6 ms·

Does anyone know how common or easy SIM swapping elsewhere in the world? The SIM swapping stories I've seen on HN mostly focus on US users. I remember reading

by Svip 7y ago

Does anyone know how common or easy SIM swapping elsewhere in the world? The SIM swapping stories I've seen on HN mostly focus on US users. I remember reading an article years ago, about banks combating SIM swapping in Africa, where a lot of transfers are done by SMS, by forcing a cooldown. But I wonder, besides the US and Africa, where is SIM swapping prevalent? NYT says I'm at risk too. I'm in Europe -- am I?

krzyk 7y ago
In Poland it is also used, I heard stories (e.g. https://niebezpiecznik.pl/tag/sim-swap-fraud/ https://niebezpiecznik.pl/tag/sim-swap-fraud/ polish website) about sim card swapping and stealing funds from bank accounts. After reading those I switched authentication from a sms text to my bank app.
- jwr 7y ago
  Unfortunately, the current corporate thinking in Poland is that 2-factor authentication means SMS. I see banks and other companies introduce this in spite of known vulnerabilities. SMS is NOT a secure second factor!
  - Slimbo 7y ago
    What's the universally accepted alternative?
    - michaelt 7y ago
      There is no universally accepted second factor. * SMS (and automated voice call) are bad for people who live in areas with poor phone coverage, people with international phone numbers, and people who want good security. * TOTP is bad for people who don't have smartphones. * FIDO U2F is bad for people who don't have $20, safari/iOS users, and people whose devices don't have USB. * Vendor-specific apps are bad for people who don't have smartphones, people with low spec or poorly supported smartphones, blind people, and the privacy-conscious. * Smart card readers and physical tokens with screens cost $$$, often aren't accessible to blind people, and are too bulky for users to carry more than one or two. * Paper single-use codes are bad for people who log in regularly, people who don't have printers, and don't scale to multiple services all that well. * All of the above are bad for people who are forgetful or clumsy enough to regularly lose or break the second factor. WITH THAT SAID, you can still provide Hacker-News-reader-approved two-factor authentication by basically copying Google: Offer the user TOTP, FIDO, SMS and paper codes, let them choose any two. Gain bonus points with a setting that stops customer services resetting the password or disabling 2fa, and a week-long warning/waiting period in case account hijackers dial up the security settings to stop the original user getting their account back.
      - deleted 7y ago
        [deleted]
      - tialaramex 7y ago
        > TOTP is bad for people who don't have smartphones. This only true if you're willing to define everything beyond the most mundane "dumb phone" as a "smartphone". One of my friends has a long list of exciting problems which ends up meaning he doesn't own what anyone these days would consider a smartphone. But it's not like he uses carrier pigeons. His phone does have a (monochrome) screen and is quite capable of running software, it's just the software has to be crappy mobile Java from last century. However TOTP is trivial, you probably can't do it in your head but you definitely can do it in a Java 1.0 implementation and so sure enough it can be run on those phones. On a brand new Pixel of course you vaguely wave your phone near the screen, it reads a QR code and sets everything up, he has to instead laboriously transcribe a secret value using T9 input, but the same effect is achieved - a changing code that he can input to prove he knows the shared secret.
        michaelt 7y ago
        You're correct: You could TOTP from a java phone app, a tablet, an airgapped computer, a non-airgapped PC you were really confident of the security of, and so on. That's why I said "bad for" rather than "impossible for" :) After all, you'd still be excluding all the people who don't have any of those. Like my 90-year-old neighbour who only has a landline phone. I've helped maybe 50 employees set up VPN access at my workplace, and at least 2 of them said they didn't have any way to TOTP independently of the laptop we were issuing them with.
      - krzyk 7y ago
        > * SMS (and automated voice call) are bad for [...] people with international phone numbers Why is that? I'm maybe spoiled by my surroundings (Poland and Europe in general), but receiveing SMS text is free abroad. While using dataplan generally is not, so SMS is cheaper (free) as a second factor if you travel a lot.
        michaelt 7y ago
    - jwr 7y ago
      TOTP (using Authy, Google Authenticator, or other apps) with a printed set of emergency recovery keys. And please, people, stop saying that this is not good for people who do not have smartphones. To a first approximation, everybody has a smartphone.
subw00f 7y ago
There's a scandal being reported by Glenn Greenwald in Brazil, which is centered around the minister of Justice and his actions as a judge in the Lava Jato operation that led to Lula (ex president) being arrested. He helped prosecutors by coordinating strategies with them. These conversations took place on telegram and were stolen using sim swap.
tialaramex 7y ago
