24 ms·

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

• lerie 9y ago
  "Social engineering", a term reserved for those who willingly buy into the Nigerian scams. Now these same people are somehow losing their phone numbers, it's laughable to me. If you "lose" your phone number to "social engineering", you don't deserve a cell phone, please purchase a wall mounted, cord entangling mess. Maybe this is just a Forbes scare tactic.
  • dang 9y ago
    Would you please stop posting unsubstantive comments and rants to HN? We're trying for higher quality here.
    • droithomme 9y ago
      I don't agree with his post. However it was clearly a reasonable position and not "unsubstantive comments and rants" as you are claiming. That is not a reasonable claim at all. Your post is unwarranted and is highly abusive. Just stop. Bullying valid minority viewpoints is not cool and does not contribute to the quality of polite rational debate and discussion.
      • dcosson 9y ago
        The comment in question was in poor taste by mocking victims of hacks for being stupid, and the premise of it was wrong anyway (not understanding that it's the telco customer service at fault more than the people who got hacked). That's about as unsubstantive/low quality as comments go, and really doesn't qualify as "polite rational debate and discussion". It makes sense for a mod to step in and say something.
        • droithomme 9y ago
          I must disagree with this. Monsieur Lerie clearly and specifically objects to the use of the term "social engineering". This does in fact deal with situations where naïve persons can be fooled by con artists. This is a problem in the field. A problem we are all aware of. Denying that it is a problem is counterproductive. Denial does not address the core issues, of exploits that utilize and depend upon the naïvity of the mark. I do not agree with him that a solution is to prevent the technologically naïve from having access to phones. Nonetheless, this is still an issue that must be addressed. Security schemes intended to protect the general market of customers must not rely upon the customer's sophistication in defense against social engineering scams. Many customers, quite reasonably, are technically naïve in some aspect or another. In is completely improper as a security protocol for mass market products to rely upon customers having enlightened opsec.
          • hueving 9y ago
            The part you are missing is that the mark is not the one being socially engineered. The attacker is getting a completely random telco to hijack the mark's phone number by socially engineering the telco. There is nothing 'the mark' can do to prevent this.
      • jacquesm 9y ago
        No, you totally, utterly fail to understand the interaction here and it is you that should stop. If you want to second guess the moderation here you're on very thin ice, this is a pretty clear cut case of someone purposefully ignoring the meat of an article to stir the pot. Note that the victims here are not party to the exchange, contrary to what is claimed in that comment, it is the call center employees of the phone company that are being social engineered into making an unauthorized change to a subscribers record. If you want to limit the use of the words 'social engineering' to the cases where the victims are the ones being social engineered you're ignoring about 3 decades worth of use of the term to apply to any situation where through clever exchanges an elevated level of access was achieved to some resource or other, and those exchanges do not have to be directly with the victim. Typical example: call the secretary from the 'IT department' to gain access to the system of the boss.
  • jasongill 9y ago
    Did you read the article? The victim who've had their phone number stolen weren't the ones that fell prey to social engineering - it's the customer service people at the phone provider who are persuaded to do a port of the phone number. Unless you operate your own phone carrier, it would be hard to avoid this attack.
    • dboreham 9y ago
      It would be about as hard as it is to prevent DNS zone hijacking. That is, not very hard.
      • jasongill 9y ago
        How, exactly, would you prevent someone in a call center on the other side of the world from being convinced to port your number away? Outgoing port "blocks" are nothing more than a note in your file - what's to say that the attacker couldn't just make up a story? "I know I called a while back and asked you to prevent porting, but I really want to switch to X carrier to get their exclusive new handset. Can you remove the block request, my mothers maiden name is..." Pretending like you could prevent this sort of attack is laughable, which is why it's so dangerous.
        • dboreham 9y ago
          As I said, like the DNS system : you lock the number, only allowing porting upon presentation of a secret that only you know. Default state is : locked.
    • deleted 9y ago
      [deleted]
  • madenine 9y ago
    If a bad actor gets your data in a breach, the article posits that only person that has to fall victim to any level of social engineering is the customer service rep of your cell provider or some other service you use. So while you might be above nigerian prices, free cruises, and the like - do you have the same faith in the as-cheap-as-possible customer service rep from your provider? That's what the article is getting at.
  • macspoofing 9y ago
    The problem is that you can socially engineer the Telecom service desk. It's not that hard. I did it when I pretended to be my dad (at his request) to switch his phone plan.
  • deleted 9y ago
    [deleted]
• simooooo 9y ago
  This has been the vector for Twitter hacks for many years. Get the 2nd factor
  • zwily 9y ago
    Get the 2nd factor... that's NOT sms.
    • Spivak 9y ago
      SMS as a second factor is fine. As bad as it is it can't reduce your security compared to just a password. SMS as an account recovery mechanism is the problem.
  • macspoofing 9y ago
    SMS is the 2nd factor. Actually it's worse than just a 2nd factor because a compromised phone number can usually be used for password recovery
    • BrandonLive 9y ago
      You are confusing two different things. The problem is one factor account recovery, because it means you have one factor auth.
• noobermin 9y ago
  NIST has already been discouraging the use of SMS for 2fa[0], but that apparently won't stop the subset of incompetent IPSec consultants who still recomment SMS based 2fa. [0] www.slate.com/blogs/future_tense/2016/07/26/nist_proposes_moving_away_from_sms_based_two_factor_authentication.html
  • jacquesm 9y ago
    It doesn't stop incompetent dataroom operators either from forcing their users to give them their phone numbers for 2fa purposes. And there is absolute gold in those datarooms if you know where to look. Recent offender: "iDeals proposes to protect your account with 2 factor authentication. It means that each time when you will be accessing the project/ changing your password/ accessing the protected versions of documents in the data room - an sms code will be sent to your cell phone. " This after me pointing out that SMS for 2fa is not a good idea.
    • kuschku 9y ago
      There’s a far worse example: PayPal only supports SMS based 2FA, or, if you dig through their old website with archive.org, you can find a way to use one of their proprietary 2FA devices. Support for TOTP? HOTP? Nope.
