10 ms·
Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M
- axaxs 8y agoI hope he wins, mainly so cell operators will perhaps take security more seriously. Not long ago, I was with T-Mobile. My username was my phone number, and the password, you could request and they'd send it to you in an email. With the climb of social media, our phone numbers are more a part of our identity than ever before, and carriers lack of security is being thrust into the spotlight.
- codegeek 8y agoAre you saying that they will send the password to ANY email if you just provide the phone number ?
- thaumaturgy 8y agoI read that as him saying that T-Mobile belongs on http://plaintextoffenders.com/ http://plaintextoffenders.com/
- axaxs 8y agoOther poster is correct, sorry if it wasn't clear. Essentially, they were storing passwords either in plaintext or a reversable encryption scheme. Now, this was a few years ago, so I don't know the current setup, but not so far back that not storing plaintext passwords wasn't common knowledge...
- wild_preference 8y agoExactly. I was able to get into my Verizon account at the store by showing the sales guy my number on my phone. I was moving my number to my non-work billing account. When I was surprised that this is all the authn they needed, the sales guy joked with the rhetorical question “well, you are <my name>, right?” i.e. “well, it ain’t a problem at the moment, right?”
- tantalor 8y agoI hope he loses, so financial services will stop supporting 2FA over SMS. Is that more or less likely than SMS providers fixing their security?
- rubatuga 8y agoHow about he wins, and then we slowly wean off a more secure SMS system for everybody?
- aeternus 8y agoThere are plenty of secure messaging services out there. Making one that works for everyone is not a trivial problem. Suppose you own a coffee shop and offer free wifi, should you be held responsible if someone logs into a bank without SSL and gets their credentials sniffed? Should you be responsible for designing a wifi protocol that uniquely encrypts the traffic of each user, without shared keys, to prevent sniffing?
- ghouse 8y ago2FA isn't _this_ problem. It's password resets via SMS that are the problem here.
- LyndsySimon 8y agoSMS is 2FA. I'm sure you mean TOTP, but it's an important distinction to make. All 2FA isn't created equal.
- tinco 8y agosms password resets are not 2fa. 2fa means you have two factors of authentication. If the only thing you need to authenticate is control over a phone number, then that's just one factor. Two factor authentication is when you need both a password and an SMS token, like how GitHub does it. I'm not saying SMS 2fa is strong enough, often passwords are weak and/or weakly guarded, and ostensibly phone numbers can be fidgeted with. But having a phone number be the only thing guarding your entire identity is a whole next level of weak.
- slg 8y agoIn my opinion "take security more seriously" is too nebulous to be constructive here. What do we want these companies to do? Security is an incredibly hard problem. It is only exacerbated when we go years without speaking with one of these companies. Anything that you have to remember in that time whether it is a password, pin code, or "who was your childhood hero" type security questions can all be forgotten. How else is this company supposed to identify you over the phone, without something that can be forgotten, without referencing easy to find public information, and without using a secondary verified contact method like email?
- mikeash 8y agoIs there an absolute requirement to be able to demonstrate your identity over the phone even if you have no secret information with which to confirm it? How about, if you forget your password and can’t get into your account, you need to visit a store in person to show your ID, or mail in a notarized copy, or something like that?
- slg 8y agoRequiring customers to come to a store would basically exclude anyone from accessing their account outside the retail footprint of the company. That isn't realistic for companies that are trying to provide you a global service like most telecoms. It also introduces plenty of other problems. For example, if you are mugged on the street and lose your phone and wallet are you just frozen out of your mobile account until you can get to the DMV and wait the month until you get a new ID? It is a hard problem that can't just be fixed by "taking it seriously".
- mikeash 8y agoPhysical presence wouldn’t be required unless you forgot your credentials. If you are mugged and forgot your password, then you’d be screwed. I’m not sure how reasonable it is to try to make that particular situation better though.
- kodablah 8y ago
- redm 8y agoThere are of course two sides to every coin. The flip side is, cell carriers never signed up to be a secure identification mechanism. SMS wasn't designed for security, and there's little financial incentive for them to invest in those changes, i.e., they don't charge you more for secure authorization of 3rd party platforms. I think its very akin to the US Social Security Number being used as a 'secure' identification in many cases. I imagine a world where you go into the cell store, and they demand three forms of identification including a utility bill to talk to you. I can already hear the complaints from a much larger portion of their customer base.
