Slashdot Mirror
Man Sues T-Mobile For Allegedly Failing To Stop Hackers From Stealing His Cryptocurrency (theverge.com)
Over the weekend, a lawsuit was filed against T-Mobile claiming that the company's lack of security allowed hackers to enter his wireless account last fall and steal cryptocoins worth thousands of dollars. "Carlos Tapang of Washington state accuses T-Mobile of having 'improperly allowed wrongdoers to access' his wireless account on November 7th last year," reports The Verge. "The hackers then cancelled his number and transferred it to an AT&T account under their control. 'T-Mobile was unable to contain this security breach until the next day,' when it finally got the number back from AT&T, Tapang alleges in the suit, first spotted by Law360." From the report: After gaining control of his phone number, the hackers were able to change the password on one of Tapang's cryptocurrency accounts and steal 1,000 OmiseGo (OMG) tokens and 19.6 BitConnect coins, Tapang claims. The hackers then exchanged the coins for 2.875 Bitcoin and transferred it out of his account, the suit states. On November 7th, the price of Bitcoin was $7,118.80, so had the hackers cashed out then, they would have netted a profit of $20,466.55. Tapang goes on to say, "After the incident, BTC price reached more than $17,000.00 per coin," but given the volatility of bitcoin prices, the hackers may not have benefited from the soar.
The suit alleges T-Mobile is at fault partly because the carrier said it would add a PIN code to Tapang's account prior to the incident, but didn't actually implement it. Tapang also states that hackers are able to call T-Mobile's customer support multiple times to gain access to customer accounts, until they're able to get an agent on the line that would grant them access without requiring further identity verification. The complaint also lists several anonymous internet users who have posted about similar security breaches to their own T-Mobile accounts.
The suit alleges T-Mobile is at fault partly because the carrier said it would add a PIN code to Tapang's account prior to the incident, but didn't actually implement it. Tapang also states that hackers are able to call T-Mobile's customer support multiple times to gain access to customer accounts, until they're able to get an agent on the line that would grant them access without requiring further identity verification. The complaint also lists several anonymous internet users who have posted about similar security breaches to their own T-Mobile accounts.
Using access to a phone number as an authentication method is the REAL problem here. Choose cryptocurrency/banking websites that don't allow access to your account simply by having access to your registered phone number. Using an encrypted channel rather than SMS helps, but there are still problems with e.g. IMEI spoofing and, as demonstrated, social engineering. This seems like a targeted attack, as the attacker knew his phone number and which websites he had cryptocurrency on, so 'security questions' likely wouldn't have helped, either.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
WTF does the price of Bitcoin have to do with it? If someone stole $20 from me 5 years ago and bought a Bitcoin with it, it's unreasonable for me to claim $9K in damages today.
Maybe the thieves then bought some coke off Silkroad and snorted it. Net Present Value, $0.
"National Security is the chief cause of national insecurity." - Celine's First Law
It sounds like AT&T or T-Mobile (not sure which carrier), was absolutely, partially at fault, for not assuring a reasonable level of security to their infrastructure. If the account in question did not require at least 2FA+ to access, which could of been enabled and disabled by the customer, and it's contents were not fully encrypted, to the point that it required an additional layer or security to unlock, such as a TOTP, then they are at fault for not providing a reasonable, and responsible security level for the account access.
However, it also appears that the coin exchange is also at fault, for not providing the same level of infrastructure security.
This entire problem seems to be a classic and disturbing case, of companies not providing reasonable security. I think this lawsuit has the potential to set a good bar for reasonable security and if it's done right and successfully, could finally usher in what is sadly missing from almost every service the average person accesses.
Buy T Mobile, our phones suck and our prices are high
T-Mobile has the same Samsung Galaxy S8 and iPhone X as AT&T, Sprint, and Verizon and, with Sprint as the possible exception, has better pricing than the rest. The fuck you talkin' about?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
But when I read they had promised they had put a security code in place but they had not done so, they lost it.