      • jacquesm 9y ago
        I think that your average dataroom holds stuff with value well in excess of what the average paypal account holds.
        • kuschku 9y ago
          The PayPal account itself might not hold much, but most people have their bank account directly linked to PayPal, without any limits. In my case, PayPal could take every cent from my account before I’d even get a message. And that’s why 2FA is so important.
      • seanp2k2 9y ago
• droithomme 9y ago
  Two factor authentication is nothing more than a massive vulnerability. We've seen people somehow change our listed contact numbers through unknown exploits, then hijack ownership of properties using the new number to prove they are us. This wouldn't be possible if not for 2nd factor authorization schemes.
  • qeternity 9y ago
    The biggest issue today is password reuse, and 2FA does help mitigate the liabilities of that. Is it perfect? No. Does it introduce more attack surface? Yes. But for the average user, it almost certainly increases their opsec.
  • SAI_Peregrinus 9y ago
    Only for 2-factor schemes that rely on your phone number. Those are horribly insecure, there's a reason NIST and pretty much all security experts recommend against using them. SMS authentication was created as a cheap hack to get around needing SecurID tokens, and should have been abandoned when ToTP (Google Authenticator and the like) became possible.
    • droithomme 9y ago
      I agree with you completely that those are totally insecure. However, 2nd factor as a dictionary vernacular term has become synonymous in the press with a telephone number and some sort of texting scheme. Before this there was little incentive to hijack phone numbers. No longer is that the case. Having a phone number is not secure in any way, proves nothing, and offloading security onto a totally insecure system such as the possession of phone numbers was a massive cop out and completely irresponsible. Maybe as you say there are 2nd factor schemes that don't use phone numbers but it hardly matters since the term 2nd factor has unfortunately come to mean phone numbers in the vernacular.
      • jacquesm 9y ago
        > 2nd factor as a dictionary vernacular term has become synonymous in the press with a telephone number and some sort of texting scheme I don't think that's true. Both my bank issues hardware tokens for challenge response type authentications, these are widely in use and understood to be 2fa, the same goes for many other services. It's a typical case of all cows are animals but not all animals are cows, I've yet to see the press categorically making that kind of mistake for 2fa, though I'm sure there will be some offenders on the whole people - and the press - seem to know the difference. And it's up to us to correct these things where and when we see them so if you do spot an article that incorrectly labels SMS as the one true 2fa then you should mail the author or the editor to get them to correct the record pointing out that they are perpetrating a fallacy that could cause their readers to be at risk. This is not as far as I can see a lost battle - yet.
• godzillabrennus 9y ago
  I owned a hosted PBX company from 2007-2011 and was amazed with how antiquated the port request system truly is. The problem is that the phone company owns your phone number and you just get access as part of a service. Unlike a domain name where you own it. If we change the law we'd bring more accountability.
  • Klathmon 9y ago
    To be fair, you really don't own a domain. You still rely on the TLD honoring your purchase and not hand it over to someone else in the same way you rely on the phone company to treat your number as yours.
    • singlow 9y ago
      In the same way that you rely on a county deed office to own your land. The only difference is the amount of legal precedence in place and physical occupancy, neither which can be solved with the wave of a hand.
    • justinclift 9y ago
      Some domain registrars are so completely incompetent (ie Dotster), I'm disappointed they're still in business. Literally clueless "customer support" staff that either don't auth (experienced that personally), or refuse to follow the written rules to everyone's detriment. Recent example: https://issues.apache.org/jira/browse/INFRA-13657 https://issues.apache.org/jira/browse/INFRA-13657 Note - Don't use Dotster (specifically) for your domains. If you're using them now, switch away. Saying that because if you experience any trouble with your domains, you'll be wanting to contact competent staff who can fix problems. Dotster's can't. :(
      • godzillabrennus 9y ago
        At least you have a legal path: https://www.google.com/amp/s/www.forbes.com/sites/theyec/2015/02/28/how-to-recover-from-a-domain-name-hijacking/amp/ https://www.google.com/amp/s/www.forbes.com/sites/theyec/201... Not exactly an easy thing to do with a phone number.
• exratione 9y ago
  Many phone companies will allow you to (a) add an annotation to your account to declare the number you are using should never be ported to another company, and (b) add a password to the account that you will have to provide to customer service representatives when making changes. This helps to minimize the chance that an attacker can use social engineering to redirect your number to a system under his or her control. If these are not options for your phone company, find a better phone company. Even given that, since it relies upon human choice and behavior, and does nothing versus attackers with assets within the phone company, it seems a bad idea to have 2FA via SMS.
• fabian2k 9y ago
  What settings exactly do I have to change to get GMail to never unlock my account by SMS alone? I have enabled proper 2FA on my Google account with U2F, but I haven't disabled everything else yet because I only have one token, and I still need something like TOTP for stuff that uses Google accounts, but doesn't support U2F. As a closely related remark, I wish U2F would just get popular enough, it's pretty convenient, isn't vulnerable against the kind of attack SMS-based 2FA is, and protects against phishing. But almost nobody outside Google supports it, and OS/Application support is rather incomplete or requires additional setup.
  • kuschku 9y ago
    Also, Google only supports U2F in Chrome – even if you have an addon to support it in Firefox, Google won’t support it (because they activate it based on Useragent, not on actually available functionality)
  • gregstoll 9y ago
    The Tech Solidarity guide at https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm has detailed instructions on how to set up 2FA with U2F and then remove SMS 2FA. (I've been holding off because I use Firefox - hopefully U2F will get more support soon!)
  • glandium 9y ago
    Something that is infuriating is that when you have 2FA enabled on Google, they insist that you add a backup phone number that a bot calls to give you a verification code, in case, you know, you lost your second factor. Which is nice and all, but now, you're back to having a second factor that is about as vulnerable as SMS.
    • inferiorhuman 9y ago
      You can remove the phone after you add another factor (ex: TOTP device).