Yes. Of course it works, if it was not possible for you to move your phone number to a different device then you'd be trapped and of course the mobile phone companies would take advantage of that to gouge you. The problem is your cell provider doesn't have a very good way to be sure it's Svip asking them to do this transfer. They are mostly going to rely on low paid call center or shop floor staff to decide. Fortunately for them this is a low-value transaction. If I get them to transfer Svip's number, I don't cost them very much money and I don't inconvenience you all that much really. Why would I bother... Unless some idiot decides to rest the authentication scheme for their valuable service on control over a phone number. In the UK in particular for example the person doing the authentication in an actual store will usually be a teenager working part time for the mobile phone company to get some spending money or during tertiary education. When a hot guy approaches them saying they can make twice their weekly wage if they just "forget" to do a proper ID check for a few friends of his, why wouldn't they say "Yes" ? They might get fired? They have never had a serious job, they're treated like shit, unless they're unusually upright and honest or they think it's a trap they're going to agree.
- rmtech 7y ago
  There are still ways to make the system more secure. For example, you have to physically go to a store to port the number unless you have the old SIM. Then it's not done immediately - there's a 72 hour period in which multiple texts and calls are sent to the old SIM asking for confirmation. If you physically have the old SIM this is instant, but if you claim to have lost it you need to wait 72 hours and provide a signature and mugshot at the store. If a member of staff "forgets" to do this stuff, they go to jail. People don't usually lose their SIM card, so this process wouldn't happen very often.
  - tialaramex 7y ago
    Sure, you could have a national "reality" TV show, everybody who lost their SIM has to go on the TV show for six months with it showing on screen which number they claim is theirs - so this way there's no chance they're a crook. Or make anyone who claims they lost their SIM wrestle a bear first before they get a replacement. Won't see many crooks take that on. But, I put it to you that this all seems very disproportionate when you remember that you're punishing the phone company and its customers for not securing Twitter. These are the wrong people!
joshvm 7y ago
Very easy. I have a UK sim with Giffgaff. I lost the original sim and ordered a new one (not linked to me, it was a freebie for distributing to get a referral). I could log into my account, activate the new sim and it was done in about ten minutes. That's really nice in some respects, but in theory if your account gets hacked, goodbye phone number. There may have been some additional work involved, eg confirm via email, but I believe other networks make it a lot more difficult. Eg you need to request it specifically through customer services and they need actual ID. My mum is with EE and she had to go to a physical store and prove she was the account holder. Three is similar, you have to request a new sim but in theory if your mobile account is broken then that can be done online (though it never worked when I tried it, the sim didn't arrive).
iicc 7y ago
UK 2016: https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud-mobile-banking-fraudsters https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud... >When Sims rang EE, it soon emerged that someone posing as his wife had managed to persuade the mobile network to activate a new sim card >Sims says that when he contacted his bank, Halifax, the call centre told him it is handling hundreds of sim scams every day, making it the fastest growing fraud in the country – although Halifax later disputed this figure. On the other hand I'm sure I saw something about banks etc being able to subscribe to services that would give them background information about a mobile number (ie if the number has been recently ported).
darkhorn 7y ago
In Turkey if you change your SIM card you cannot login to your bank account (web site, app). Yeah, even if you are in same mobile operator with your same phone number. How does my bank know that I have changed my SIM card? I think that they have API between mobile operator, government, and bank. For example I can see my mobile and land line numbers from my e-government account.
- kamyarg 7y ago
  App is able to access the sim unique identifier. - https://en.wikipedia.org/wiki/SIM_card#ICCID https://en.wikipedia.org/wiki/SIM_card#ICCID - https://stackoverflow.com/a/38032034/1329429 https://stackoverflow.com/a/38032034/1329429 But I am not sure about website, maybe they have integration with the operators to check last sim change date and compare it to their last know trusted sim or check the last time your phone was audited? You need to generate one time codes in TR banks afaik.
  - darkhorn 7y ago
    https://m.garantibbva.com.tr/mobile-tr/bireysel/subesiz/internet_bankaciligi/guvenlik/genel_bilgiler.page https://m.garantibbva.com.tr/mobile-tr/bireysel/subesiz/inte... >Numara taşıma, 4.5G veya başka nedenlerle yapılan SIM kart değişikliklerinden sonra, Garanti BBVA İnternet Bankacılığı ve Garanti BBVA Mobil’e girişte kullanılan tek kullanımlık şifreler güvenliğiniz için bloke edilmektedir. "Due to switching to another provider, 4G, or for whatever reason if you change your SIM card your password is blocked for both the app and internet banking." >Blokenizi kaldırmak için Garanti BBVA Şubelerine uğrayabilir ya da 444 0 333 no’lu Garanti BBVA Müşteri İletişim Merkezi’ni arayabilirsiniz. "In order to remove the password block you will need either to visit the one of our banks or call us." Logging to Garanti requires 2FA. You can either use your password + SMS, or your password + one time code generator, in the past there was also password + mobile sign. In Turkey 2FA is required by law in banking. This law is in action since for, I think 5-6 years. Also, it is easy to implement this "notify the bank if SIM has changed" because all the banks (except few state banks which are in Ankara) and mobile operators (3) are all located in Istanbul.
Semaphor 7y ago
In Germany, you have an extra PIN (called PUK) that is required for these things (alternatively show up with your ID at a store). So unless someone has that, it’s not as much of a problem.

