Slashdot Mirror
Man Sues T-Mobile For Allegedly Failing To Stop Hackers From Stealing His Cryptocurrency (theverge.com)
Over the weekend, a lawsuit was filed against T-Mobile claiming that the company's lack of security allowed hackers to enter his wireless account last fall and steal cryptocoins worth thousands of dollars. "Carlos Tapang of Washington state accuses T-Mobile of having 'improperly allowed wrongdoers to access' his wireless account on November 7th last year," reports The Verge. "The hackers then cancelled his number and transferred it to an AT&T account under their control. 'T-Mobile was unable to contain this security breach until the next day,' when it finally got the number back from AT&T, Tapang alleges in the suit, first spotted by Law360." From the report: After gaining control of his phone number, the hackers were able to change the password on one of Tapang's cryptocurrency accounts and steal 1,000 OmiseGo (OMG) tokens and 19.6 BitConnect coins, Tapang claims. The hackers then exchanged the coins for 2.875 Bitcoin and transferred it out of his account, the suit states. On November 7th, the price of Bitcoin was $7,118.80, so had the hackers cashed out then, they would have netted a profit of $20,466.55. Tapang goes on to say, "After the incident, BTC price reached more than $17,000.00 per coin," but given the volatility of bitcoin prices, the hackers may not have benefited from the soar.
The suit alleges T-Mobile is at fault partly because the carrier said it would add a PIN code to Tapang's account prior to the incident, but didn't actually implement it. Tapang also states that hackers are able to call T-Mobile's customer support multiple times to gain access to customer accounts, until they're able to get an agent on the line that would grant them access without requiring further identity verification. The complaint also lists several anonymous internet users who have posted about similar security breaches to their own T-Mobile accounts.
The suit alleges T-Mobile is at fault partly because the carrier said it would add a PIN code to Tapang's account prior to the incident, but didn't actually implement it. Tapang also states that hackers are able to call T-Mobile's customer support multiple times to gain access to customer accounts, until they're able to get an agent on the line that would grant them access without requiring further identity verification. The complaint also lists several anonymous internet users who have posted about similar security breaches to their own T-Mobile accounts.
Then why is there an AT&T icon at the top of the article?
In Soviet Russia, phone company gives coins to YOU.
Because they don't want you to go into the store. Not just t-mo but banks as well.
Wait, that's not a thing. Thank god for the FDIC then...oh right. Hmmm.
Well at least you can rest easy knowing the big ebil banks don't have any control over you!
Using access to a phone number as an authentication method is the REAL problem here. Choose cryptocurrency/banking websites that don't allow access to your account simply by having access to your registered phone number. Using an encrypted channel rather than SMS helps, but there are still problems with e.g. IMEI spoofing and, as demonstrated, social engineering. This seems like a targeted attack, as the attacker knew his phone number and which websites he had cryptocurrency on, so 'security questions' likely wouldn't have helped, either.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
WTF does the price of Bitcoin have to do with it? If someone stole $20 from me 5 years ago and bought a Bitcoin with it, it's unreasonable for me to claim $9K in damages today.
Maybe the thieves then bought some coke off Silkroad and snorted it. Net Present Value, $0.
"National Security is the chief cause of national insecurity." - Celine's First Law
It sounds like AT&T or T-Mobile (not sure which carrier), was absolutely, partially at fault, for not assuring a reasonable level of security to their infrastructure. If the account in question did not require at least 2FA+ to access, which could of been enabled and disabled by the customer, and it's contents were not fully encrypted, to the point that it required an additional layer or security to unlock, such as a TOTP, then they are at fault for not providing a reasonable, and responsible security level for the account access.
However, it also appears that the coin exchange is also at fault, for not providing the same level of infrastructure security.
This entire problem seems to be a classic and disturbing case, of companies not providing reasonable security. I think this lawsuit has the potential to set a good bar for reasonable security and if it's done right and successfully, could finally usher in what is sadly missing from almost every service the average person accesses.
Buy T Mobile, our phones suck and our prices are high
T-Mobile has the same Samsung Galaxy S8 and iPhone X as AT&T, Sprint, and Verizon and, with Sprint as the possible exception, has better pricing than the rest. The fuck you talkin' about?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Anyone can sue anyone for anything.
The trick is actually winning the lawsuit.
"Good luck with that, dude." /s
But when I read they had promised they had put a security code in place but they had not done so, they lost it.
This guy took the appropriate steps, the phone company should pay up.
If you say you have security on your account but do not actually put it in, then you owe the customer money
excitingthingstodo.blogspot.com
Show me where T-Mobile agreed to safeguard securities for customers worth tens of thousands of dollars as part of their wireless subscription.
I'm sure that no matter how much it was your fault for letting this happen, you'll somehow not be held responsible. Like if you hire a security guard to guard your property. The most they can lose is their job, right? So, I guess all T-Mobile is out is a customer.
Now, if the BBB wants to slam them or the DA wants to hold someone responsible for fraud... LOL. Of course, I'm kidding. We can't risk anyone losing their jobs.
PS - Don't forget to pay them the time period they were failing to guard your property properly.