      • deleted 9y ago
• awinter-py 9y ago
  Not answering security questions truthfully is tricky. Yes, it's a problem that security questions turn hacking into a simple public records search. BUT most terms of service have a line like 'you warrant that you've been entirely truthful with us' or something. If you give the wrong security question to your bank, they potentially have grounds to freeze your money or screw you later. Why isn't the answer 'consumers have the power -- punish services that don't support FIDO by not using them'. At best this article is saying 'don't connect anything to anything'.
  • djsumdog 9y ago
    I never use real answers. I've had a bank teller ask "your mother had a number I get maiden name?" "Wait, you actually use real answers instead of passwords for security questions?"
    • awinter-py 9y ago
      I don't use real answers either because I'm paranoid about this stuff, but it always causes trouble when I have to interact with an institution. Examples: - I lost my health insurance for 6 months because I couldn't dig up my 'secret answer' in time to activate COBRA. - My credit card expired while I was traveling and I couldn't reactivate it because I didn't know what answer I had given to 'mother's maiden name'. (In the end I convinced them I didn't need a secret answer to verify my identity, which in its own way is even worse). - Some company had a form that stripped numbers from the secret answer and mine had numbers in it (hilarity ensues). Instead of working around institutional nonsense, we should fire bad companies and hire / start good ones.
      • macintux 9y ago
        I always, always store my bogus answers in 1Password. One of many reasons I love the tool. Most security questions are either trivial for someone else to figure out with a little research or I don't know what my real answer would be. Name of my first pet? Well, I had several that could meet that definition, and I definitely don't remember the name of the first one.
• ghouse 9y ago
  While SMS for 2fa is _a_ problem, it's not _this_ problem. Using SMS for _account recovery_ circumvents 2fa and circumvents strong passwords.
• willow9886 9y ago
  This recently happened to a friend of mine. It was devastating. As mentioned, U2F is very scarcely supported today. The best way he came up with to secure services that insist on using SMS for 2FA (or credential reset) was to register the number of a pre-paid phone for those services. Inconvenient? YES. But a pre-paid phone number can not be ported by a negligent (or willfully criminal!) operator.
  • FT_intern 9y ago
    It's still very trivial to tell a customer rep that you lost your SIM card and have the rep send all new communication to the phone number to a separate SIM card with a pre paid phone.
    • deleted 9y ago
      [deleted]
    • munin 9y ago
      If you only use this pre-paid phone for authentication, then the fraudster has to discover that phone number before they launch their attack. For additional security, you can rotate this pre-paid phone number every few months, and only use it for authentication to online services.
• occamrazor 9y ago
  Would this attack be neutralized by a mandatory waiting period of a few weeks for number porting? I recently ported my number to another operator (in a European country), I had to wait for a month and received at least two warning SMS.
  • Thriptic 9y ago
    It would but the average user would be pissed if they went into a retail store and were told that they had to wait weeks to use their new phone. They might decide to abort the purchase.
    • occamrazor 9y ago
      I didn't think about that, because all phones here have a removable SIM card.
  • ryanlol 9y ago
    Meh, I'd just report your phone as stolen and get the IMEI blocked. You wont get the warning SMS and might not even get a new phone in time to figure out what's going on.
• TaylorSwift 9y ago
  This happened to me. 1. I believe it began with the hacker getting DOB/SSN. 2. Called wireless provider, and hacker forward all calls and texts to a burn phone. Eventually, the hacker ported my wireless phone to another provider/number (not sure which), and the phone registered to my provider did not work anymore. The landline phone was also forwarding calls to another number.* 3. Hacker gained access to email (as that email was also within the telco's site). At the beginning, the hacker did not reset the password. After I changed the email's password, hacker was still gaining access to our emails and he/she eventually reset the email blocking my access. (reason was all the text and calls was forwarding to his/her burn phone so he/she can reset the pass anytime) 5. Requested 2FA from bank. 6. Gained access to bank account. This was over a course of 3 months. It was a nightmare to resolve and paranoia still remained. The hacker later on went opening several bank accounts. Fortunately, this was discovered early. The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. *I saw two numbers that were being used within my wireless account site to forward the calls.
  • adekok 9y ago
    > The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. Why would they care? It happens dozens of times a day, and the criminals are out of their jurisdiction. If only the police, FBI, politicians, etc. could go after the banks and telcos to improve their security. But no... they see it as their job to destroy security, in order to make you "safe".
    • wyck 9y ago
      The is a direct correlation between security and fraud related interest/insurance in regards to the cost of use and exposure to fraud. They aren't out to "destroy" your security, it's a liability threshold calculation. At the end of the day secure yourself in life, this include choosing banks that are more stringent based on your needs and what you want to pay.
      • joshgel 9y ago
• mtgx 9y ago
  Remember this the next time you may tend to agree with governments' push for backdoors. If they get their way even Google Authenticator won't be safe, just as SMS isn't anymore for 2FA, all because the surveillance agencies preferred to keep the SS7 vulnerability and others like it so they can exploit it (outside of the "rule of law", as otherwise they wouldn't need it).
  • femto 9y ago
    But...if a public that doesn't understand the nature of backdoors is fearful of the consequences of backdoors being cracked, it's a short step to turn attempts to crack the backdoor into something terrifying, in which case an attempt to crack the backdoor becomes a justification for its existence. Yes, I'm cynical on this matter.
• 49531 9y ago
  A few months ago I took 3 of my 4 kids to a birthday party at a minigolf course. I played some holes with my youngest I had taken with me, and then left the two older ones at the birthday party with the understanding that their mother would pick them up (as we had discussed earlier) After leaving the party with my youngest, I went to the grocery store, and then on home. When I got home my wife was gone, which I expected since she was picking up the older kids from the party. Throughout this afternoon I had not been checking my phone in an attempt to be a bit less connected on the weekends. About half an hour later my wife comes home totally freaked out and frazzled. Apparently after I had left, someone went into a T-Mobile store and somehow convinced the associate that my number was theirs. I had received a couple of texts from T-Mobile with a pin number where the store associate had attempted to do something, but I was not aware of them until later. Once this person had my number, they called my bank, reset my online password, and transferred all of our money from various accounts into one of my checking accounts. The bank then put a hold on everything (thank god). My wife happened to have been paying bills online while this was happening, and saw it all go down. Her first thought was to call me, then when I didn't answer to call the mom throwing the birthday party. Birthday party mom told my wife I had left, so my wife assumed that myself and our 3 year old were being mugged or something. The police were involved and she spent a good amount of time freaking out trying to find me. All in all I had a pretty good afternoon :P For real tho, it was a freaking mess. Took weeks to get our accounts safe, and we try to avoid using phone numbers for 2fa now.
