4 ms·

This is interesting, how exactly can a phone number be "stolen"? I mean a practical reality. I'm in Poland, have had the same number for >10 years with several

by jakubp 8y ago

This is interesting, how exactly can a phone number be "stolen"? I mean a practical reality. I'm in Poland, have had the same number for >10 years with several carriers in a row, contract-based. How can anyone "steal" it / take it over?

EugeneOZ 8y ago
For starters, you can copy sim card, entirely. About practice - one of Telegram users was comprised using his phone number, because russian government just ordered to mobile operator to do this. It was much more simple than copying sim card :)
- jakubp 8y ago
  Right. So if you need physical access to my phone to be able to copy my keycard, I'm not too worried. I'll find out very quickly I don't have it, within minutes typically (hours at most). If someone is an incredibly smart adversary, steals my phone, gets the SIM card, copies it, and gives it back without me noticing, I'm f*ed anyway. Or is there a way to copy SIM card remotely??? As for state-level adversary, I get it. I'm even less concerned here :)
  - EugeneOZ 8y ago
    Physical access is not needed.
schoen 8y ago
I think it depends on the carrier and the adversary. For example, a government could ask the carrier to give them a copy of traffic to your number, or to cancel your number, or to let them send data as you. This is already "practical" if you have a capable enough adversary; for example, there have been reports of attackers subverting SMS-based 2FA. https://www.google.com/search?q=attacks+on+sms+2fa https://www.google.com/search?q=attacks+on+sms+2fa This could be based on cooperation of the carrier, or perhaps SS7 attacks, or IMSI catchers.
monocasa 8y ago
SS7 is horribly secured, and you can pretty easily forge that signaling information. For the past couple years here in the US, scammers have been calling with stolen numbers that match your prefix more than a random caller probably would. So for ABC-DEF-GHIJ all of ABC-DEF matching is a pretty good sign it's a spammer if you live in a large metropolitan area. Unfortunately it makes them nearly impossible to track back, because when you call the number back, it's some random private number that didn't even make the call and has no idea what you're talking about. I've had a couple very angry people call me and yell to stop trying to sell them credit cards.
- jakubp 8y ago
  I don't fully follow the prefix thing. So a scammer makes a call from a number that's a prefix of my number? That doesn't affect 2FA, that won't show up as "me" on my friends' phone screens when they call, etc... how is that an issue?
  - monocasa 8y ago
    The scammer is able to forge the signaling and routing. It's not that they have numbers for your prefix, they're just able to connect to SS7, know that they're calling 555-111-2222, and forge the signaling information for say 555-111-3333 hoping that you're more likely to pick up the phone, and you have no way to call them back as they'll not be associated with that number once the call is done. > That doesn't affect 2FA You can use the same techniques to say "I am 555-111-2222, route all sms for that number to me". > that won't show up as "me" on my friends' phone screens when they call They absolutely can do that. It's not that they bought numbers in each of the prefixes, it's that they're forging the signaling information for another number in your prefix dynamically, based on your number.
    - jakubp 8y ago
      Thanks :)
geofft 8y ago
One common scam in the US is to walk into a retail store, say that you lost your phone, ask for a replacement SIM card, and trick the minimum-wage employee into giving it to you (fake IDs, yelling, whatever).
rawfan 8y ago
As another commenter pointed out, the mobile network signaling system sucks. You can just read other peoples SMS by becoming part of the SS7 network. It's that easy. Watch these two talks on the subject: https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271... https://media.ccc.de/v/31c3_-_6122_-_en_-_saal_1_-_201412271830_-_mobile_self-defense_-_karsten_nohl https://media.ccc.de/v/31c3_-_6122_-_en_-_saal_1_-_201412271...
- jakubp 8y ago
  I can't follow this, it's too technical for me. Are you saying anyone here on HN who watches the talk (and is technical enough) could just read text messages of the people who are in the area around their BTS? How is that NOT done en masse then?
em-bee 8y ago
if you loose your simcard, or it expires for some orhe reason, it will eventually be reassiged. then someone else has your old number and may recover your old account if you weren't able to change the number on it.

