4 ms·

How can a mobile carrier operate like this?? No authentication that the request isn't fraudulent? In Sweden I switched to another carrier, still keeping the nu

How can a mobile carrier operate like this?? No authentication that the request isn't fraudulent? In Sweden I switched to another carrier, still keeping the number in the same name. To do that I got a text message with a code I had to input to initiate the process. When I ported my phone number from my father to me within the same carrier when I turned 18 that required the same confirmation to initiate the process and signed request/approval both from me and my father posted to the company, with associated emails about the process. This isn't even hard? This is just basic steps to prevent identity theft....

jsnell 7y ago
This is not about porting the number to a different carrier or even a different owner though. It's more analogous to getting a replacement SIM card. The last time I had a phone stolen, I went to the carrier's store, they checked my ID, and gave me a replacement SIM. And the things is, if the customer service representative is empowered to do that, they could also be bribed by the attacker.
- ktsmith 7y ago
  It's worse than this though. My colleague had his sim replaced by an attacker in October of last year even though his account had a note on it specifically to prevent this without the account holder being present and showing photo id. Not only can the customer service rep at your carriers store do this but so can the phone reps at all the other stores that sell phones for your carrier such as best buy. The bottom line is that SMS/phone numbers shouldn't be an identifying factor for security purposes.
- Gwypaas 7y ago
  I checked, to get a replacement sim my carrier sends out inactive cards that needs to be activated through their web service using the printed number on the card. If you don't have an account you need to contact customer service, and to get through there they most likely authenticate you based on your SSN and an already active app on your phone (BankID) where you input your personal password. This has actually created problems when people get their stuff stolen abroad. The ID application is authenticated using your bank and a device using your physical bank card, a generated number from the webpage and your pin and then the generated number is put into the webpage. So if you get both phone and card stolen it's essentially impossible to get into your accounts until you can get a new one posted to you. Especially fun if your bills end up in a digital mailbox requiring that login.... Using that app is how essentially all identification is done in Sweden since it's based on an already approved physical device and a personal password. With your bank as insurance that the information is correct based on your physical bank card and the account associated to it.
  - knorker 7y ago
    See recent Tele2 attacks. This is a problem in Sweden too. Maybe the Tele2 attacks made them finally sort things out.
    - Gwypaas 7y ago
      Googled. Is it regarding using social engineering to enable call forwarding last autumn? Can't find anything else.
      - knorker 7y ago
        Yeah. Which is how this guy got hacked, too. Whether it's by forwarding or new sim card is a detail. It's the same social engineering vulnerability.
        Gwypaas 7y ago
        And reading the article everyone was already at the time working on preventing it, because any unauthorized change is illegal. The prevention seems to be either through BankID authentication or actually calling/texting the number being forwarded to make sure the request is legitimate.
    - eythian 7y ago
      What Tele2 attacks?
      - knorker 7y ago
        https://computersweden.idg.se/2.2683/1.710395/google-konto-hacka https://computersweden.idg.se/2.2683/1.710395/google-konto-h...
mayniac 7y ago
In your case, a dedicated attacker could socially engineer the carrier into changing you and your father's contact details and then port the number. $100k is a lifetime's worth of money in some countries, and it can justify a few months worth of recon.
- Gwypaas 7y ago
  How? I still get a text to my physical phone with the active number being ported and use the code supplied to initiate the process. Somehow making them change my contact details would just end up with the bills being sent to the wrong place, if you still have paper bills and don't have it automatically paid or goes to a digital mailbox.

jsnell 7y ago

This is not about porting the number to a different carrier or even a different owner though. It's more analogous to getting a replacement SIM card. The last time I had a phone stolen, I went to the carrier's store, they checked my ID, and gave me a replacement SIM. And the things is, if the customer service representative is empowered to do that, they could also be bribed by the attacker.

ktsmith 7y ago
It's worse than this though. My colleague had his sim replaced by an attacker in October of last year even though his account had a note on it specifically to prevent this without the account holder being present and showing photo id. Not only can the customer service rep at your carriers store do this but so can the phone reps at all the other stores that sell phones for your carrier such as best buy. The bottom line is that SMS/phone numbers shouldn't be an identifying factor for security purposes.
Gwypaas 7y ago
I checked, to get a replacement sim my carrier sends out inactive cards that needs to be activated through their web service using the printed number on the card. If you don't have an account you need to contact customer service, and to get through there they most likely authenticate you based on your SSN and an already active app on your phone (BankID) where you input your personal password. This has actually created problems when people get their stuff stolen abroad. The ID application is authenticated using your bank and a device using your physical bank card, a generated number from the webpage and your pin and then the generated number is put into the webpage. So if you get both phone and card stolen it's essentially impossible to get into your accounts until you can get a new one posted to you. Especially fun if your bills end up in a digital mailbox requiring that login.... Using that app is how essentially all identification is done in Sweden since it's based on an already approved physical device and a personal password. With your bank as insurance that the information is correct based on your physical bank card and the account associated to it.
- knorker 7y ago
  See recent Tele2 attacks. This is a problem in Sweden too. Maybe the Tele2 attacks made them finally sort things out.
  - Gwypaas 7y ago
    Googled. Is it regarding using social engineering to enable call forwarding last autumn? Can't find anything else.
    - knorker 7y ago
      Yeah. Which is how this guy got hacked, too. Whether it's by forwarding or new sim card is a detail. It's the same social engineering vulnerability.
      - Gwypaas 7y ago
        And reading the article everyone was already at the time working on preventing it, because any unauthorized change is illegal. The prevention seems to be either through BankID authentication or actually calling/texting the number being forwarded to make sure the request is legitimate.
  - eythian 7y ago
    What Tele2 attacks?
    - knorker 7y ago
      https://computersweden.idg.se/2.2683/1.710395/google-konto-hacka https://computersweden.idg.se/2.2683/1.710395/google-konto-h...

mayniac 7y ago

In your case, a dedicated attacker could socially engineer the carrier into changing you and your father's contact details and then port the number. $100k is a lifetime's worth of money in some countries, and it can justify a few months worth of recon.

Gwypaas 7y ago
How? I still get a text to my physical phone with the active number being ported and use the code supplied to initiate the process. Somehow making them change my contact details would just end up with the bills being sent to the wrong place, if you still have paper bills and don't have it automatically paid or goes to a digital mailbox.