- sdkmvx 8y agoI just want a world where you go into a cell store, and they don't tell you they've got a great idea, just make your PIN your birthdate. If they actually took part that seriously, most identification could be done with a PIN or a password or whatever and the serious identification could be reserved for people who've actually forgotten.
- ghaff 8y agoExactly. You can always debate specific security practices. But there's definitely a tradeoff between resistance to social engineering and related attacks on the one hand and convenience on the other hand. You give one example. It also applies when people lose the password for an account, no longer have access to their original or backup email, etc. The most secure thing to do is probably to tell the customer "tough." But that won't go over very well so account recovery practices get put in place that are probably susceptible to social engineering attacks.
- tonyztan 8y agoWhat if carriers created an "enhanced security mode," which users can opt-in to if they want more security and are okay with sacrificing convenience in case of account recovery? It would be similar to the account recovery aspect of Google's Advanced Protection Program: "A common way that hackers try to access your account is by impersonating you and pretending they have been locked out of your account. To give you the strongest protection against this type of fraudulent account access, Advanced Protection adds extra steps to verify your identity during the account recovery process. If you ever lose access to your account and both of your Security Keys, these added verification requirements will take a few days to restore access to your account."[1] [1] https://landing.google.com/advancedprotection https://landing.google.com/advancedprotection
- wowzerz 8y agoour phone numbers are more a part of our identity than ever before Okay, great idea: phone numbers are the new social security number. Oh but wait, not really. Not when I can set up a prepaid phone for $30. Or three for $90. Or what about office phones and VOIP services that accept text messages on office desktop phones. Or virtual services like twilio, and on and on. Yeah, not really. Phones aren’t quite anyone’s identity at all. Don’t pretend like the world is so beholden to some AOL homepage instagram vanity account, signed up with a free email address.
- bdcravens 8y agoTwo things that jump out: 1) $200M in punitive damages? The hack occurred in January, and the price has gone down across all cryptocurrencies substantially since then. 2) Was the password hacked? Or did the exchange allow password resets via SMS? (So negligence made 2fa really 1fa) In this situation it seems AT&T would be at most 50% responsible.
- wp381640 8y ago> AT&T would be at most 50% responsible You could reduce that further by arguing AT&T aren't at fault because third-parties built authentication and identity protocols ontop of what was never guaranteed to be a secure or authenticated channel
- bdcravens 8y agoGiven that the NIST published guidance in 2016 recommending it not be used for 2FA, I agree with you. That's why I said "at most" :-)
- s73v3r_ 8y agoAnd then increase it again by arguing that AT&T should never have made it possible for employees to do this.
- evgen 8y agoAnd then diminish it to zero again because yes it should be possible for employees to do that. The economic value for most people of being locked out of your phone number and not being able to easily fix the problem or easily upgrade a phone exceeds the cost imposed when some of those people are morons and assume ability to receive an SMS message sent to a particular phone number is any sort of security factor.
- s73v3r_ 8y ago"And then diminish it to zero again because yes it should be possible for employees to do that." Absolutely not. It never should be possible for a single employee to do that with no checks at all.
- bdcravens 8y agoIf Bank A makes my PIN number automatically the last 4 of my SSN, and Company B discloses that information, is Company B responsible for 9 times whatever losses I incur if my ATM is stolen?
- jklein11 8y agoSure.. you can sue for whatever you want. There is no guarantee that you will be awarded the damages though.
- bdcravens 8y agoThat was my literal question, yes :-) I'll reword it to be match what I was trying to say.
- digitaLandscape 8y agoThis kind-of comment would have been clever in elementary school. Here, you're just being a dick.
- jklein11 8y agoSorry I really wasn't trying to be a dick here. The original post asked whether one party could sue instead of being responsible. It is possible that this is why my post seems childish. The point I was trying to make was about conflating the damages being sought in a lawsuit by one party and the actual damages owed by other other in a lawsuit. I think it is pretty common practice for the plaintiff pick a high number out of somewhat thin air to prevent themselves from pricing themselves from leaving money on the table.
