SIM Vulnerability leads to information disclosure via malicious SMS
1–10 of 60 posts
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#2I don’t understand why to steal someone else’s phones? the main thing for what?
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#3I don’t understand why to steal someone else’s phones? the main thing for what?
Sim-swap attacks, forging communications from some one (snag CEO phone; send message "wire ten million dollars now to china; we're acquiring a company!").
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#4First the Intel management engine backdoor. And now this, probably first conceived when someone cards were being developed
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#5I don’t understand why to steal someone else’s phones? the main thing for what?
This is not about stealing someones subscriber identity but about having unrestricted access to some ancient looking software running on the sim card. TBH it looks like this is not really an exploit but working by design if access is actually unrestricted. SMS is used as an alternative transport for the software (S@T Browser) and apparently access should be limited to entities providing a 3DES key ... But i just skimmed over some documents so don't take my word for it ;)
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#6I don’t understand why to steal someone else’s phones? the main thing for what?
Leaked emails/passwords from exploited sites + the ability to do 2fa or trigger a password reset via phone verification. People's bank accounts, bitcoin exchange wallets, etc have been hacked like this.
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#7I don’t understand why to steal someone else’s phones? the main thing for what?
Because then in most cases you bypass 2 factor authentication through sms for people's accounts. And then steal their social media handles or anything. Sites like Twitter only allow SMS 2 factor authentication, so currently no way to avoid the issue, which is why even the CEO was just hacked. One has to assume they are working on real 2 factor authentication. That will help people in the know stay protected, but the average person or simply enables sms 2 factor authentication will still be vulnerable until a company like Apple or something automatically offers 2 factor app for all sites that support 2fa.
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#8The youtube-conspiracy-style intro video and lack of details does not instill a feeling of credibility.
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#9I don’t understand why to steal someone else’s phones? the main thing for what?
Because then in most cases you bypass 2 factor authentication through sms for people's accounts. And then steal their social media handles or anything. Sites like Twitter only allow SMS 2 factor authentication, so currently no way to avoid the issue, which is why even the CEO was just hacked. One has to assume they are working on real 2 factor authentication. That will help people in the know stay protected, but the…
I've been mitigating this vector best I can by associating any of my accounts that only offer 2FA via SMS to a Google Voice number / Google account that can only be accessed via Token/Backup codes.
Re: SIM Vulnerability leads to information disclosure via malicious SMS
#10[deleted]