  • xbmcuser 9y ago
    In Singapore they give us a physical token. We have to enter the 2Fa we receive into it to receive a third code to enter into the website. Well I guess it's 3Fa. It is a bit of a hassle but better safe than sorry.
    • 49531 9y ago
      Yea, my wife uses a physical token generator now, and I use the app which is bound to my phone. Someone would have to physically have my phone (and unlock it) in order to access my bank now.
• microwavecamera 9y ago
  With helpful picture of a "hacker" so you can recognize one.
• dheera 9y ago
  I wish we could kill phone numbers once and for all. It's insecure, device-dependent, carrier-dependent, country-dependent, subject to snooping and censorship, and all of these are recipes for disaster as an authentication scheme, especially in the event that a device gets stolen. Phone calls and text messages should emphatically NEVER be used to verify anything. Conversation with one of my banks the other day: Them: Can we please verify a code sent to your phone number? Me: Umm, sure, although that won't verify anything. Use something else to verify that it's me. Them: Can you please verify your phone number? Me: Umm, I don't know what phone number I used with you? Try XXX-XXX-XXXX, XXX-XXX-XXXX, XXX-XXX-XXXX, XXX-XXX-XXXX, XXX-XXX-XXXX, XXX-XXX-XXXX, and XXX-XXX-XXXX? They all belong to me depending on where I am. Them: Can we use XXX-XXX-XXXX? Do you have this phone with you right now so we can we send a text message with a verification code? Me: Send your insecure SMS to any of my numbers. They all go to my e-mail inbox. [I don't need to have my "phone" with me -- my "phones" are virtual.]
  • blhack 9y ago
    Is it really necessary or helpful to be rude to the poor CSR who is just trying to do their job? They didn't make this policy, and I'm sure they think its just as stupid as you do.
    • dheera 9y ago
      This isn't a literal transcript of the conversation, more like what was going on in my head vs. what they said ;) Of course I was nice to them in explaining that I have a ton of virtual phone numbers and really don't know which one I used, etc.
    • lostmsu 9y ago
      I would not think CSR would actually know that phone is not a secure channel. I bet they are taught it is.
      • dx034 9y ago
        It is still more secure than not using a second factor at all. Stealing a phone number is more work than not having to do it.
• drdaeman 9y ago
  2FA (including U2F and whatever else) has one big problem that this article fails to mention. And when 2FA is suggested, this really should be said explicitly. Users aren't warned enough about the fact that everything fails, and they will have to go through 2FA deactivation/account recovery process sooner or later. They must be really reminded to DO BACK UP the recovery code(s). With "back up" as in "keep not just somewhere, but where you can actually find it, when you'll need it". (But not in your password manager) This is true for SMS 2FA as well, but completely losing the number (as long as one's a paying customer) must be significantly less common than losing a device.
  • averagewall 9y ago
    This is what somehow doesn't get mentioned as much as security. It's a tradeoff between not getting hacked, not getting locked out by accident, and convenience. If you get locked out of Gmail, you're up the creek. Google won't help. It's just gone forever. Having 2 factors increases the chance that you'll lock yourself out. If you've got two, then you really need 4: 1) Password 2) 2FA 3) Backup codes for when you lose the 2FA device/number 4) Phone number or email address for password recovery when you forget your password. Not the same number as 2 of course.
  • jeffwilcox 9y ago
    So true! We have thousands of employees at our company using GitHub.com, and every week someone loses access to their account permanently. Why? They never bothered to store the original recovery codes for the account.
• legohead 9y ago
  I read a blog where someone got hacked through a simcard clone, and they went into the details of how easy it was to do. This prompted me to enable 2fa on everything I could, but the funny thing is, a lot of the backup options for 2fa is -- you guessed it -- your cell phone number. Some of them don't even allow you not to use your cell phone as a backup. I think Github and Slack are like this, but I may be wrong, it has been a while since I turned them on.
  • jeffwilcox 9y ago
    With GitHub the SMS backup option is just a secondary choice, not required. A UbiKey or similar device or just storing the recovery codes + using an app is the best route in that one.
  • pascalxus 9y ago
    The most important thing is: DONT use your telco phone number in any of your sensitive accounts. Replace that phone number with a Secure phone number: the article recommends using Google Voice -> since this can't be compromised in the same way that a telco phone # can be.
• itslennysfault 9y ago
  I'm SHOCKED this wasn't a thing earlier. Spoofing a phone number is insanely easy. When I was in High School we figured out how to do it and used to prank call people from other peoples numbers. Eventually, we realized that if you call someone's cell from their own number it takes you directly into the voicemail admin menu. Fun times.
  • gambiting 9y ago
    That's a bit different than receiving text messages aimed at a different number.
• sna1l 9y ago
  Does anyone know if Project Fi provides any extra layers of security? I haven't seen anything
  • Yhippa 9y ago
    If anything the ability to get texts via the web makes it worse.
    • BrandonLive 9y ago
      How so? By which I mean... I think that doesn't make any sense but please elaborate.
• flurdy 9y ago
  So 2FA reset via SMS is bad, which I agree but what are the alternatives to prevent a meltdown when your 2FA device dies? I have had two phones die on me that was my 2FA device, plus OS upgrades, so I have gone through resetting 10-20 2FA accounts a few times. Though with upgrades usually I foresaw that and downgraded my 2FA before hand. All I wish for was that resetting 2FA would be a very very slow step by step process and spammingly broadcasted to all emails, sms, postal etc associated with the account. But I know for cost cutting customer services departments that wont happen.
  • prebrov 9y ago
    I use 2FA code generator in cloud-synced 1Password. That endures all software upgrades, unlike Google Authenticator or Authy.
