Slashdot Mirror
The SIM Hijackers (vice.com)
Lorenzo Franceschi-Bicchierai of Motherboard has a chilling story on how hackers flip seized Instagram handles and cryptocurrency in a shady, buzzing underground market for stolen accounts and usernames. Their victim's weakness? Phone numbers. He writes: First, criminals call a cell phone carrier's tech support number pretending to be their target. They explain to the company's employee that they "lost" their SIM card, requesting their phone number be transferred, or ported, to a new SIM card that the hackers themselves already own. With a bit of social engineering -- perhaps by providing the victim's Social Security Number or home address (which is often available from one of the many data breaches that have happened in the last few years) -- the criminals convince the employee that they really are who they claim to be, at which point the employee ports the phone number to the new SIM card. Game over.
Game Over? Was this written by a twelve year old? TFA certainly sounds like it was....
I wonder how long until these "hackers" figure out how to call a company and steal my Yubikey authentication credentials...
https://www.youtube.com/watch?v=LlcAHkjbARs
Happened Linus Tech Tips as well. Carrier need to beef up their training and require more authentication
Meanwhile, many banks here are dropping actual 2FA based on the chips in our bank cards, and replacing it with security codes sent by SMS. Great idea. What really surprises me in this story is that T-mobile sent a warning to their customers instead of changing their procedures, and no longer perform sim swaps for any Tom Dick & Harry identifying themselves with a (semi public) SS number.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Are we going to need another step?
A call on a POTS? Use the mail and a mailbox to secure another way of communications?
Domestic spying is now "Benign Information Gathering"
I work in the crypto asset space and these types of attacks have been going on for years now. If your 2FA is based on SMS or a call-back, you're doing it very wrong.
For those interested in doing 2FA correctly, buy a yubikey (USB-C if your phone supports) and couple that with Yubico authenticator which is 100% compatible with Google Authenticator. The major difference is that none of your 2FA codes appear until you plug your yubikey into your phone and nothing sensitive is stored on the phone itself. This way, the attacker would physically need your yubikey to authenticate as you - problem solved.
Because IT WUZ HAXX0RZ!!1!
That's msmash for you.
Or are there still companies out there using SSN for authentication.
sudo rm -r -f --no-preserve-root /
No need for any "hack" since the information is already available for free to anyone asking for it.
If the victim has an email address associated with the mobile phone account (almost everyone does), the phone service should send a code to the email address and ask the "customer" to read it out when they receive it.
No code, no phone redirect. We'll stick a new SIM card in the post to put in your new phone.
Summation 2
Why don't carriers check basic stuff like whether the SIM is still active on the network in the same mobile device it has always been before doing the swap?
In the EUm a few terrorist used a huge number of prepayed SIM cards. Now everyone has to show some kind of ID, just to own one.
They are FREE....!
great news, we'll soon have to have 3 forms of id to do anything to our phone accounts.
Talk about a word salad. Interior crocodile alligator, I drive a Chevrolet movie theater.
Only the State obtains its revenue by coercion. - Murray Rothbard
It's not about the phone. It's about that Youtu.be affiliate link at the bottom of every post. It could be creimer, it could be one of his imposters, or it could be APK. I don't even know anymore. Anyway when you go watch the Rock go be a lolligirl or whatever its about, appleboi get like 25% of a whole penny!