That's not what is happening here. People will set up account recovery with their phone used as a relay for a recovery pin. Most likely he has some kind of online wallet linked to it.
love is just extroverted narcissism
I had my account broken into on T-Mobile. It's far too easy for people to break in since all you need is the phone number and some personal information.
They need to let you choose your own login account names and some security questions.
Just way too lax helping you keep your account secure.
You stored thousands in coins on your phone. YOUR PHONE! Stupid is as stupid does.
No, he didn't store it on his phone. HIS PHONE!
It was however his two factor number used for the SMS to verify it was him logging in.
Let that be a lesson to anyone that thinks using your phone number for two factor is a good idea.
Before throwing around accusations of stupidity I suggest actually reading the article.
Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
That's not what is happening here. People will set up account recovery with their phone used as a relay for a recovery pin. Most likely he has some kind of online wallet linked to it.
and that is somehow better? if anything that is even worse. at least a phone you can have encryption, password/pin protection etc.
They let an unauthorized person access their system. Ways that could have been avoided: using security questions before allowing a reset, having an extra factor of authentication like a RSA SecureID key or similar device, only allowing password resets from known IPs/domains, two factor SMS with a security question and response on the website with the answer (a merging of two factor and security questions), the list goes on...
It was however his two factor number used for the SMS to verify it was him logging in.
If this was only his second factor then the hackers couldn't have gotten in.
But this guy lost control of both factors.
It sucks to be him, but he has to man up and realize he got screwed by thieves and drop this idiotic suit against T-Mobile.
Call your wirlesss carrier. Have them put a security notice on your account that nobody is allowing to change the SIM or port the number without showing up a retail store, in person, with a photo ID.
Everyone should do this.
Now there's a match made in heaven! The least secure form of "currency" or "investment" managed via the least secure form of electronic surveillance / communications device.
Who could have foreseen this sort of problem?
Buy T Mobile, our phones suck and our prices are high
T-Mobile has the same Samsung Galaxy S8 and iPhone X as AT&T, Sprint, and Verizon and, with Sprint as the possible exception, has better pricing than the rest. The fuck you talkin' about?
It's not the phone, it's the network. T-Mobile's network sucks cock. Sure, T-Mobile AT&T Sprint are cheaper than Verizon but you get what you pay for in a big way.
I guess 80Mbps+ everywhere I use my phone sucks dick?
T-Mobile isn't going to want this anywhere near a jury.
This is exactly why I have two e-mail accounts. One for daily use on the phone and one for banking not on the phone. The annoying thing is that makes the banking one hard to check easily. I can't get notifications. And those might be time sensitive.
I wish that banks could figure this out. What they need is to let you provide two e-mail accounts. One for all messages and one for anything that involves authorizing transactions or recovering passwords.
Some drink at the fountain of knowledge. Others just gargle.
Now hundreds!
Do you really think the phone company enjoys your grandmother calling them and saying she lost her phone and then trying to get her new phone working with her old number? That is the typical phone customer. You can't have good security with most people because they have no good way of authenticating themselves. I spend an hour on the phone with Revenue Canada last week and the first 3 people I spoke to couldn't authenticate themselves, the first thought giving me a number to call them back at was good enough. (My MP is looking into it)
T-mobile knew this so they claimed to add a real layer of security, except according to the plaintiff they never followed through in enforcing it.
As for the price of bitcoin, it is hard to sell OmiseGo tokens for cash but easy to sell them for bitcoin. The thieves stole the OmiseGo, converted them to bitcoin and then sold the bitcoin. That is why the plaintiff is claiming the value of the bitcoin sold.
Don't worry about that idiot; he hasn't actually looked at T-Mobile in over a decade. Sure, their network used to suck, but so did every other network at some point or another; T-Mo has put more into expanding their network in the last 5 years than the other 3 combined and it's paid off big time.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Now the text message I got from them last week makes sense.
"T-Mobile Alert: We have identified an industry-wide phone number port out scam and encourage you to add account security. Learn more: t-mo.co/secure"
I was suspicious of it and went to their website to see if i could add it myself. I could not. Still being suspicious I called their general customer service line to verify. I figured my phone company wouldn't randomly port out my number to any Tom, Dick, or Harry claiming to be me. There must be some other lapse in their processes for this to be such an issue. At least with the new PIN in place I have some rudimentary form of 2FA to prevent someone trying to port my number witbout my knowledge.
I don't know where you are but I use T-mobile International (highest tier business plan) and it's dirt cheap relative to competing plans, overall very reliable, and features unlimited data AND unlimited hotspot.
Don't worry, a few more hours and bitcoin will be worth zero anyway.
What people think of as a "bank" is a commercial bank.
An investment bank is not a bank; it is a securities broker and underwriter that represents companies in securities transactions like going public, mergers, selling stock or issuing bonds.
People are being mislead enmasse into believing 2FA exists to protect them and enhance security when reality is this technology is pushed almost exclusively in public settings as a means to not have to deal with people forgetting their passwords.
Automated reset facilities result effectively in factor x OR factor y rather than factor x AND factor y. This predictably results in a significant reduction of security in the name of not having to deal with considerable administrative burden of "I forgot my password".