    • clebio 9y ago
      TIL. Thank you.
    • kgilpin 9y ago
      If all this information is in 1Password then I guess you are back down to one factor - your 1Password master password. Which may be ok with you. Just pointing it out.
    • Shank 9y ago
      If you use an Android phone that's rooted, you can use Titanium Backup to copy your Google Authenticator app data between devices. It's up to you to copy that data somewhere else, but it is a very low level alternative to storing everything in 1Password or similar.
      • davchana 9y ago
        Even without rooting, just do that that next time when you register for 2FA, save that QR image, or screenshot it, and/or save that 16+ chars string somewhere safe, same as where you save passwords. Phone died/changed/lost? Install Google Auth, rescan that QR/Screenshot.
• chrisper 9y ago
  The issue I have with 2FA without sms is that I need to also take care of recovery codes. Basically, it's like erasing all the benefits of going digital, since now I have to store (and take care of) paper copies of recovery codes. If I use a 2FA app like the Google one and lose my phone, I need to have the codes ready. If I were to use my phone number, I kind of don't need that since I just get a new sim and a new phone. But at the same time that is not safe now. So what is the solution here? I liked the idea of something like DUO but not enough places use it.
  • Yhippa 9y ago
    You could try Authy. The restore is not immediate but it keeps track of the services you have set up for 2FA. Trusting a huge honeypot like that with your auth is up for debate.
  • laurencei 9y ago
    > If I use a 2FA app like the Google one and lose my phone, I need to have the codes ready. It is a trade off. You either want difficult access if you lose your phone (via printouts) - or you want quick access (via SMS). I dont think you can realistically have it both ways. Having a "slow" method to retrieve a major access to your accounts seems to be the safest method, especially when you are likely to rarely use your phone. You could also give a copy of the printouts to a family member or close friend, who you could ring if you were remote.
    • chrisper 9y ago
      I guess you are right. It's not like I am using those codes all the time, so the inconvenience is tolerable.
• e79 9y ago
  You should also make sure providers like Google don't fall back to less secure account recovery methods. I blogged about this here, after I realized that I was still vulnerable even while using real 2FA: https://ericrafaloff.com/google-account-security-and-number-portability/ https://ericrafaloff.com/google-account-security-and-number-...
  • sillysaurus3 9y ago
    Regarding the $8k of bitcoin stolen (https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoin-in-15-minutes-with-verizon-and-coinbase-com-ba75fb8d0bac https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoi...), that's what you get for storing your coin in Coinbase or someone else's service. If you're not in control of your keys, you don't own the coins. This uncomfortable truth has a way of occasionally poking out, like that story.
• zkms 9y ago
  Years ago, when SMS 2FA first became a thing, I remember people familiar with telecom stuff pointing out SS7 vulnerabilities and porting/SIM takeover issues. People shouted them down and claimed that they were being too paranoid and exaggerating the risk, or that most people aren't attractive-enough targets for someone to dedicate so much effort for hacking their accounts (and that SMS 2FA was thus good enough for most people).
• rxdemon 9y ago
  isn't it old article ?
• devuo 9y ago
  Last year when I upgraded my phone I was amused — but mostly horrified — by how easily one could get a SIM card for my own phone number with less than a modicum of information on me. As I required to upgrade my Micro SIM to a Nano SIM, I went to one of my provider's shops and asked for a Nano SIM for phone number X. I was then asked to verbally confirm my name and address — and that's it. No ID card confirmation, no nothing. "Here you go sir, your new SIM card will be active within a few minutes. Can I help you with anything else?". What. the.
  • Shank 9y ago
    Last week I walked into a T-Mobile store and asked for a new SIM card to replace one I lost. I gave them the phone number and apparently an invalid pin (the sales rep verified that I gave him the wrong PIN). I asked if I should do something else to verify it was my account and nothing. They didn't ask for name, ID, or anything else, and they didn't charge me for the SIM card. I went home and popped it in and my account had clearly been transferred -- I didn't have to do any other activation steps or anything. Great customer service experience, but horrible security.
    • wapz 9y ago
      Your story reminds me of when I ordered a $200 video card from Staples ship to store. I went to the cashier and told them they should have a video card I ordered. They asked for my name and gave it to me (inside the shipping box so they didn't even know the contents). It's not as bad as getting your phone number stolen but it opened my eyes how easy it would be to "steal" a package.
      • pishpash 9y ago
        The problem with all these stories is that there is a physical interaction. Maybe there is a video or whatever, but for some reason people easily let their guard down when transaction is conducted in person.
        • averagewall 9y ago
• rxdemon 9y ago
  Old article ?
• cloudkj 9y ago
  Does this hack work on Google accounts? I just tried the "forgot password" feature there and as far as I can tell there's no way to actually complete a password reset with only a compromised phone number.
• avenoir 9y ago
  What is a good way to make these attacks more difficult? Would something like Yubikey work if it had more adoption?
• mathrawka 9y ago
  I highly suggest having at least 2 phone numbers, one that is your main number that you use and give out. The others are kept private and never for calls or texts, but only for 2FA.
  • knodi 9y ago
    I did this with TMobile when they had get 3 lines and get 4th free. I use the 4th free line as my 2FA. The 2FA line is an old android phone and is always plugged in & on in my basement. I have a little script on the phone that reports any SMS messages a db running on my home server (RPi) and I access it with in my network (or via VPN).
• deleted 9y ago
  [deleted]
• unlmtd 9y ago
  Iv been telling people not to use phones forever.
• seanieb 9y ago
  Has anyone tried suing a Telco that's given away access to their phone account?
• Keverw 9y ago
  It's insane how much easier it is to transfer a phone number than a domain name. I also find it odd Facebook, and other sites will let you signup solely with a phone number. There's prepaid cell phone providers that recycle phone numbers, etc. Just seems so stupid to rely on a phone number for authentication alone, but two factor I'm okay with since you still need to know the password. Twitter has a developer product where you can be texted a code to login using only a phone number, which to me just seems wrong to do. It'd be nice if trying to port a number, change important info, etc if they had to actually call you or text you first to confirm. But one of the problems is people will lose their phones, and need a new sim or phone... That I think I'd have a requirement to actually visit the store - but that doesn't work to well with prepaid phone providers without physical stores selling via other stores like Walmart, Target, etc. Maybe in that case without nearby stores, partner with your retailers to verify ID or fax a ID in.
