8 ms·
Listen to a SIM-Jacking, Account-Stealing Ransom
- slivanes 8y agoI remember reading somewhere that Google Voice numbers cannot be ported - and are useful in having them set as your 2FA for email accounts etc. Is that still correct?
- majormajor 8y agoI ported one out last year, I had to make it portable from inside my Google Voice account (a quite poorly documented pain, actually), but that's still a much higher bar than your average cell carrier.
- ironcan 8y agoAnd since there is no google customer service, nobody can social engineer it out of you!
- cj 8y agoGoogle Voice is on track to be a core service in Gsuite, which has pretty impressive phone support in my experience.
- toast0 8y agoI interacted with Google support (when it was called Google apps) for two things, the first one was I wanted to disable links in Gmail -- the support people couldn't understand what I wanted for about 30 minutes, then couldn't understand why I wanted it, then said it couldn't be done. I don't remember what the second one was, but it ended with the support person agreeing it was a problem, but suggesting I post to product forum. If that's amazing support, I'd rather rely on the normal channels: writing an angry blog post and posting it to HN, or suckering your smart friends into interviewing at Google and bribing them to fix your problems once they get there.
- markovbot 8y agodid you try to port it without marking it as portable in Google Voice? I would be interested to see if that flag actually matters.
- techsupporter 8y agoI tried to port out in early 2017 without unlocking the number at GV and the receiving provider said the sending provider had rejected the port request.
- wlesieutre 8y agoI've ported one back out, you have to sign into your account and allow it.
- Rjevski 8y agoFor UK numbers I can also recommend these guys: https://www.aa.net.uk/telecoms.html https://www.aa.net.uk/telecoms.html Their technical support is actual tech support, with tech guys that won't take any bullshit, especially if you have 2FA (TOTP-based) on your account. The numbers are not recognised as VoIP and will work with every single service (I have yet to find one that will fail). I believe they are partnered with a local carrier that does some magic (call forwarding to some internal number?) so from the outside they look just like any other mobile number from that carrier. (no affiliation besides being a satisfied customer for years)
- plantain 8y agoExcept their text messages only appear to be processed every half hour or so... which makes it useless for 2FA most of the time (the only reason I went with them).
- lotsofpulp 8y agoBank of America does not or is not able to send 2FA SMS to Google Voice numbers.
- deanmoriarty 8y agoThat's not true, I have both my Bank Of America and Merrill Edge accounts protected with 2FA using my Google Voice number, and it's been working fine for at least a couple years (when I switched to that method), I use both of them weekly receiving their authentication text via GV and never had a problem.
- lotsofpulp 8y agoInteresting, I tried years ago and it didn't work, maybe it has changed. Good thing is BoA also emails 2FA codes, so don't need SMS anyway.
- gammateam 8y agoI ported my Google Voice number to T-mobile about 6 years ago, replacing my main number Great decision as I got to reset my social graph - no services would try to auto-connect me with everyone from high school and college that had data dumped their contacts 10/10
- deanmoriarty 8y agoIs it worth it though? Now you can't fully rely on your phone number for 2FA, T-mobile is one of the providers notoriously known for transferring numbers without asking too many information. My daily number, not connected to any 2FA (for which I use Google Voice) is a T-mobile, and a couple years ago I bought a nano sim to replace a larger sim, and the call center operator transferred the number without me having to answer almost anything overly personal, I think they just asked for a PIN which I'd obviously forgotten and with some mild additional information it was reset right there. It was truly shocking, the old sim just got disconnected from the network instantly. For 2FA via text, Google Voice is IMHO the only choice, by far. And for social graph implications, on your google account you can choose to not be discoverable to other people via your phone number, and that includes the Google Voice number since it's explicitly listed there (of course I assume it doesn't work the other way around, which seems to be the thing you are bothered by, I'm usually worried about being discovered by others than being shown a list of people I might know).
- gammateam 8y agototally worth it, that number can be used to create a new google voice number. Offering SMS based one time codes - with no OTP protocol alternative - should be considered negligence of the legally sanctionable kind. and finally who cares about your social graph on Google? Thats not the issue at alllll
- davchana 8y agoDo you mean a brand new google voice number can/should be used for all 2fa smses?
- exabrial 8y agoDear everyone at Apple, Facebook, Google, etc. Please stop and remove the ability to use texting as 2FA. The mobile telecom industry is not hardened.
- devwastaken 8y agoOr, allow it, and inform them there's a safer method called Google authenticator. Authenticators make your logins dependent upon 3rd party software, and is only as secure as how that single source of failure is.
- shittyadmin 8y agoThere's many 2FA apps compatible with the TOTP and HOTP standards and they rarely, if ever require an update. Absolutely minimal 3rd party involvement, I'd say less than most web browsers these days as there really isn't a significant attack surface for the apps.
- kaoD 8y agoIf you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive: https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_algorithm#HOTP_value https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a... https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm#TOTP_value https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-...