by Svip 7y ago

krzyk 7y ago

In Poland it is also used, I heard stories (e.g. https://niebezpiecznik.pl/tag/sim-swap-fraud/ https://niebezpiecznik.pl/tag/sim-swap-fraud/ polish website) about sim card swapping and stealing funds from bank accounts. After reading those I switched authentication from a sms text to my bank app.

jwr 7y ago
Unfortunately, the current corporate thinking in Poland is that 2-factor authentication means SMS. I see banks and other companies introduce this in spite of known vulnerabilities. SMS is NOT a secure second factor!
- Slimbo 7y ago
  What's the universally accepted alternative?
  - michaelt 7y ago
    There is no universally accepted second factor. * SMS (and automated voice call) are bad for people who live in areas with poor phone coverage, people with international phone numbers, and people who want good security. * TOTP is bad for people who don't have smartphones. * FIDO U2F is bad for people who don't have $20, safari/iOS users, and people whose devices don't have USB. * Vendor-specific apps are bad for people who don't have smartphones, people with low spec or poorly supported smartphones, blind people, and the privacy-conscious. * Smart card readers and physical tokens with screens cost $$$, often aren't accessible to blind people, and are too bulky for users to carry more than one or two. * Paper single-use codes are bad for people who log in regularly, people who don't have printers, and don't scale to multiple services all that well. * All of the above are bad for people who are forgetful or clumsy enough to regularly lose or break the second factor. WITH THAT SAID, you can still provide Hacker-News-reader-approved two-factor authentication by basically copying Google: Offer the user TOTP, FIDO, SMS and paper codes, let them choose any two. Gain bonus points with a setting that stops customer services resetting the password or disabling 2fa, and a week-long warning/waiting period in case account hijackers dial up the security settings to stop the original user getting their account back.
    - deleted 7y ago
      [deleted]
    - tialaramex 7y ago
      > TOTP is bad for people who don't have smartphones. This only true if you're willing to define everything beyond the most mundane "dumb phone" as a "smartphone". One of my friends has a long list of exciting problems which ends up meaning he doesn't own what anyone these days would consider a smartphone. But it's not like he uses carrier pigeons. His phone does have a (monochrome) screen and is quite capable of running software, it's just the software has to be crappy mobile Java from last century. However TOTP is trivial, you probably can't do it in your head but you definitely can do it in a Java 1.0 implementation and so sure enough it can be run on those phones. On a brand new Pixel of course you vaguely wave your phone near the screen, it reads a QR code and sets everything up, he has to instead laboriously transcribe a secret value using T9 input, but the same effect is achieved - a changing code that he can input to prove he knows the shared secret.
      - michaelt 7y ago
        You're correct: You could TOTP from a java phone app, a tablet, an airgapped computer, a non-airgapped PC you were really confident of the security of, and so on. That's why I said "bad for" rather than "impossible for" :) After all, you'd still be excluding all the people who don't have any of those. Like my 90-year-old neighbour who only has a landline phone. I've helped maybe 50 employees set up VPN access at my workplace, and at least 2 of them said they didn't have any way to TOTP independently of the laptop we were issuing them with.
    - krzyk 7y ago
      > * SMS (and automated voice call) are bad for [...] people with international phone numbers Why is that? I'm maybe spoiled by my surroundings (Poland and Europe in general), but receiveing SMS text is free abroad. While using dataplan generally is not, so SMS is cheaper (free) as a second factor if you travel a lot.
      - michaelt 7y ago
  - jwr 7y ago
    TOTP (using Authy, Google Authenticator, or other apps) with a printed set of emergency recovery keys. And please, people, stop saying that this is not good for people who do not have smartphones. To a first approximation, everybody has a smartphone.