- wolfgke 8y ago> If Bank A makes my PIN number automatically the last 4 of my SSN, and Company B discloses that information By Kerckhoffs's principle > https://en.wikipedia.org/w/index.php?title=Kerckhoffs%27s_principle&oldid=844528755 https://en.wikipedia.org/w/index.php?title=Kerckhoffs%27s_pr... a cryptosystem has to stay secure even if everything about the system, except the key, is public knowledge. So Bank A is at fault, because it neglected basic guiding principles for designing security systems.
- markovbot 8y agoI hope we see more of this. A lot more. These fuckers need to hurt.
- asdfman123 8y agoWho, phone companies or cryptocurrency investors?
- m-i-l 8y agoSorry for his loss, and the mobile providers do need to do something about this known attack vector. But with cryptocurrencies you need to "be you own bank", and extending his own analogy how many legitimate or long lasting banks would store USD24 million in cash in a hotel room safe?
- kodablah 8y agoFollowing this analogy, would the bank sue the builder or vault manufacturer if they gave someone a key to the vault without the bank's knowledge and it was used to rob the vault? Or might the bank sue a armored carrier for irresponsibly storing monies that were stolen in transit between banks? Maybe you can be your own bank, but banks have to depend on external factors/entities to do what they're supposed to do as well.
- m-i-l 8y agoSeems reasonable, because bank vaults and armoured vehicles are designed specifically for protecting high value items. Hotel room safes on the other hand are not (in fact some even have a disclaimer advising you not to store valuables in them).
- jmull 8y agoPhone numbers are specifically designed to serve as public identifiers. I don't think you can expect a security mechanism that is supposed to work counter to that to work very well.
- closeparen 8y agoThe validation mechanism is control over the phone number, not knowledge of it. Verification by knowledge of numbers intended to remain secret (social security, credit card) is also never okay.
- jmull 8y agoI'm going by the content of the story, which describes acquiring the phone number as the key issue. > After the first hack, Terpin alleged that an impostor was able to get his phone number from an "insider cooperating with the hacker" without an AT&T store employee requiring him to show valid identification or provide a required password. That phone number was later used to access Terpin's cryptocurrency accounts, according to the complaint.
- closeparen 8y ago“Acquiring the phone number” means getting it mapped to the attacker’s phone/SIM card. Overview of SMS hijacking (copy paste link, JWZ doesn’t line HN referrer headers): https://www.jwz.org/blog/2018/07/two-factor-auth-and-sms-hijacking/ https://www.jwz.org/blog/2018/07/two-factor-auth-and-sms-hij...
- jmull 8y agoWhat you say must be the real story. It's just that the article says, "was able to get his phone number". Getting a phone number, to me, has always had a pretty universal meaning, which is to simply learn its digits. But I suppose you must be right and they actually mean a deeper compromise.
- nkrisc 8y agoAre there any phone companies that have decent security practices? As far as I can tell switching is pointless because they're all awful in this regard.
- thinkythought 8y agoMy snarky answer is use an MVNO that will both show up as the base carrier to any searching online/number lookups, and has completely useless clueless terrible support that either couldn't or wouldn't redirect like this. Assuming you even have to use SMS, get some weird walmart mobile service that you can't even really call for support. It's security through obscurity but they often literally wont let you port your number out without absurd gymnastics, the support people don't know how, their crappy web based management system the CSRs use doesn't have a button, etc.
- bubblethink 8y agoThat's the wrong question to ask. There are no financial institutions that have proper 2FA. I don't know of a single bank in the US that uses any standard 2FA. They all use SMS. Recently, I found that you can make paypal (US) use TOTP 2FA with a workaround. I recommend everyone to do that.
- stanleydrew 8y agoThere's not a lot of detail in the article, but reading between the lines it seems like an attacker went to an AT&T retail location and pretended to be the plaintiff in order to re-assign the plaintiff's phone number to a new SIM card.
- Nasrudith 8y agoMy first thought was "cryptocurrency is fundamentally not investment but speculation they don't create anything of value but squander vast ammounts. Second is that it is multileveled frustration that both phone systems are so damn insecure like the completely insecure call identification - while international efforts to track down telefraud rings are well and good a proper system would prevent most of their tricks.
- Arubis 8y agoFrom TFA: > Terpin was the victim of two hacks within seven months If indeed these were separate occurrences of breaking in through the same phone account—and the article is not definitive on this—then the punitive damages seem quite appropriate. “Fool me twice, shame on me,” and all that.
