Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker got all my texts for $16

vice.com

Post reply on HN
Print view View original

261–270 of 296 posts

Re: A hacker got all my texts for $16

#261

Post by neycoda »

heroprotagonist wrote: post #230
Mandatum wrote: post #46

In Australia it's mandated you're sent a message before rerouting or migrating to another provider. Surprised this isn't enforced in the other countries, it costs next to nothing to implement and is just an additional step in the account migration process. I'd love to see companies allow for opt in additional security measures, like banks or telco's calling me - having a verbal password to confirm things, that level…

I tried to get T-Mobile to stop giving my location to anyone that hits their APIs with a 'Yes I have permission' flag set. There's no opt-out for it, and no enforcement of the permission requirement. Their support had me snail mail a letter to some PO box. I never got a response. And now they're going to start outright selling their customer activity after forcibly un-opt-outing* everyone who opted out in their priva…

Capitalism doesn't ensure good things for people, just maximized profit for the best marketers. You want good things? The government has to require it. Otherwise it'll only happen if it's under the umbrella of maximized profit.

Re: A hacker got all my texts for $16

#262

Post by lostlogin »

InvertedRhodium wrote: post #48
lostlogin wrote: post #35

Earlier quoted context omitted.

The whole 2 factor thing really falls down if sms is a part and you aren’t getting the messages. I had a miserable time trying to get into Backblaze recently, with even the ability it offered to switch sms providers failing. The list of valid keys they give you on setup bailed me out eventually, but it took me a while to remember them.

> remember them Uh. You're supposed to memorise them? I printed them out and stuck them in a safe place.

I laughed when I saw this. It took me a while to remember I had the backup codes. I hadn’t memorised them.

Re: A hacker got all my texts for $16

#263

Post by path411 »

anaganisk wrote: post #199
fckthisguy wrote: post #168

Earlier quoted context omitted.

I completely agree. SMS 2FA is, at best, just adding a little hassle for the hacker. If it's not a targeted attack, there's a chance that the extra effort means they'll move on, but that won't stop any remotely determined hacker.

And isn't that true for most of the people? Still better than nothing right?

I agree it's def better than nothing. But I think most end users think 2FA SMS is the equivalent of hiring an armed security guard at your door, not when it's really the equivalent of putting an ADT sign in your front lawn from amazon.

Re: A hacker got all my texts for $16

#264

Post by fatnoah »

wealthyyy wrote: post #260
fatnoah wrote: post #259

Earlier quoted context omitted.

Just adding that landline numbers, not just toll-free numbers, are probably vulnerable to this.

Yes, I forget to include it.

I also place the blame on Sakari. I headed Engineering for a company that allowed you to bring your own landline number for business, and our automated flow for non-toll-free landline required receiving a code via telephone call (to avoid the situation of compromised SMS routing) and entering that as part of the signup process.

For toll-free numbers, it was a manual process where we received written LOAs and verified ownership via the SMS/800 database (ironically, SMS here has nothing to do with messaging and is purely coincidental).

Re: A hacker got all my texts for $16

#265

Post by fatnoah »

lvs wrote: post #45
lstamour wrote: post #20

It’s worth pointing out that often LOA forms ask for a PIN, usually the same PIN as would be required to check voicemail. A better telecom company might make the PIN something harder to remember but enforcing such things would also make it harder to switch carriers, particularly if it replaced today’s standard forms of ID checks. It’s better to assume that until phone numbers can be locked and unlocked the way domain…

My reading of this article suggests that the PIN requirement for number porting is bypassed in this forwarding scenario, since this method is claimed to be distinct from simjacking. That is, the number hasn't been ported by the FCC's guidelines, although I didn't glean exactly how that's happening by these retail providers.

