3 ms·
I assume that the attacker did one of two things: either they were somehow cloning the SMS messages so they came to both the customer's phone and to them, or th
by URSpider94 9y ago
I assume that the attacker did one of two things: either they were somehow cloning the SMS messages so they came to both the customer's phone and to them, or they jumped the gun on an SMS redirect they had set up and the first TFA got sent to the customer; they then retried later and got the message on their channel.
The logical fallacy in your answer is in assuming that, just because the customer got an SMS with a TFA code, an attacker did not get the same or subsequent code and use it. We don't know that.
Of course, it's also possible that Uber's TFA is broken ...
- Bartweiss 9y agoI had been assuming that cloning was very unlikely, yeah. It seems substantially harder than actual redirection or capture would be. But honestly, I hadn't considered the possibility that they triggered an SMS and then got access later, maybe with a second (rerouted) SMS. That's a good point.