- lawlessone 8y agoI feel for him. But couldn't they reasonably argue they are not a service for securing this kind of thing? If i leave $224m in my car and park it in car park at my local shopping centre are they liable for $224m? I'm not saying they're not liable to some extent.
- paulpauper 8y agohe lost $24 million
- lawlessone 8y ago>Fund, is seeking $200 million in punitive damages and $24 million of compensatory damages from AT&T. OK that's even more crazy. I had assumed he lost 224.
- s73v3r_ 8y agoI could reasonably argue that they should not allow any employee to give out my details, such that they can intercept my messages, to anyone. And by allow, I mean even make it possible.
- ProAm 8y agoIt's more he parked it at the dealership, and the dealership made a stranger a spare key to get into the car.
- williamscales 8y agoEven more analogously in my opinion: someone walked into the dealer, said "hey, transfer the keyless entry for my car to this fob right here" and they did.
- NegativeK 8y agoOr that someone put out plastic-shell bike lockers, someone had a $224M stolen from one, and now they're pissed. I suspect that metaphors aren't going to really convey this well.
- shashanoid 8y ago> Have your own guy impersonate you and get your $24 million stolen > Sue At&T for $224 million > ??? > Profit
- NegativeK 8y ago> Go to jail for perjury. > Lose all profit.
- saas_sam 8y agoWasn't it like a year ago that famous YouTubers and such were getting their accounts stolen the exact same way and AT&T promised they would tighten up security measures?
- SurrealSoul 8y agoYes, you have to opt-in to this type of security
- adtac 8y agoOpt-in security is the best form of security, after security by obscurity /s
- sturgill 8y agoI prefer both options: opt-in by obscurity.
- loa-in-backup 8y agoSueing tge internet to force it to forget your number?
- village-idiot 8y agoI’m not sure if he has any legal recourse against AT&T, but it’s another example why sms based 2FA is a bad security scheme, especially if you’re a high value target.
- aviv 8y agoIn the US it is trivial to hijack any mobile number's SMS traffic. It takes less than a minute. SMS as 2FA should never ever be used by anyone.
- maym86 8y agoHow does it work? Why is it so easy?
- jeanlucas 8y agoSMS is not exactly the most secure protocol. But you do not need to use SMS for 2fa, that's a misconception.
- bena 8y agoIsn't it effectively plaintext? I don't know too much about the SMS protocol. But I do know that most protocols do start out plaintext because programmers are lazy and optimistic.
- village-idiot 8y agoThat’s one part of the problem. The other part is that it’s actually quite easy to convince most cell phone carriers to change the SIM card associated with a given phone number. Once you’ve pulled that off hijacking the account is easy.
- marcosdumay 8y agoIt's not exactly plaintext. Last time I saw it was using broken crypto (may have changed since then, but I doubt it), and it encrypts the data hop by hop, so that if you insert yourself as a hop, you'll just have decrypt (with your keys), read and encrypt it.
- onetimemanytime 8y agoPublicity and tens of millions in Bitcoin /Ethereum++ is a bad idea. Especially since once it's gone it's gone. Hacking your account means FU money and then some, with less chance of getting caught than other crimes. So they have all the incentive in the world to take heir sweet time...even if they lost 50% laundering, it's still more than enough. I'm all for At&t to be held responsible if they broke security protocols. They charge an arm and a leg
- tessi3r 8y agoHaving any serious amount of money and being showy or grandiose about it is asking for trouble... Only rich morons actually need armed security as a result of their social media habits emanating from a pathetically desperate ego.
- coding123 8y agoWhat kinda crappy ass crypto wallet would break if you had access to a cell phone account.
- perl4ever 8y agoI notice AT&T is quoted as saying "we dispute these allegations and look forward to presenting our case in court". It's interesting they didn't say "these allegations are baseless and without merit". I wonder if that means anything.
- cjslep 8y agoA "baseless allegation" is one with no evidence or reason. This guy has a reason and presumably evidence, so his allegations are not baseless. A baseless allegation would be if I were suing AT&T for losing all my crypto investments. I have none and am not an AT&T customer. An "allegation without merit" means no rational interpretation of the law would result in a guilty conviction of the allegations. Baseless ones are almost always without merit.
- perl4ever 8y agoYou think that lawyers say an allegation is "baseless" iff it is baseless? That's an interesting epistemic outlook.
