, perhaps through a malicious app, or link you clicked.

What your experienced can't be done with just a sim swap attack, as you would have lost access to your phone number. And it can't be done with the described T-Mobile hack, as it would have given the hackers silent access to your texts, so they could have reset your Gmail password, but then you would have noticed a password change (and you claim it didn't change.)

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#243

Post by NavinF »

neaumusic wrote: post #156
newsclues wrote: post #139

Earlier quoted context omitted.

SMS 2FA is a security risk! I used to work tech support for cell phone providers, and while we were trained about fraud, the nature of the industry low wages, high turnover, makes this a security flaw that financial institutions should not risk.

How is SMS a security risk? As far as I know, SMS is closely tied to a person's identity, especially 'know your customer' regulations. I'm curious how it's a security risk; as far as I know they have to be unique, which is good

Do you live in the US? You don't need an ID to get a phone number here so SMS is not necessarily tied to your identity and it has nothing to do with KYC.

Moreover, you don't want it to be tied to your identity. The fact that anyone can pretend to be you and hijack your phone number is exactly what makes it insecure.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#244

Post by askiiart »

danso wrote: post #145
ctvo wrote: post #116

Earlier quoted context omitted.

2FA with authenticator. As someone correctly points out, Google appears to keep SMS as a recovery option unless you specifically opt out? Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.

Just noticed that Authy’s answer to the FAQ of “ Is the Authy App Susceptible to a SIM Swap?” does not have the word “No” in it. Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings https://support.authy.com/hc/en-us/articles/360012427914-Is-...

SMS is just used to sign in. Everything is encrypted, and you can't access any data without a password. If you don't have the password, you don't get the data. There is no recovery.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#245

Post by konha »

danso wrote: post #145
ctvo wrote: post #116

Earlier quoted context omitted.

2FA with authenticator. As someone correctly points out, Google appears to keep SMS as a recovery option unless you specifically opt out? Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.

Just noticed that Authy’s answer to the FAQ of “ Is the Authy App Susceptible to a SIM Swap?” does not have the word “No” in it. Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings https://support.authy.com/hc/en-us/articles/360012427914-Is-...

Your OTP secrets should be e2e encrypted if you set up a backup passphrase. Worst case: someone can download your encrypted seeds.

I’ll agree though that Authy’s docs are really ambiguous about account recovery.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#246

Post by JohnFen »

gjsman-1000 wrote: post #32
photon12 wrote: post #8

> T-Mobile declined to answer questions about what it may be doing to beef up employee authentication. But Nicholas Weaver, a researcher and lecturer at University of California, Berkeley’s International Computer Science Institute, said T-Mobile and all the major wireless providers should be requiring employees to use physical security keys for that second factor when logging into company resources. > “These breaches…

You assume that regulation can just make security magically happen. I see no reason to assume that premise to be correct in practice. It's not like the US Government hasn't been breached countless times or had Supreme Court opinions leaked; and it's not like corporations that really tried and should be examples of best practice haven't also been breached. Also, what law can prevent insider attacks? There's already pl…

Regulations matter in order to make entities do the right thing when they have no other incentive to do so. They certainly aren't a panacea, but they also certainly can have positive effects.

> I would be fundamentally opposed to such a law because it turns security into a simple matter of compliance.

True, but that's better than effectively having no security at all.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#247

Post by photon12 »

clintonb wrote: post #222
photon12 wrote: post #93

Earlier quoted context omitted.

I agree completely. I didn't ask why government enforced regulation hasn't happened. I asked why industry self-regulation has failed. I've worked in a regulatory/security role for a major conglomerate before. I'm not saying I expected self-regulation to work. But, if you are in a position of customers seeing direct harm every day , it's not unreasonable to ask why there is a failure here.

What does it mean for the industry to self-regulate? How do you define industry? Is it telecoms, or all tech companies? Self-regulation has failed because the cost of a data breach remains relatively low compared to implementing security measures, at least on the surface.

Regulation generally is targeted at preventing consumer harm. Self-regulation is the practice of appropriately mitigating consumer harm. I mean mobile subscription providers here by "industry."

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#248

Post by jareklupinski »

lkbm wrote: post #62
jareklupinski wrote: post #34

Earlier quoted context omitted.

yup https://www.bleepingcomputer.com/news/security/google-fi-dat... my friend had google fi and was caught in this, among other things they had their instagram taken over. scary few days. thankfully their roommate works at meta... I think the only way to be really safe is to use one of the smaller MVNOs and never ever ever reveal who your carrier is

I've always figured I should have two numbers—one I let people know, and one for 2fa. But that's ~$20/mo and a moderate annoyance, so for now mostly just fingers crossed that eventually everywhere that matters will allow me to switch fully to authentication apps and hardware keys.

if you have an apple watch, depending on your plan, it may have a different phone number

wonder if that works...

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#249

Post by xorcist »

thrashh wrote: post #160
xorcist wrote: post #122

Earlier quoted context omitted.

> Two-factor auth wasn't even a commonly accepted best practice two decades ago. Maybe, had you said three decades? But not two. It was already mature by then. Two decades ago was 2003. Even consumer banking was online, and in many countries exclusively 2FA. I've worked the banking space then and we absolutely had smart cards. Military and defense had them everywhere. Proprietary solutions had already gone away repla…

Sure. My dad had a 2FA dongle in the 90s too But outside of government, defense and banking, who exactly was using it? It was not on the radar of the vast majority of people. Most technology takes decades to filter through the world

Well, the vast majority of people live in impoverished areas of the world, so in a strict sense that's true.

But it was absolutely a standard form of authentication already, and regarded as best practice security for those who cared about such things.

Which perhaps weren't that many, but then again, still isn't.

Re: Hackers claim they breached T-Mobile more than 100 times in 2022

#250

Post by stanleydrew »

6ak74rfy wrote: post #224
livueta wrote: post #219

Earlier quoted context omitted.

Do you happen to know if they allow you to also totally disable SMS 2FA? I know that Vanguard, for instance, supports non-SMS 2FA but doesn't let you disable SMS as a fallback (and I'd rather not just totally remove all phone numbers, but maybe I have to...).

Yeah, in Fidelity SMS 2FA is disabled for me. Fall back is to call them to get into my account. Don’t know about Schwab.

I had their non-SMS Symantec 2FA set up a couple years back, but turned it off cause I couldn't figure out how to disable the SMS fallback. Every time I got a new device and wanted to set up the Symantec TOTP generator they would just send me a SMS for validation. So I just told them to turn off the Symantec part.

Maybe they've changed their policy since then. But when you call to get set up on a new device, how do they verify your identity now if you don't have SMS fallback?

Post reply on HN