SMS routing and number porting are different things, as the voice and SMS operate independently. I headed Engineering for a company that allowed you to SMS enable your landline or toll-free number, and our automated flow for non-toll-free landlines required receiving a code via telephone call (to avoid the situation of compromised SMS routing). We didn't support numbers that were not in those two buckets, i.e. mobile numbers (not allowed by carriers) as well as "virtual" numbers like Google voice, Twilio, etc. (possibility for abuse and/or no way to properly validate ownership). OP's issue is purely the fault of Sakari for having terrible process.

The process of changing the routing is pretty simple. It's a matter of being a trusted actor and having the ability to submit changes in routing for SMS to a central provider that maintains and propagates this info.

Re: A hacker got all my texts for $16

#266

Post by efreak »

cabaalis wrote: post #139
tialaramex wrote: post #91

Earlier quoted context omitted.

> due to peculiarities of the NANP phone number scheme I suspect more like due to peculiarities of the United States of America. Such as a disinclination to regulate anything, trusting that somehow this time the most profitable course for corporations will also work out OK for its citizens even if it didn't on previous occasions. This report lists a long chain of buck-passing companies that have exploited an obvious…

Pretty sure a hacker would be perpetrating an actual, punishable-by-trial crime in forging those legal documents. That's generally the first regulation that the US imposes. A disinclination to regulate anything is a good idea in a society that generally punishes bad behavior after the behavior has been perpetrated. I would have doubts for instance about government regulating the process for sending and receiving SMS…

> would you want every new software or protocol to have to go through some kind of bureaucratic review before it can be used?

Absolutely yes if said protocol is to be used by an entire population as a basic means of communication. Either by the government or a non-profit not tied to the industry. Protocols should also not be allowed to be secret if used at scale.

I see no reason to make a distinction between computer protocols and in-person safety protocols. The threat level is different, but it covers just as many (if not more) people.

Re: A hacker got all my texts for $16

#267

Post by meowface »

wealthyyy wrote: post #224

Damn lies. Damn lies. The attack vector only works for VOIP or Toll Free Numbers. The upstream agreements already block Mobile numbers. This is paid marketing for his company.

Not sure why this isn't higher up. This is crucial information showing this is FUD.

There are still grave vulnerabilities in mobile provider SMS (2FA or otherwise) due to how easy it is for a dedicated attacker to SIM swap, but this particular claim is completely misleading.

Re: A hacker got all my texts for $16

#268

Post by efreak »

pdpi wrote: post #215
cabaalis wrote: post #139

Earlier quoted context omitted.

Pretty sure a hacker would be perpetrating an actual, punishable-by-trial crime in forging those legal documents. That's generally the first regulation that the US imposes. A disinclination to regulate anything is a good idea in a society that generally punishes bad behavior after the behavior has been perpetrated. I would have doubts for instance about government regulating the process for sending and receiving SMS…

A key part of regulation is placing the onus of solving problems on those best equipped to solve them. You don’t need the government to mandate what the protocols should be, you just fine carriers for allowing this sort of bad outcome and let them sort things out.

This requires trusting "those best equipped" to prioritize the rules over money when the fines aren't significant enough to affect the bottom line.

Re: A hacker got all my texts for $16

#269

Post by efreak »

contingencies wrote: post #206
Mandatum wrote: post #46

In Australia it's mandated you're sent a message before rerouting or migrating to another provider. Surprised this isn't enforced in the other countries, it costs next to nothing to implement and is just an additional step in the account migration process. I'd love to see companies allow for opt in additional security measures, like banks or telco's calling me - having a verbal password to confirm things, that level…

Nice one. My neighbour chaired the Australian inter-carrier roundtable implementing mobile phone number portability. I will send him a note! Other cool hacks of his: automatic video advertising scheduling system once saved Channel 9(?) from airing a gas oven ad during a Holocaust documentary. Scored a bonus for that one.

How is that a hack?

Re: A hacker got all my texts for $16

#270

Post by CRConrad »

Weird. The whole idea behind the whole company is to send SMSes on behalf of its customers, if I understood the article correctly. So why would they need to muck about with reassigning the phone numbers of SMS recipients in the first place?
Post reply on HN