4 ms·
I was attacked in the same manner this weekend. I'll dump what I know below in the hopes it helps someone. I lost money when MTGox went under and made some onl
by cdiamand 7y ago
I was attacked in the same manner this weekend. I'll dump what I know below in the hopes it helps someone.
I lost money when MTGox went under and made some online posts (on reddit, I think) several years ago. Maybe this is what caused me to be targeted?
This weekend a malicious actor posing as the account holder on my account was able to get my number transferred to his phone. At&t fraud says this happened at a store, and the user had the last 4 of one of my family member's social security number, as well as a fake id. I'm not sure I believe this, but will request more info in writing.
I regained access to my account. The attacker came from IP 216.162.42.85 (santa clara california)
They entered my email and according to google activity logs immediately went after my coinbase account. They got in (joke's on them I didn't have anything). Then they searched my email for 'btc', and also made a visit to my bank website. They weren't able to get access.
As far as I can tell, they were in and out within 10 minutes. I wonder if this was related to the author's experience?
- dbancajas 7y agoThis is the reason I have disabled SMS as a recovery option in my gmail/google account. My 2FA for gmail is now my iphone and ipad. THey have to know my password and get one of my devices to hack my account. I also use protonmail and for SMS based 2FA, I plan to use a google voice number from a totally different google account w/c forwards the text to my protonmail account. Google voice numbers cannot be ported out. Hence, avoiding the sim hack. They can port out if they hack my "shadow" google account. The trick is to never use the shadow account for anything. Hence, the attackers have no way to get to your google voice.
- cdiamand 7y agoThis is awesome. Thank you for sharing. I wish more people knew that their entire identity hinges on a store clerk at AT&T.
- js2 7y ago> Google voice numbers cannot be ported out. I hoped so too but someone replied to me that they can: https://news.ycombinator.com/item?id=19886705 https://news.ycombinator.com/item?id=19886705
- pg_bot 7y agoI'm fairly certain that any phone number in the US has to be portable by law.
- dontbenebby 7y agoYou can port out a voice number - it's $3 if it was originally a voice number: https://support.google.com/voice/answer/1065667?hl=en https://support.google.com/voice/answer/1065667?hl=en Weirdly, you can't port a Gsuite google voice # to a gmail account. (I looked into it when considering canceling my Gsuite account)
- klosnet 7y agoI've ported out my google voice numbers several times.
- anaisbetts 7y agoPorting out GVoice numbers is harder, but it can absolutely be done, I've moved a purely Google Voice number to T-Mobile before.
- retube 7y ago> My 2FA for gmail is now my iphone and ipad sorry - how does that work? what's the platform / messaging service?
- PeterisP 7y agoAuthenticator app that generates one-time codes; no messaging (or even being online) required after the initial sync.