10 ms·
A privacy flaw in Comcast's automated telephone system
- ryanlol 9y agoPfft, boring stuff. Comcast will let anyone get your home address, name, last 4 digits of SSN with just your IP address!
- goldenkey 9y agoThere was a thread here recently about how it costs 10 bucks to rent out a cellular tower in Malaysia and co-opt a cell phone number as roaming, in order to defeat SMS security 2FA. Experts on HN were saying that the trunk level protocols for cell phone numbers are pretty much worthless when it comes to security. Their conclusion was that: security in this world is so poor that you might as well live with the assumption that there is no real security for public services.
- lotsofpulp 9y agoIt's ludicrous to me that many services, especially financial, go through the trouble of setting up SMS 2 factor, but not TOTP.
- gm-conspiracy 9y agoI have a friend that was at the beach with her husband, and she had taken her phone with her, but her husband left his in the car. Thieves had used a jammer/replay device to unlock their car, remove her husband's phone from his Otterbox case, take his SIM card, reassemble the phone, and steal several credit cards from his wallet (also in the car). Within the hour, my friend began receiving fraud alerts. If she had not taken her phone with her, they would not have known for quite a few hours, at least.
- fyfy18 9y agoDo you have happen to have a link?
- exikyut 9y agohttps://hn.algolia.com/?query=tower%20malaysia&sort=byPopularity&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=tower%20malaysia&sort=byPopula...
- goldenkey 9y agoI think this was it: https://news.ycombinator.com/item?id=16771649 https://news.ycombinator.com/item?id=16771649
- BlackLotus89 9y ago> Making matters worse, if you then pay the bill on someone else's account, the system prompts you to add yourself as an authorized user and requests the callers phone number, potentially granting them full access to your account. Uhm yeah sure boring stuff. Can I have your phone number?
- amelius 9y ago> Comcast will let anyone get your home address, name, last 4 digits of SSN with just your IP address! IP address? Really?
- ryanlol 9y agoYes, really. Of course they are nice enough to support multiple methods of searching for accounts, so you aren’t restricted to just looking up by IP addresses.
- MobutuPehuenche 9y agoThat's not amenable to bulk, automated harvesting however, unless you've compromised their internal network.
- htgb 9y agoIf I read this correctly, you have to spoof the telephone number in order to get the address, and you only get it read out loud so automation isn't trivial. To me, it doesn't feel like a big deal, but that might be because in Sweden, everyone's [1] addresses are freely available and searchable online, given for example name or telephone number. See [2] and [3] for example. So are telephone numbers and addresses considered very private in the US? Some comments in the Reddit thread suggest security bounties etc. [1] Unless you have a protected identity. [2] https://www.eniro.se/ https://www.eniro.se/ [3] https://www.hitta.se/ https://www.hitta.se/
- p49k 9y agoIt’s pretty trivial to spoof caller ID though; there is basically zero security that prevents it from happening and many apps that make it easy.
- diggan 9y agoI'm swedish as well, and explaining this to my wife from Peru was a fun experience. The rest of the world is not as open with neither address information or salary information as Sweden is. If this is good or bad, I'm not sure but it saved me in a number of situations to be able to search for someone's number via a public website. Keep in mind that the social number in USA is apparently also supposed to be secret (like a password) which sounds absolutely crazy to me.
- htgb 9y agoYeah, I suppose that's right. And as you say, it's very practical. > Keep in mind that the social number in USA is apparently also supposed to be secret (like a password) which sounds absolutely crazy to me. That's very true, reminds me of this video [1] by CGP Grey, giving some background of the issue. [1] https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus
- deleted 9y ago[deleted]
- ryanlol 9y ago
- coinerone 9y agoRemember the Time when you just look for an Adress in a Telephonebook?
- p49k 9y agoYou could always opt out of the white pages. Not the case here.
- gm-conspiracy 9y agoTo be a dick, you don't have to be a Comcast customer, either.
- cptskippy 9y agoI recall once when a storm knocked down the cable lines in my neighbor's yard. He called Comcast to report the downed line however he wasn't a customer but some how got an appointment to come out on my account. I received a call confirming the appointment time the day it was set to happen. Aother interesting quirk of their system is that if you ever contact them about your account, whatever phone number you use to contact them is automatically added to their CRM system and associated with your account. That phone number is not shown on your account though if you login to check. I know this because I received a marketing call at my Office Desk Phone regarding my home account. The agent asked for me by name and then said something like "hi, I was calling to discuss your account that services <my address>". I logged into my Account on their website and verified that my office phone number was not associated with my account. Then I interrupted their script to ask how they got the number and they said that it was associated with my account.
- exabrial 9y agoReally could be entitled: "^A(?nother)? ?(?/w.+ )?flaw in Comcast.*$"