- travmatt 8y ago“If the facts are against you, argue the law. If the law is against you, argue the facts. If the law and the facts are against you, pound the table and yell like hell.” I suspect good lawyers refrain from falsely alleging a claim is baseless when they have more sound arguments to make, and they save the histrionics for table pounding occasions.
- cjslep 8y agoNo, I'm providing definitions and using myself in an example. Please do not put words in my mouth.
- perl4ever 8y agoYou provided unnecessary and unhelpful definitions, from my perspective. I assume as axiomatic (and required by HN guidelines) that you intended to be helpful and relevant, so I asked a question to determine what you were thinking. If you do not think lawyers use the "baseless" language in a totally transparent, sincere way, then I would've expected you to be more interested in when and how they do that, which is the discussion I was looking for, if any.
- tessi3r 8y agoWhile I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target. To this day I have a personal phone and a revolving burner I only use for non-SMS 2FA with an unlisted number, which is kept in an EMF proof bag while not in use. Security for this kind of thing is an absolute joke. Granted, this guy should've known better granted the value of his holdings... Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. However, I'm still waiting for a carrier that creates a system that can't be trivially socially engineered by bored Chinese scammers...
- avian 8y ago> Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen. I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?
- rubatuga 8y agoMaybe he means phone -> google account -> android backup -> 2fa keys?
- koolba 8y agoNo that’s wrong. TOTP based 2FA is totally out of band with the only attack vectors being losing your physical device (or a device backup!) or leaking of the secret from the server side.
- testvox 8y agoNo that's wrong, authy backs up your TOTP seed to their server and will give them out to anyone who gains access to your authy account and can verify that they can receive sms messages sent to the number associated with the authy account. (Though they are encrypted and authy does not store the encryption keys).
- aml183 8y agoThis was a good article about how to prevent these types of attacks. https://medium.com/@masonic_tweets/minimum-viable-security-32e61d10aee4?ref=tokendaily https://medium.com/@masonic_tweets/minimum-viable-security-3...
- enahs-sf 8y agoI think about this a lot as the phone is a pretty obvious single point of failure for 2FA and telcos are easily pwned through basic social engineering. I struggle with removing it as an alternative though because losing your phone or 2FA device leaves you in a pretty nasty spot. Tough choice.
- metalliqaz 8y agoGiven the revelation that phone number security just isn't that secure, I have changed my online accounts that allow 2FA to use a crypto key. However, I have found that most seem to only allow crypto keys in addition to a cell phone number. You can't turn it off. Has anyone else noticed this? What is the point of moving to something more secure if you can't get rid of the weak link?
- jobigoud 8y agoYeah it really makes you think of all the other methods you might not even know about. My bank has an mobile app to connect that I'm not using because I don't trust it, but what if it's indeed insecure and someone else exploit it...
- CNJ7654 8y ago2FA by SMS strikes again. I'm not going to hold my breath for every phone company to get their act together. Hopefully these kinds of incidents will lead to a wider adoption of U2F, or at least OATH TOTP
- nodesocket 8y agoNot getting my sympathy. Use a hardware wallet such as Trezor for God sake. Also, in what world when he lost $24M can he sue for $224M? Entited to a 10x return because of his own neglegence. Nope!
- bufferoverflow 8y agoWho the hell keeps $24M worth of crypto on a phone? I only trust open source systems, do all large transactions on fresh Linux, disable JS if I have to use the browser, never visit any unusual websites, nothing not related to the process.
- tonyztan 8y agoOriginal court filing here: https://www.greenbergglusker.com/content/uploads/2018/08/Complaint-as-Filed-3063362-1.pdf https://www.greenbergglusker.com/content/uploads/2018/08/Com...
- hondadriver 8y agoHow can he prove he did posses this amount of crypto currency and is not making everything up? With a system without any regulation nor oversight where you have to play your own bank, this is exactly what you’ve signed up for...
- jobigoud 8y agoHe still has the private keys that control addresses that can be shown from the blockchain to have had the coins until the hack. What is harder to prove is that he doesn't also control the new addresses where the funds were transferred to.
- mastrsushi 8y ago>Loses $24M in anonymous currency that's unbound by state >Sues telecommunications conglomerate for $224M over loss Is this guy ill or what