This guy took the appropriate steps, the phone company should pay up.
If you say you have security on your account but do not actually put it in, then you owe the customer money
excitingthingstodo.blogspot.com
That's not what is happening here. People will set up account recovery with their phone used as a relay for a recovery pin. Most likely he has some kind of online wallet linked to it.
love is just extroverted narcissism
I had my account broken into on T-Mobile. It's far too easy for people to break in since all you need is the phone number and some personal information.
They need to let you choose your own login account names and some security questions.
Just way too lax helping you keep your account secure.
You stored thousands in coins on your phone. YOUR PHONE! Stupid is as stupid does.
No, he didn't store it on his phone. HIS PHONE!
It was however his two factor number used for the SMS to verify it was him logging in.
Let that be a lesson to anyone that thinks using your phone number for two factor is a good idea.
Before throwing around accusations of stupidity I suggest actually reading the article.
Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
regardless you should not be using your phone number to secure something of value. that is just braindead on the part of the user.
That's not what is happening here. People will set up account recovery with their phone used as a relay for a recovery pin. Most likely he has some kind of online wallet linked to it.
and that is somehow better? if anything that is even worse. at least a phone you can have encryption, password/pin protection etc.
I'm sure T-Mobile will use some weasel words in their terms on conditions to say they aren't responsible for anything beyond the lost wireless service time.
The thing which will argue against that is in your example of the security guard only able to lose his job, to better fit the circumstances the security guard would have agreed to require a secret code (say, a PIN) to validate visitors and instead he told the burglars to come right in, no code required, let me open the door for you. That may still get him in trouble as an accessory, because at that point he's actively assisting the criminals against what he agreed to do as his job.
T-Mobile, as represented by their employees, took a proactive measure to assist the criminals in violation of what they had agreed with the customer to do. Damages directly attributable to that action have a decent shot at an equitable remedy where T-Mobile has to make the guy whole, i.e. pay for his losses.
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
Now there's a match made in heaven! The least secure form of "currency" or "investment" managed via the least secure form of electronic surveillance / communications device.
Who could have foreseen this sort of problem?
From TFS: "The suit alleges T-Mobile is at fault partly because the carrier said it would add a PIN code to Tapang's account prior to the incident, but didn't actually implement it."
So, yes, in theory it is a great idea... when actually implemented.
T-Mobile isn't going to want this anywhere near a jury.
This is exactly why I have two e-mail accounts. One for daily use on the phone and one for banking not on the phone. The annoying thing is that makes the banking one hard to check easily. I can't get notifications. And those might be time sensitive.
I wish that banks could figure this out. What they need is to let you provide two e-mail accounts. One for all messages and one for anything that involves authorizing transactions or recovering passwords.
Some drink at the fountain of knowledge. Others just gargle.
Do you really think the phone company enjoys your grandmother calling them and saying she lost her phone and then trying to get her new phone working with her old number? That is the typical phone customer. You can't have good security with most people because they have no good way of authenticating themselves. I spend an hour on the phone with Revenue Canada last week and the first 3 people I spoke to couldn't authenticate themselves, the first thought giving me a number to call them back at was good enough. (My MP is looking into it)
T-mobile knew this so they claimed to add a real layer of security, except according to the plaintiff they never followed through in enforcing it.
As for the price of bitcoin, it is hard to sell OmiseGo tokens for cash but easy to sell them for bitcoin. The thieves stole the OmiseGo, converted them to bitcoin and then sold the bitcoin. That is why the plaintiff is claiming the value of the bitcoin sold.
Don't worry about that idiot; he hasn't actually looked at T-Mobile in over a decade. Sure, their network used to suck, but so did every other network at some point or another; T-Mo has put more into expanding their network in the last 5 years than the other 3 combined and it's paid off big time.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
People are being mislead enmasse into believing 2FA exists to protect them and enhance security when reality is this technology is pushed almost exclusively in public settings as a means to not have to deal with people forgetting their passwords.