- VectorLock 8y agoIt always bugged me how Google Authenticator doesn't back up accounts "by design." I know its more secure, but damn its a major hassle if you use it for a lot of things and you need to get a new phone.
- somabc 8y ago
- baybal2 8y agoOne does not even need to bribe or defraud telecom employees, the biggest gaping hole is the fact that roaming requests are insecure, and SMSes are plaintexted. On "certain Russian forums" the talk is that was the way how British MPs were deprived of their email mailboxes in 2016. Somebody dug up their IMSIs from leaks and public dbs, and sent roaming requests through Megafon - Russia's biggest telco
- droopybuns 8y agoI doubt that was necessary. Many of the telcos use atrocious pin security for voicemails- and they fail to prevent spoofed calls to their voicemail servers. Makes for a bad combination. SS7 hacking to achieve that end would be a higher barrier to entry and more likely to get caught.
- gammateam 8y ago> One does not even need to bribe or defraud telecom employees wow, no proof of stake required, rating 1/5
- themagician 8y agoThis is something that really worries me. I use token based 2FA when I can but the reality is that I have like 50 accounts with 2FA and I forget which ones have SMS as a backup. I'm sure there's an account in there somewhere that's at risk. I have AT&T and use the extra security PIN code, but I know it's not 100% guaranteed. The other day I got a robocall asking for my PIN and last for of my social. I didn't do it, but just knowing my number was on that list worried me. I called AT&T and asked them to put a note in my account that said not to allow my phone number to be transferred to another SIM. They said they did it, but again I don't know how effective that is. I understand why they make it possible to move a number to a new SIM, but I really wish you had an option to force a notification and delay the transfer for a number off days. Even a three day delay would be enough. You'd put in the request and they'd send a notification via SMS/call and email, and then the transfer wouldn't happen for 72 hours. I would gladly deal with the potential inconvenience of not having access to my phone for a few days if it meant that it would make it harder to transfer my number to a different SIM. I don't think this should be mandatory, but I'd like the option. It's just WAY too easy to call a cell provider and have them transfer your number to a new SIM and all the security measures that they use are easily defeated. Once you have someone's social security number you can spend 99¢ on a public records dump and get enough information to convince just about any customer service person to do whatever you want.
- notyourday 8y agoThe lack of security of cell phone providers is absolutely infuriating considering the sheer number of people who are paid $20/h that have ability to see and manipulate records at the likes of AT&T, Sprint, TMO and VZ not to mention those who work for resellers like BestBuy that are authorized to make activation and porting related changes. It reminds me of MJR confidently stating that the maximum cost of gaining access to any secure network is min: 1) A yearly salary of the lowest paid employee who has access (i.e. someone's secretary) 2) A price of a Desert Eagle
- wikibob 8y agoAh just FYI the pay is around $10-$11 an hour.
- jameslk 8y agoThis marketing entrepreneur talks down a ransom seeker with a heart warming story AND manages to record it? Sounds a little too good to be true
- FeteCommuniste 8y agoThe accent of the "scammer" in the call is definitely not German.
- socialist_coder 8y agoGermany has a ton of immigrants, they don't all speak with German accents.
- ghop02 8y ago2FA security aside, it really is remarkable how Jared was able to talk the hacker down. We seem to really undervalue those sorts of social skills. Jared's one conversation could have saved hundreds of thousands of dollars (for himself and others).
- notyourday 8y agoWhen a social engineer I meets a social engineer II the better social engineer gets the upper hand. In this case it was not the hacker.
- aviv 8y agoTaking over the SMS functionality of any phone number in the US is trivial and can be done in 2 minutes. The phone will continue to operate as normal and the victim will likely take a while to notice anything is wrong. Never ever use SMS to secure anything.
- yborg 8y ago>can be done in 2 minutes Citation needed. Extra credit for WikiHow step by step with badly drawn art.
- noselasd 8y agoTrivial if you have access to an SS7 network that has a direct access or a roaming agreement with the network of the victim, and the proper tools to do that. But you will not manage to do it within 2 minutes if you have.
- mherdeg 8y agoThe "OG account" stuff is fascinating. ( see e.g. https://waypoint.vice.com/en_us/article/43ebpd/the-long-weird-story-explaining-why-i-bid-dollar700-for-a-stolen-psn-account https://waypoint.vice.com/en_us/article/43ebpd/the-long-weir... for screenshots of forum or https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://medium.com/@N/how-i-lost-my-50-000-twitter-username-... ). Also fascinating is that the only functional support channel is "write a blog post and hope a lot of people upvote it on a news aggregator". Two really interesting trends there.
- deleted 8y ago[deleted]
- walrus01 8y agoFor anyone who wants to know how easy it is to social engineer big-4 mobile phone carrier customer service people... I highly recommend reading Mitnick's "art of deception" book on social engineering in general.
- Exuma 8y agoCan someone please point out what is the solution to bypass all these headaches? Can I get a separate phone account that is under a business entity or something (not a personal name)? Would that work?