  • plttn 9y ago
    I can't speak for whether or not Facebook is doing it, but the carrier of the number is usually a determining factor on whether or not an arbitrary line is allowed for registration.
  • Broken_Hippo 9y ago
    "There's prepaid cell phone providers that recycle phone numbers, etc. " This isn't limited to prepaid phone companies or even cell phones. This practice has gone on for years. (I worked at GTE/Verizon around the time of the merger). My understanding is that the bigger issue is that it is fairly easy to run out of phone numbers if we never repeat. If I remember correctly, most hold the number unused for 3-6 month and fewer folks change now since they can port numbers to a new company at times, if the company that owns the number allows for it. (Yes, the phone company at least used to own the number).
• KGIII 9y ago
  Test
• addcn 9y ago
  Wouldn't the easiest solution be to use a landline and use the call options for 2f? Physical access to my home is root access
  • pugworthy 9y ago
    What is this land line thing you speak of?
• pascalxus 9y ago
  So, I've read the article a couple of times, It's pretty long. For those of you looking to get the most bang for your buck, I think the following advice is Golden: 1. Do NOT secure your sensitive accounts (facebook, primary email, bank accounts, twitter, etc) with your telco phone #. Telco Phone number is NOT secure! "Create a brand new Gmail email account. Do not connect it to any of your existing email accounts. (When signing up for a new Gmail, you don’t need to enter a phone number or current email, although there are fields for you to do so. Leave them blank.) Once you’ve created the new island-unto-itself email address, create a new Google Voice number." Use this Google Voice # to secure your primary accounts, and don't have your telco # listed in any of those accounts. But, make sure your New Gmail account is super secure, with a security key, as mentioned in the article. 2. Check the password recovery methods for all your sensitive accounts and make sure the answers aren't duplicated from any other site. Actually, it's best to remove them, if you can. If any security experts want to chime in, please do.
  • txmx2000 9y ago
    Or use a Google Voice number to setup 2FA on the same account. That way you can only ever login if you have a device on your person already logged in. If somehow you're away from technology long enough that all your devices are locked, use a printed backup code to unlock one.
    • pascalxus 9y ago
      But, if you use Google Voice number on your other Gmail account, they say it's not recommended because you can get locked out of both. I think you can use Google Voice number on everything other than your main Gmail account. So, to be extra safe, after you've set up your 2FA for gmail, make sure to change your recovery phone # to something other than your main telco or google voice number.
      • deleted 9y ago
        [deleted]
      • txmx2000 9y ago
• ganwar 9y ago
  This sort of attacks have been happening for over 5 months in crypto. Kraken published a highly useful blog post on it. Do give it a read. http://blog.kraken.com/post/153209105847/security-advisory-mobile-phones http://blog.kraken.com/post/153209105847/security-advisory-m...
• buyx 9y ago
  These attacks have been going on for at least a decade in South Africa. The fact that it's still going on, and if the coverage is to be believed, spreading globally, is a pretty shocking indictment of the industry. I wonder what other scams are being incubated in lesser-known parts of the world, that are waiting to be unleashed.
• galfarragem 9y ago
  Resuming: what's the simplest solution to at least reduce risk? Is it to get a second phone number just for banking?
• dhruvrrp 9y ago
  A couple of years ago i got a new phone which used mini sim instead of the micro sim that my older phone used. So i went to an AT&T store to get it and the rep asks for my name and my phone number and 5 minutes later comes back with a new sim saying it'll activate my noon the next day. There was no authentication at all. Literally anyone could have walked in gave my name and phone no and would have gained access to my phone. I stopped using my phone for 2FA since then.
• kraig911 9y ago
  Security while we all say is super important will never be important until people doing the customer service actually care. When my identity was stolen 20 years ago it was a nightmare involving writing letters to a postbox and getting form letters in return... doing to the police, the banks, and the utilities and being treated like an idiot because I filled out a rental application that someone used to get credit cards is a nightmare that still follows me to this day. It's as if all forms of customer service needs to go through a third party.
  • Dowwie 9y ago
    "It's as if all forms of customer service needs to go through a third party." .. and therein lies opportunity for the tech-preneurs
• EZ-E 9y ago
  This kind of attacks could lead to total disasters in China where the standard is to login and register solely on a phone number using a confirmation text. In China your phone number is pretty much as valuable as all your password combined, all services are solely linked to it. Even though phone companies ask for id before issuing a SIM card, I'm pretty sure a tiny bribe is enough to get past most store clerks
  • averagewall 9y ago
    ID isn't just for security, it's so the police can track you. So they'll be putting pressure on phone companies to do it thoroughly. They take a copy of my passport when I get a SIM card. Probably not going to bribe them into leave missing documentation on your file. They could easily be caught by their boss at any time in the future.
  • jackvalentine 9y ago
    Or do what I do every time I visit China - just buy a SIM from some dudes cart by the side of the road. He doesn't care who you are.
• theprop 9y ago
  Wow! What's the easiest way to stop this kind of attack? Stop all two-factor authentication?
• ww520 9y ago
  5 or 6 years ago, my phone number got ported by someone else without my knowing. My phone suddenly didn't work anymore. I called into AT&T right the way to ask what's going on and they said someone has "took over billing" from my account and AT&T transferred the number over. WTF? I was adamant to get the number back since that's the number I give it out to people. They won't bungle saying it's out of their hand. Finally they said they could place the number into the free pool for re-allocation which would freeze it for 3 months before it could be used again. I was concerned it could be used as a vector against my bank accounts. It was a nightmare.
  • daemin 9y ago
    So basically as long as a hacker wouldn't mind paying your phone bill for a month they could easily take over billing of it, then clean your accounts out, then cancel the number. This is another one of those messy human areas where computer systems are either too strict or not strict enough.