Automated reset facilities result effectively in factor x OR factor y rather than factor x AND factor y. This predictably results in a significant reduction of security in the name of not having to deal with considerable administrative burden of "I forgot my password".
Those marketing 2FA as an enhancement to security deserve to be on the receiving end of lawsuits for their deceptions.
But the important thing is that diverse babies are really important. Anybody that doesn't think diverse babies are really awesome must be Hitler. Buy T Mobile, our phones suck and our prices are high, but diverse babies.
What is that drivel supposed to mean?
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
If he can show that they were supposed to apply a PIN but did not, he's got a fairly solid case. Will cost him an awful lot though, the US judicial system is not supposed to be utilised by ordinary plebs unless they're in the dock.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
This type of attack is quick common in South Africa, where it is called SIM swap fraud.
In most cases, a corrupt employee at a store of the network assists criminals to obtain a new sim for a customer's account. They then use that, with credentials obtained elsewhere (likely phishing) to get into the user's internet banking and transfer money away.
Using push notifications to an app prevents this. Other things that work is to use HOTP or TOTP tokens instead.
The way it should work is that you confirm you identity with an identity provider. Other companies verify with them. Authorization has to be digitally signed by multiple parties. These companies would have specific procedures for recovering identities and would free other companies from having to deal with it. The procedures you agree to with the identity company are binding and chosen by you.
This is why you have key fobs which can even be Bluetooth. Unhackable as they only receive and transmit data. Which you should only use like a digital signature. How often would a person use their signature back when people used checks? Don't let web sites to force you to use them for signing in or accepting EULA's.
https://support.coinbase.com/c...
"If you are a United States resident, your Coinbase USD Wallet is covered by FDIC insurance, up to a maximum of $250,000"
Because his number was ported to AT&T.
All the criminal activity happened at the AT&T' side.
But it ridiculous to go after T-Mobile, they released the number after being given the correct info on the port request, and restored the number after netting told the request was fake.
Moral of the story is to keep your personal data private. Nobody did anything wrong here except for the hackers.
Did you really read TFA? You just assume that so called "hacker" in the story really did the hack? This is another misused case of the word "hacker"...
Carlos Tapang of Washington state accuses T-Mobile of having “improperly allowed wrongdoers to access” his wireless account on November 7th last year. The hackers then cancelled his number and transferred it to an AT&T account under their control. “T-Mobile was unable to contain this security breach until the next day,” when it finally got the number back from AT&T, Tapang alleges in the suit
The suit alleges T-Mobile is at fault partly because the carrier said it would add a PIN code to Tapang’s account prior to the incident, but didn’t actually implement it. Tapang also states that hackers are able to call T-Mobile’s customer support multiple times to gain access to customer accounts, until they’re able to get an agent on the line that would grant them access without requiring further identity verification. The complaint also lists several anonymous internet users who have posted about similar security breaches to their own T-Mobile accounts.
The thief called up T-Mobile support and social engineered the right person to change all information and gain access to the number, and then the person transferred the number to AT&T. Now you tell me why AT&T should be responsible? Also, nobody give personal info to anyone. Most information you need to do this kind of thief is usually in public. It is all about skills to find the right person to talk to on the other line.
How am I saying this is better? I am just explaining what happened.
love is just extroverted narcissism
AT&T-Mobile
The suites are fleshies, silly. I really hope this term doesn't catch on.
If I had that much money backed by a phone number, I'd get a $10/month PAYG (Pay As You Go) phone under an assumed name. Say your name is "Joe Blow". Bad guys know it, and can find the number associated with that name. They know which phone number they have to socially engineer.
But if you have a burner phone, under the name "Jane Doe", that you use to receive SMS confirmations, that'll be more secure. Obviously, have the phone rooted, and Google/Facebook/etc "cr-apps" removed, and don't give out that phone number to anybody except the service you're securing with it.
And if the bad guys can find out your "Jane Doe" number from the digital coin company that you use it for, I'd say they've already been pwnd to the max.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user