4 ms·
"That other little thing the attacker did? He started a port of the phone number from Verizon to a VOIP provider, and that port had completed overnight." One t
by cmurf 10y ago
"That other little thing the attacker did? He started a port of the phone number from Verizon to a VOIP provider, and that port had completed overnight."
One take away is how SMS as 2FA depends on a flawed assumption. The other I found cute is using random strings as answers to the stupid account recovery questions companies continue to ask.
Things not mentioned in the blog is exactly what personal information the attacker had, that authenticated him to Verizon. PIN? Some portion of his SSN? It must not have been account recovery questions because the target of the attack used random strings as answers.
- JoshGlazebrook 10y agoVerizon definitely does ask for account pin whenever I call in, usually entered via number keypad before you're routed to an actual person.
- josu 10y agoApparently, the PIN is opt-in. >With Verizon on the phone, it was a fairly simple matter to re-reset the portal password, set an account PIN to prevent attacker re-entry and un-do the phone forward.
- nbadg 10y agoUsing social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit. [1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m... [2] https://www.youtube.com/watch?v=caVEiitI2vg https://www.youtube.com/watch?v=caVEiitI2vg [3] https://youtu.be/bjYhmX_OUQQ?t=98 https://youtu.be/bjYhmX_OUQQ?t=98
- x0x0 10y agoHoly crap, watch video #3 it's worth it. She adds herself to the account by calling and asking.
- JoshGlazebrook 10y agoWow that really was crazy easy for her to do that. I guess it also taps into emotions with the crying baby as well.
- initram 10y agoI have many accounts that require a PIN. Many of them I set up years ago and have no idea what the PIN would be. I'm always able to talk my way out of it, though. (And this is not something I practice or know how to do well. I literally just say something like, "PIN? I have no idea. I don't even remember having the option to set one.")
- stanleydrew 10y agoThe problem is that the default PIN (which is what 99% of customers still have probably) is just the last four digits of the primary account holder's SSN.
- nbadg 10y ago> One take away is how SMS as 2FA depends on a flawed assumption. NIST (among many others) has recommended you stop using SMS for MFA: https://threatpost.com/nist-recommends-sms-two-factor-authentication-deprecation/119507/ https://threatpost.com/nist-recommends-sms-two-factor-authen...
- eridius 10y agoSome time ago I started doing the random strings too. I use 1Password for everything, so I just add the questions as free-form fields to 1Password, set up password fields for the answers, and have 1Password generate (pronounceable) passwords to use as the answers.
- dapearce 10y agoWill 1Password detect and autofill these or do you have to look it up?
- eridius 10y agoI have to look it up. There's no way 1Password would be able to detect this. But I can look it up via the 1Password Mini window (the same thing you use to fill the password in the same place) so it's no trouble.
- tajen 10y ago...then I called my bank, they asked me what was my grand mother's name and I answered "Oh it's a very long, random string". I don't remember how secure the other questions were, but she seemed satisfied with such an answer (and granted me access).
- mpolichette 10y agoDid this really happen? I mean, you know what they say about the weakest link...
- mikeash 10y agoIn my case, I forgot I had a randomly generated answer, gave them the real answer, and the representative got very confused when he tried to compare that to what he had in the system.
- eridius 10y agoIs this a hypothetical or something that actually happened? Because if it's the latter then the rep that you talked to needs to be retrained, because that's equivalent to saying "oh it's some street in San Francisco" when asked what street you grew up on. In any case, I have 1Password generate pronounceable passwords specifically to avoid the problem of the rep trying to compare random alphanumeric strings. 1Password can even generate random phrases of N words (e.g. xkcd passwords) which works well for this sort of thing because it's easy to say those over a phone.
- arielb1 10y ago2FA is supposed to be 2-factor authentication: a password and a phone number. If you allow the phone number to reset the password, it becomes 1-factor authentication.