Slashdot Mirror
Investor Sues AT&T Over Two-Factor Security Flaws, $23 Million Cryptocurrency Theft (fastcompany.com)
An anonymous reader quotes a report from Fast Company: Crypto investor Michael Terpin filed a $224 million lawsuit against AT&T in California federal court Wednesday alleging that the phone company's negligence let hackers steal nearly $24 million in cryptocurrency from him, Reuters reports. He's also seeking punitive damages. Terpin says hackers were twice able to convince AT&T to connect his phone number to a SIM card they controlled, routing his calls and messages to them and enabling them to defeat two-factor authentication protections on his accounts. In one case, he says hackers also took control of his Skype account and convinced one of this clients to send money to them rather than Terpin. The second hack came even after AT&T agreed to put an additional passcode on his account, when a fraudster visited an AT&T store in Connecticut and managed to hijack Terpin's account without providing the code or a "scannable ID" as AT&T requires, he says.
"Your security weaknesses allowed someone to steal my pretend money!"
I imagine that in his lawsuit he's valuing the currency at the then-value (as of early January) rather than the present value. Because if it was present value, not only would the losses be much smaller, but AT&T could just keep dragging the lawsuit out until the losses would be so small as to be meaningless ;)
I believe Bird-Person can arrange that.
Not because I think he deserves his money back...
He might win and in the process force ATT to stop sucking at security. That would be a win for everybody.
Sure, AT&T might provide horrible security, so their mobiles are not a good 2nd factor.
But isn't as much blame to put on whoever maintained the first factor? The article doesn't tell us how and why that factor failed...
This has been a problem for years. I keep getting prompted to add my phone number to use for "extra security" when really all it does is increase the attack surface and make the account easier for a dedicated attacker to compromise. Considering that dedicated attackers are by far the worst kind, and knowing that not just AT&T but basically all carriers can easily be convinced, by a sob story about a lost phone or similar, to give anyone access to your number, you'd have to be pretty stupid to use that method for anything seriously important (like millions in cryptocurrency).
I wouldn't even use that for Facebook...
queue the hordes who call this frivolous because SMS can be hacked anyway...
on the flip side sounds like this guy was targeted and probably not because he isn't a douche.
When your security matters, telecoms should not be trusted.
Anons need not reply. Questions end with a question mark.
You can't steal someone's identity, in actuality, unless you have their biometric signature within their physical body. This is how to responsibly authenticate access to hundreds of millions of dollars. However, if for some reason your real identity is better kept unknown and shrouded in cryptocurrency to evade taxes and hide the identity of your investors' insider hedges then I guess you get what you deserve from anonymity.
The real problem is the laws regarding banking is stuck in the late 20th Century when bank robbery became "identity theft".
In the 19th Century, they called it bank robbery when the Wells Fargo Stage Coach got robbed.
In the 21st Century, Wells Fargo robs the customer, outright.
As for AT&T, they've been stealing for years.
Yay! Sue their pants off. Bigly lawsuits may finally motivate such companies to reduce shortcuts and sloppiness.
Seems the only way to make them care is to kick them in their wallets.
Table-ized A.I.
He was obviously hacked. It's his fault.
Some lawyer is trying this on spec. Maybe he's hoping they'll settle to avoid legal costs.
And cry to the law when your libertarian dunning-krugerrands get free-marketed away from your weak hands.
Anyway, lol at keeping $23 million "worth" of crypto hot and not using so much as a hardware wallet. I don't even have $23 *thousand* to protect, yet I use a yubikey literally anywhere that allows it (including keepass using a plugin), because account security is broadly dependent on individual organizations that are highly incentivized to be insecure.
Cheapskate couldn't spring for an RSA token. The phone company isn't good at security and expecting them to be on a phone plan is ridiculous. If he wanted security he should have bought a plan that explicitly supplied it, instead of trying to create the obligation ex post facto.
Also insurance seems like it would have been in order here.
Oh lol wait; this "investor" didn't own any cryptocurrency. He was nominally owed cryptocurrency by some worthless online site with poor 2fa implementation that instead transferred actual ownership of the currency to the hackers.
