3 ms·

That's a good point in general; NIST recommends not using SMS for challenge-response authentication. I don't know whether in this case the victim was using SMS

That's a good point in general; NIST recommends not using SMS for challenge-response authentication. I don't know whether in this case the victim was using SMS codes, or whether the attacker used their phone number as part of a more involved attack (e.g. calling customer support and impersonating the victim). Even if you don't use SMS codes, there are a number of attacks that are opened up if someone seizes your cell phone number. In general, however, I think it would be a good thing if service providers were held liable for damages occurring due to account breaches; that's the only way we're going to get proper account security. Schneier has written on this subject extensively, e.g. https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html https://www.schneier.com/essays/archives/2003/11/liability_c....

Maxion 8y ago
I work in fraud prevention. While it's not yet a typical attack, it is does happen regularly. Usually the attack is done against an individual who is known to have significant crypto assets and is using Gmail. By default if you enable 2fa on your Gmail account, sms based 2fa is activated as backup. The attacker social engineers the phone provider to port the victims number, then resets the victims Gmail account, uses Android device manager to wipe their devices, and using the details found in Gmail they proceed to gain access to other accounts owned by the victim. The main goal being to social engineer access to services where they store crypto or to find unencrypted wallet backups in the cloud.
- theptip 8y ago
  The previous best option I was aware of with Gmail was to add a pair of Yubikeys, then explicitly remove your cellphone from the account, to close the gap you mention. Now there is https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/, which might be a better option -- interested to know if you've got any opinions on that scheme.

Maxion 8y ago

I work in fraud prevention. While it's not yet a typical attack, it is does happen regularly. Usually the attack is done against an individual who is known to have significant crypto assets and is using Gmail. By default if you enable 2fa on your Gmail account, sms based 2fa is activated as backup. The attacker social engineers the phone provider to port the victims number, then resets the victims Gmail account, uses Android device manager to wipe their devices, and using the details found in Gmail they proceed to gain access to other accounts owned by the victim. The main goal being to social engineer access to services where they store crypto or to find unencrypted wallet backups in the cloud.

theptip 8y ago
The previous best option I was aware of with Gmail was to add a pair of Yubikeys, then explicitly remove your cellphone from the account, to close the gap you mention. Now there is https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/, which might be a better option -- interested to know if you've got any opinions on that scheme.