by jakubp 8y ago

EugeneOZ 8y ago

For starters, you can copy sim card, entirely. About practice - one of Telegram users was comprised using his phone number, because russian government just ordered to mobile operator to do this. It was much more simple than copying sim card :)

jakubp 8y ago
Right. So if you need physical access to my phone to be able to copy my keycard, I'm not too worried. I'll find out very quickly I don't have it, within minutes typically (hours at most). If someone is an incredibly smart adversary, steals my phone, gets the SIM card, copies it, and gives it back without me noticing, I'm f*ed anyway. Or is there a way to copy SIM card remotely??? As for state-level adversary, I get it. I'm even less concerned here :)
- EugeneOZ 8y ago
  Physical access is not needed.

schoen 8y ago

I think it depends on the carrier and the adversary. For example, a government could ask the carrier to give them a copy of traffic to your number, or to cancel your number, or to let them send data as you. This is already "practical" if you have a capable enough adversary; for example, there have been reports of attackers subverting SMS-based 2FA. https://www.google.com/search?q=attacks+on+sms+2fa https://www.google.com/search?q=attacks+on+sms+2fa This could be based on cooperation of the carrier, or perhaps SS7 attacks, or IMSI catchers.

monocasa 8y ago

SS7 is horribly secured, and you can pretty easily forge that signaling information. For the past couple years here in the US, scammers have been calling with stolen numbers that match your prefix more than a random caller probably would. So for ABC-DEF-GHIJ all of ABC-DEF matching is a pretty good sign it's a spammer if you live in a large metropolitan area. Unfortunately it makes them nearly impossible to track back, because when you call the number back, it's some random private number that didn't even make the call and has no idea what you're talking about. I've had a couple very angry people call me and yell to stop trying to sell them credit cards.

jakubp 8y ago
I don't fully follow the prefix thing. So a scammer makes a call from a number that's a prefix of my number? That doesn't affect 2FA, that won't show up as "me" on my friends' phone screens when they call, etc... how is that an issue?
- monocasa 8y ago
  The scammer is able to forge the signaling and routing. It's not that they have numbers for your prefix, they're just able to connect to SS7, know that they're calling 555-111-2222, and forge the signaling information for say 555-111-3333 hoping that you're more likely to pick up the phone, and you have no way to call them back as they'll not be associated with that number once the call is done. > That doesn't affect 2FA You can use the same techniques to say "I am 555-111-2222, route all sms for that number to me". > that won't show up as "me" on my friends' phone screens when they call They absolutely can do that. It's not that they bought numbers in each of the prefixes, it's that they're forging the signaling information for another number in your prefix dynamically, based on your number.
  - jakubp 8y ago
    Thanks :)

geofft 8y ago

One common scam in the US is to walk into a retail store, say that you lost your phone, ask for a replacement SIM card, and trick the minimum-wage employee into giving it to you (fake IDs, yelling, whatever).

rawfan 8y ago

As another commenter pointed out, the mobile network signaling system sucks. You can just read other peoples SMS by becoming part of the SS7 network. It's that easy. Watch these two talks on the subject: https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271... https://media.ccc.de/v/31c3_-_6122_-_en_-_saal_1_-_201412271830_-_mobile_self-defense_-_karsten_nohl https://media.ccc.de/v/31c3_-_6122_-_en_-_saal_1_-_201412271...

jakubp 8y ago
I can't follow this, it's too technical for me. Are you saying anyone here on HN who watches the talk (and is technical enough) could just read text messages of the people who are in the area around their BTS? How is that NOT done en masse then?

em-bee 8y ago

if you loose your simcard, or it expires for some orhe reason, it will eventually be reassiged. then someone else has your old number and may recover your old account if you weren't able to change the number on it.