Those marketing 2FA as an enhancement to security deserve to be on the receiving end of lawsuits for their deceptions.
But the important thing is that diverse babies are really important. Anybody that doesn't think diverse babies are really awesome must be Hitler. Buy T Mobile, our phones suck and our prices are high, but diverse babies.
What is that drivel supposed to mean?
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
And Steam keeps telling me to add my phone number so they can send one time codes to whoever steals my phone.
My PC has more security than my phone. A lot more, the only security my phone has is being in my pocket, and my password is random generated too long to remember without using a password manager (and not one of those web-based password snatchers).
I think most cell phone companies caution against the use of exchanging payment information through un secure means. T Mobile is not your mother. You do stupid stuff, you pay the price.
This type of attack is quick common in South Africa, where it is called SIM swap fraud.
In most cases, a corrupt employee at a store of the network assists criminals to obtain a new sim for a customer's account. They then use that, with credentials obtained elsewhere (likely phishing) to get into the user's internet banking and transfer money away.
Using push notifications to an app prevents this. Other things that work is to use HOTP or TOTP tokens instead.
The way it should work is that you confirm you identity with an identity provider. Other companies verify with them. Authorization has to be digitally signed by multiple parties. These companies would have specific procedures for recovering identities and would free other companies from having to deal with it. The procedures you agree to with the identity company are binding and chosen by you.
This is why you have key fobs which can even be Bluetooth. Unhackable as they only receive and transmit data. Which you should only use like a digital signature. How often would a person use their signature back when people used checks? Don't let web sites to force you to use them for signing in or accepting EULA's.
https://support.coinbase.com/c...
"If you are a United States resident, your Coinbase USD Wallet is covered by FDIC insurance, up to a maximum of $250,000"
Shall I sue Target because someone pickpocket took the wallet they sold me?
Put your money in a bank and you'll have some chance at redress if someone steals it.
How am I saying this is better? I am just explaining what happened.
love is just extroverted narcissism
One of the things that annoys the fuck out of me, is that Google keeps asking for my phone number, because they want it to be a backup password recovery thing. That is, if I let Google do what they want to do, then anyone who has my phone number will have total control over my Google account.
I keep saying no, but they harass me all the time. I have seen other companies (*) do this too. It will eventually get to the point where I either have to stop using their services, or I let them use my phone number as a second way to authenticate my account.
What this means, is that I can't use my Google account for anything important. I can't use it as a 3rd party login, for example, because that menas I would be giving anyone who gets my phone number the ability to perform such third party logins.
Fortunately, I don't use my Google (or Facebook or Twitter, etc) credentials for logins to other sites, but I know a fuckload of people who DO. And that means that that those people need to make sure that no one ever takes their phone number. It's a thing they should be constantly worrying about and trying to protect. For some reason, I suspect they don't.
How likely is it that someone would take my phone number? Well, here's the problem: I simply don't know. But since I don't know, I assume it's risky and could happen too easily. I wonder if these other people who do use a service that constantly nags them for phone numbers and also uses it as external authentication to other sites, maybe presume the other way. ("If I don't know, then it's probably fairly safe.") TFA is an anecdote that shows that it can happen.
Anyway, what I'm really getting at, is that the problems are foreseeable but maybe we all differently assess the risk. I personally think this guy has no legitimate case against T-Mobile, because if taking over his T-Mobile account could cause him to lose control of something important, that means he never should have linked his T-Mobile account to that important resource. If your phone number can be used (e.g. click the link in this SMS) to access something, recover a "lost" password etc, then you already know that you are at risk, therefore no reasonably cautious (**) person would ever do anything like that.
(*) Another company who does this is Facebook, and they won. I had to give Facebook my phone number in order to have more than on API key, and my employer relies (!?!) on these API keys (called "app id" in Facebook lingo) is in spite of the fact that I long ago told them that someone above me in the org (e.g. the owner!) needs to make his own account and be the administrator of the API keys. But, of course, nobody wants to be the person who has a Facebook account, so I was the lucky "winner." Until I'm fired or quit, and then I don't know what they'll do, because I'm deleting my Facebook account the day I stop working here, since to me, Facebook is a "work thing."
(**) And this is where we have an argument about whether or not something very commonplace is very stupid, or somehow "reasonable" since so many people happen to do it. A thousand lemmings can't be wrong, therefore there should be a law that cliffs may not exist, since they're so irresistable to jump off of.
But this guy lost control of both factors.
No he didn't lose control they used the phone to reset the factors.
If I had that much money backed by a phone number, I'd get a $10/month PAYG (Pay As You Go) phone under an assumed name. Say your name is "Joe Blow". Bad guys know it, and can find the number associated with that name. They know which phone number they have to socially engineer.
But if you have a burner phone, under the name "Jane Doe", that you use to receive SMS confirmations, that'll be more secure. Obviously, have the phone rooted, and Google/Facebook/etc "cr-apps" removed, and don't give out that phone number to anybody except the service you're securing with it.
And if the bad guys can find out your "Jane Doe" number from the digital coin company that you use it for, I'd say they've already been pwnd to the max.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user