Biometrics are a terrible solution. The biometric hashes to a digital signature stored by the service, just like they currently store hashed passwords. When that hash is lost or stolen, how am I supposed to change my physical self?
OTOH, text messaging is a common 2FA method and AT&T needs to do better before someone gets their bank account hoovered.
I hope AT&T loses big considering that they screwed up once, agreed to an additional security measure, then ignored the extra measure entirely in the process of screwing up again.
Possession is not the same as ownership, despite the quip about it being worth 9/10ths as much.
If I store my property into a self-storage locker, I am NOT transferring ownership of my knicknacks to the storage company.
Isn't it an open question whether using the AT&T phone service as a critical authentication component puts a duty on AT&T to secure their phone service?
Doesn't the organization that decided to use the AT&T phone service as a critical authentication component bear some responsibility for their choice?
If I secure my $100M gold stash in a storage locker protected by a $40 Masterlock padlock, do I get to sue Masterlock for $100M when the thieves use a bolt cutter to remove the lock and take my gold?
If I secure my $100M gold stash in a storage locker protected by a $40 Masterlock padlock, do I get to sue Masterlock for $100M when the thieves use a bolt cutter to remove the lock and take my gold?
No, but if the thieves asked Masterlock to open it and they did, you'd have a much better case.
You can just hack off your fingers and replace them with AT&T fingers. Remember, AT&T - Reach Out and Touch Someone [with AT&T Fingers].
The question is closed. AT&T _already had a duty to secure their phone service_ in the first place.
As a DIRECT result of AT&T's improper an unlawful actions, their customer was significantly harmed. This even happened after AT&T was taken to task for making the same mistake on the same customer's account previously and having promised to implement measures to prevent it. IANAL, but that sure as hell sounds like ample grounds to sue for the value of the entire loss, plus legal costs, etc.
The lock analogy is absolute and utter BS. A slightly better (though still flawed) analogy might be hiring a security company to prevent anyone from accessing your storage locker containing a stash of gold. The security guard on duty then decides to ACTIVELY ALLOW a burglar to enter the locker, a second time after having already screwed up once and promising to adequately protect it this time. SO, do you "get to sue" the security company?
That is indeed an interesting question. There are two different factors at play.
I expect a certain amount of security from a $5 Masterlock.
I expect a greater amount of security from a American Lock Company shrouded shackle that costs $60.
I expect even more security from a $500 Medeco.
Similarly, I expect a pickup truck to be able to carry a 400 pound load. I expect a semi truck to be able to carry a 10,000 pound load. Ford isn't responsible if I put a 10,000 pound load on my F-150 and it doesn't work well. Wrong tool for the job.
Aside from how much security is expected, how much LIABILITY is there? The maker of a $5 lock might reasonably foresee that their lock would be used to secure a $50 item. Medeco knows their locks are used to secure $20,000 jewelry. If you use a $5 to "secure" a $10,000 item, that's on you. You used the wrong lock for the job.
Is a text message designed or expected to secure $xx million? Is it the right tool for the job?
But isn't as much blame to put on whoever maintained the first factor? The article doesn't tell us how and why that factor failed...
If the investor ("crypto gambler" sounds more apt) had their virtual tulip bulbs in their blockchain wallet, there would've been no heist. My best guess would be that the coins were stolen from an account on Coinbase, which uses this sort of 2FA.
So, as much as I loathe AT&T, this is really just another case of someone failing to heed the advice of "don't keep your Bitcoins on an exchange." There are so many ways that can end badly, and most of them don't involve AT&T.
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
BTW people are talking about how much fault AT&T may have vs if this guy is at fault for using the wrong tool for the job. Let us not forget, really it's the thief's fault.
Whenever bad guys hack something, everyone wants to go after the company that got hacked. *IF* the company was reckless, that makes sense to a degree. There's also a criminal involved. That's who REALLY, obviously did something very wrong.
At the least, AT&T agreed to implement an additional security measure which they then ignored entirely (as if it didn't exist). That constitutes a specific promise made and then reneged.
It's notable that at one time, AT&T took security VERY seriously. They still enjoy the reputation even though increasingly it seems undeserved.