• tbrock 9y ago
  Great. Now that we've succeeded in compiling a list of personal sad stories to one up one another, why not not discuss how we could encourage the banks / phone companies to make this situation impossible. 1) Ban SMS as a second factor for high risk targets like banks. 2) Telecom companies should require social security number or uniquely identifying information to provide account access. 3) ???
  • dcosson 9y ago
    > 1) Ban SMS as a second factor for high risk targets like banks. As others have pointed out, if it were just a second factor they would also need your password. SMS is being used for full account recovery, so as a single factor. > 2) Telecom companies should require social security number This is exactly what we should not be doing. I would like it to be harder to steal my identity than getting a 9-digit number, which can never be rotated, and which I am required to provide in plaintext to many different people in many different situations (renting an apartment, opening a credit card, etc.). To make matters even worse, up to the first 5 digits of an SSN can be easily guessed if you know the person's age and birthplace, and the last 4 digits are used even more haphazardly than the entire number is (e.g. sometimes the last 4 are displayed in plaintext on a website while the first 5 are starred out).
  • bumblebeard 9y ago
    Some kind of cryptographic challenge-response system might be a good solution but I don't know how to get your average computer user and customer support rep to use a system like that. All the ones I can think of are designed for computers to talk to each other so they aren't very user friendly. Is there something like Kerberos but for humans?
  • daemin 9y ago
    As I have commented elsewhere for this article, there are other countries which require and record ID for every phone number and sim. I see this as more of a control issue (from the Government perspective) since it won't be used by customer service staff for security.
• adventured 9y ago
  Anyone here happen to know how hard it is to steal a Twilio number as compared to a number issued by eg T-Mobile or Verizon? Is the only way to do so, by accessing the Twilio account that controls the number (whether directly or by API)?
• santzeshn 9y ago
  A few months back I lost my phone, so I went to my operator with passport to get new sim with my old number (in Thailand) . She said the sim isn't actually in my name but my ex-girlfriend's, and I told I remember I took the sim with her id as I didn't carry my passport with me, so I guess there's nothing I can do. She just replied well we could change the sim to your name, didn't even check with the original owner and 5 minutes later I was on my way with new sim.
• pseud0r 9y ago
  Where I live you need a copy of your passport to port a number, in addition the new sim can only be sent to your government registered address, I think that would be quite hard to game. Even so, hackers can still use SS7 to hijack phone numbers.
  • disiplus 9y ago
    SS7 is harder to obtain and alot of good operators have now protectons for hiacking via SS7.
• TimMurnaghan 9y ago
  Too many Forbes articles. They're months behind on this story and have an aggressive anti-adblock so I'd rather not see stories from them.
• theoracle101 9y ago
  "If you follow several of the steps I outline in this story (unless you go with Google Voice), you’ll end up with at least three email addresses: your current primary one, one just for your mobile carrier, and one that you use for other sensitive accounts such as online banking or Facebook or Dropbox." Why not just have all sites that require SMS 2FA (there are a lot, including tele co.s) be directed to a personal google voice number? And also remove the any SMS 2FA from this google and your personal? Wouldn't that solve the issue they are suggesting? Why do you need a third account?
• dustinmoris 9y ago
  BREAKING NEWS: Hackers are hacking! Great article -.-
  • slerslors 9y ago
    This is what I thought as well.
• z29LiTp5qUC30n 9y ago
  I am surprised no one here mentioned mooltipass https://www.themooltipass.com/ https://www.themooltipass.com/
  • Anarch157a 9y ago
    It's another gadget to carry arround, and if you lose it or forget it somewhere, you're SOL. Better have a KeePass2 database on your phone synced to a cloud storage. Even if the cloud account is compromised, without the KeePass password, your credentials should be safe. If you need, you can open the database using a webapp in any browser.
• konceptz 9y ago
  Take a modified attackers point of view. Could you convince a cell phone store rep that you are who you say you are without your drivers license? Or, for a million bucks, could you make a cell phone store rep think you were someone else? The answer is why SMS 2fa isn't such a great idea. Because your security checkpoint is owned by a (underpaid) store representative.
• leke 9y ago
  Articles like this ramp up my paranoia, especially since I got a phone call from the UK three days ago. Nobody on the other end. Hung up after saying hello three times. Never heard back since. It has me worried, especially since I just came back from my holidays (not in the UK).
• yladiz 9y ago
  Can anyone recommend a US based bank (or a bank that accepts US customers) that 1) has either a 2FA token for phone e.g. with Google Authenticator, a hardware token, or some kind of other token based factor; and 2) has strong security when calling? I generally don't need a physical presence. My current two banks don't have direct 2FA enabled. As far as I remember, the questions available to one of my banks (credit union) are simple enough that you could probably find out by doing a public info search somewhere, and the other bank (Chase) has SMS 2fa, but outside of that it's just public database questions (I know this because I had my card number stolen recently, I currently don't have access to my phone as I'm out of the country, and they asked me a few different questions from a public database, like if I had ever lived at ABC Dr., do you know this person, and what is the full name, etc.). I'd much rather be able to give the banks some kind of information that they are required to verify before they can access my account, like a verbal passphrase, but I don't think that's possible (as in, I wouldn't be able to access my account over the phone without the passphrase).
  • mackncheesiest 9y ago
    I know that USAA offers TOTP 2FA. Not sure about calling though.
    • yladiz 9y ago
      Sadly, USAA is only open to military service members and their kids. That would be my choice if I could use it.
      • sowbug 9y ago
        Not true. They offer insurance only to military families. Banking is open to anyone. EDIT: This is no longer true as of 2013.
        • yladiz 9y ago
          Are you sure? At the link listed below, it seems that it's only available for military. https://www.usaa.com/join/start/?productId=bank-checking-classic https://www.usaa.com/join/start/?productId=bank-checking-cla...
• ziikutv 9y ago
  What's funny is... my Bank does not allow me to use any special characters and for the investor accounts numerical only. They do not have 2FA either. CIBC Canada Addendum also several of my purchases were flagged as hacked purchases by them and I had to call them three times so far this year. All purchases from same Amazon account, same IP too. So I do not think they have a good services team.