This kind of thing infuriates me because I have similar "restrictions" on my accounts yet my lovely ISP's outsourced call centers refuse to follow protocol that requires them to ask. The policy literally says they will be terminated for failing to do so yet everytime I call, it's trivial to get around them.
OTOH, text messaging is a common 2FA method and AT&T needs to do better before someone gets their bank account hoovered.
Car door locks are a common way of securing your vehicle, and they can be easily defeated with a wedge, an inflatable bag, and a bent coat hanger. Car manufacturers need to do better, before someone gets their valuables stolen.
Or perhaps, you can realize the security is inherently shitty and don't rely on a locked car to protect your valuables.
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
Run several dozen time in prime-time, and include a visible cigarette-style warning on all their products that the provided security is basically non-existent.
Thats an asinine comment at best, some people are just fucking idiots with no care or consideration for anyone else!
s/Thats/This is/
Thats an asinine comment at best, some people are just fucking idiots with no care or consideration for anyone else!
What comment are you even replying to?
Perhaps you meant to reply to the GP? The direct parent of your post is entirely true. Masterlock deciding to open your lock for a thief is a much better analogy to what AT&T did than the thief using bolt cutters.
Is a text message designed or expected to secure $xx million? Is it the right tool for the job?
+1 but out of mod points. That is exactly the right question. And I'm hoping banks are taking notice: over here there seems to be a shift away from air-gapped 2FA (PIN protected challenge/response through a chip on bank cards) because people find it "inconvenient" having to carry the pocket card reader. SMS based 2FA is all the rage now.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
AT&T is a phone company, not a secure vault. They are not obliged by contract to provide Fort Knox-like security to you. It's the same reason you don't use Windows to run mission-critical industrial or medical systems - because you will be the only one responsible for any consequences. If you rely on AT&T to provide security for transactions of such magnitude, then you're doing it wrong and any losses are your own fault.
You know they are going to respond claiming Bitcoin isn't legitimate and that he can't prove damages, because it's not an accepted currency or doesn't have an accepted value.
AT&T is the worst company on the face of the planet in regards to quality and security.
against this attack a non air gapped version would have worked just as well as long as the recieving phone is a smartphone which can do apps.
Problem with this attack isn't lack of airgap but the fact the security is dependent on a changeable private key (imei) of a public key (your number)
verifying biometrics without meeting in person comes down to digital data which can be stolen and reproduced.
The difference is that security companies will have an agreement about how much they're willing to protect, and insurance policies to cover loses up to that amount. Your contract with them will spell out the maximum amount that they will protect or transport for you, and if it goes missing then your losses will be covered.
AT&T is not a security company and has not agreed to protect your valuables. You can certainly sue them for failing to provide the service which you purchased, but expecting them to pay out millions because you were stupid enough to coopt their service as a shitty "security" method ... that's not at all reasonable.
We're telecoms, the sign in front, jackass. Do you read?
Security is next door!
I'm not sure it actually matters. They were clearly negligent, and because of that, their customer was harmed. How about this: Your landlord doesn't merely fail to prevent a thief from entering your apartment, but instead _actually takes away your apartment key and gives it to the thief_ without any authorization, and after having already promised you to never let anyone in without your explicit permission. When the thief then makes off with all your expensive stuff, what, do you just get a one day credit on your rent because that dude was occupying your apartment for the day while stealing everything? Or is your landlord perhaps responsible for the loss?
It really sounds a lot like this guy considers his AT&T billing account to also be a form of identification.
Did AT&T market it as a form of identification?
Don't get me wrong: I know lots of other irresponsible parties (e.g. Google and Facebook, among many, even Slashdot works like this) use the ability to receive a challenge by phone or email as the main way of authenticating. But everyone knows you can't do that with anything important. A Slashdot account is about as far as you would take that. Did AT&T tell this guy they support this way of doing things?
Your phone can't authenticate you to someone else, and this story is merely an example one of the ways it can fail. But even before this story, you knew it doesn't (and can't) work. It will always be a bad idea. No matter how this lawsuit goes, it will still be a bad idea.
All at&t has to do is stall. If the trial lasts a few months, even if they are found guilty, they'll only owe like 50 bucks.
There are some proprietary implementations of salted/revocable biometrics out there.