• CWuestefeld 9y ago
  A few weeks ago I was vacationing in Big Bend National Park, which is in a remote corner of Texas. When trying to pay for our breakfast, my credit card was declined. On the phone with them, they said the card had been flagged as being used in fraud because we were off in the middle of nowhere, away from our normal spending patterns. The ONLY way to reactivate the card is for the CC company to SMS text us with a code, which we have to read back to them. The thing is, the very reason they flagged us - that we were way off in the middle of nowhere - also meant that we had no cell phone service, and couldn't receive the SMS. And given the vast size of Big Bend (getting out of the park from the hotel is a 45 minute drive), it was questionable if I'd be able to drive to a location with cell service if I couldn't fill my gas tank first. The hotel manager overheard me arguing on the payphone with the credit card company, and he drew me a map of some pockets of cell service within the park, so in the end I was able to get it taken care of. One ironic part of this was that the card is in my wife's name. When they wouldn't listen to her, she gave them verbal authorization to talk to me in her stead. They were willing to believe her identity for this, but not for the re-activation of the card, which doesn't make sense. I also asked their CSR why they flagged the card. They said that I should always notify them if I'm going away. I asked them what the criteria is for that, since this was an in-state trip (I live in Austin, and Big Bend is also in Texas). The CSR said that's odd, and he doesn't know why that would happen. So good for them that they watch for fraud, but the failure mode for their heuristic is the most catastrophic possible. If the very reason they flag me also prevents me from fixing the problem, then it's a rather badly-designed system.
  • binarymax 9y ago
    This used to happen to me all the time with Lloyds "Worldwide Service". When I would travel, I would tell them ahead of time where and when, and inevitably the first time I used my card in another country it was declined and I'd need to call in to card security and clear it. Mind you this would cost a couple quid due to the overseas use of my phone. These weren't exotic locations either, it would happen in NYC. Then one time to me it happened when I was exhausted after a very long flight, trying to check into a hotel. I got on the phone with them, sternly told them the history of events and the situation, and demanded to be compensated for the time and hassle otherwise I would switch banks. I pointed out their bank was misnamed "Worldwide Service". They put £100 in my account, and the problem seemed to go away after that point (I still needed to inform them ahead of time, but that did the trick).
• tracked24x7 9y ago
  "Locksmiths Are Breaking into Bank Safes"
• exabrial 9y ago
  Companies are calling it "two factor authentication", which it is not. Please, hn, don't promote sms 'authentication' at your jobs. TOTP is easy to implement and not never difficult for users to understand.
• bit_logic 9y ago
  It seems a simple solution would be for the phone company to send a confirmation SMS or automated voice call to confirm number porting or any other major action. Is there a reason they don't do this? It seems like a good balance between convenience and security.
  • dazmax 9y ago
    There was this recent case showing how not to do this feature. https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoin-in-15-minutes-with-verizon-and-coinbase-com-ba75fb8d0bac https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoi...
• maherbeg 9y ago
  Someone should write a comprehensive guide on how to protect your accounts while preventing yourself from being locked out of said accounts. Seems like some combination of the following: * using Google Voice for all account recovery situations that require a phone number * Calling your cell phone provider to have a note that states do not allow for number porting * Use hardware 2fa tokens. Have two setup, one as a backup in case you lose one. * Keep a copy of your recovery codes somewhere accessible * Probably have a safety deposit box with your backup 2fa token and recovery codes stored. * Primary email provider should use a hardware token and not have sms recovery * Use unique passwords everywhere and use a password manager
  • deleted 9y ago
    [deleted]
• sr2 9y ago
  Seems pretty silly putting any form of security apparatus into a technology which could possibly have been engineered from the ground up to be SIGINT-enabled. It's as if GSM was deliberately designed by the intelligence community to be available for eavesdropping. They build the protocol with just enough good security that Johhny can't intercept his wife's calls to check for cheating, but with enough bad security that intelligence services (and sophisticated criminals) can play Mallory[0] [0]: https://en.wikipedia.org/wiki/Alice_and_Bob#Cast_of_characters https://en.wikipedia.org/wiki/Alice_and_Bob#Cast_of_characte...
• leighmon 9y ago
  Take a look at the article by Cody Brown regarding his coinbase account being drained of ETH and BTC due to the same fundamental problem: way too easy to steal someone's phone number.
• ossguy 9y ago
  I've noticed a number of people using https://jmp.chat/ https://jmp.chat/ to get a second number for 2FA. It supports most of the short codes companies use for 2FA, but it doesn't require you have a Google account (or even an existing phone number).
• Osiris 9y ago
  For 2FA I like how Microsoft does it. You have an app on your phone. When they need to authorize you, they push to the all and it automatically pops up with approve and decline buttons. You verify the code is the same on the phone and screen and hit approve. It's an easier workflow than having to open Google authenticator, find the code, and enter it.
  • bhhaskin 9y ago
    Google is starting to do this as well. You get a push notification instead of entering the code.
• SkyMarshal 9y ago
  Worth reposting Kraken's mobile phone security advisory: http://blog.kraken.com/post/153209105847/security-advisory-mobile-phones http://blog.kraken.com/post/153209105847/security-advisory-m...
• homakov 9y ago
  Or just ask them all to implement decentralized SecureLogin.
• hobarrera 9y ago
  If I want to change my number to a new SIM, my telco requires me to log in, and fill in a form. If I forgot my password their email it to me. They don't have any offices open to the public, nor any hotline, and are really the cheapest alternative where I live, but it seems that their attempts to save money have resulted in them ending up with a securer infrastructure than some notorious ones from very advanced countries.
• Hackertrogan1 9y ago
  do you want to hire a hacker and dont know who to hire. i( TROGAN HACKER) was voted the best hacker in the whole of united state 2015. contact me today for various types on hacking ( criminal records cleaning ... exam score up grade... social media hack... email hack and so on) EMAIL: trogan_virus@gmx.com WHATSAPP: +1(209)5530511 TROGAN, New York,USA