subw00f 7y ago

There's a scandal being reported by Glenn Greenwald in Brazil, which is centered around the minister of Justice and his actions as a judge in the Lava Jato operation that led to Lula (ex president) being arrested. He helped prosecutors by coordinating strategies with them. These conversations took place on telegram and were stolen using sim swap.

tialaramex 7y ago

Yes. Of course it works, if it was not possible for you to move your phone number to a different device then you'd be trapped and of course the mobile phone companies would take advantage of that to gouge you. The problem is your cell provider doesn't have a very good way to be sure it's Svip asking them to do this transfer. They are mostly going to rely on low paid call center or shop floor staff to decide. Fortunately for them this is a low-value transaction. If I get them to transfer Svip's number, I don't cost them very much money and I don't inconvenience you all that much really. Why would I bother... Unless some idiot decides to rest the authentication scheme for their valuable service on control over a phone number. In the UK in particular for example the person doing the authentication in an actual store will usually be a teenager working part time for the mobile phone company to get some spending money or during tertiary education. When a hot guy approaches them saying they can make twice their weekly wage if they just "forget" to do a proper ID check for a few friends of his, why wouldn't they say "Yes" ? They might get fired? They have never had a serious job, they're treated like shit, unless they're unusually upright and honest or they think it's a trap they're going to agree.

rmtech 7y ago
There are still ways to make the system more secure. For example, you have to physically go to a store to port the number unless you have the old SIM. Then it's not done immediately - there's a 72 hour period in which multiple texts and calls are sent to the old SIM asking for confirmation. If you physically have the old SIM this is instant, but if you claim to have lost it you need to wait 72 hours and provide a signature and mugshot at the store. If a member of staff "forgets" to do this stuff, they go to jail. People don't usually lose their SIM card, so this process wouldn't happen very often.
- tialaramex 7y ago
  Sure, you could have a national "reality" TV show, everybody who lost their SIM has to go on the TV show for six months with it showing on screen which number they claim is theirs - so this way there's no chance they're a crook. Or make anyone who claims they lost their SIM wrestle a bear first before they get a replacement. Won't see many crooks take that on. But, I put it to you that this all seems very disproportionate when you remember that you're punishing the phone company and its customers for not securing Twitter. These are the wrong people!

joshvm 7y ago

Very easy. I have a UK sim with Giffgaff. I lost the original sim and ordered a new one (not linked to me, it was a freebie for distributing to get a referral). I could log into my account, activate the new sim and it was done in about ten minutes. That's really nice in some respects, but in theory if your account gets hacked, goodbye phone number. There may have been some additional work involved, eg confirm via email, but I believe other networks make it a lot more difficult. Eg you need to request it specifically through customer services and they need actual ID. My mum is with EE and she had to go to a physical store and prove she was the account holder. Three is similar, you have to request a new sim but in theory if your mobile account is broken then that can be done online (though it never worked when I tried it, the sim didn't arrive).

iicc 7y ago

UK 2016: https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud-mobile-banking-fraudsters https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud... >When Sims rang EE, it soon emerged that someone posing as his wife had managed to persuade the mobile network to activate a new sim card >Sims says that when he contacted his bank, Halifax, the call centre told him it is handling hundreds of sim scams every day, making it the fastest growing fraud in the country – although Halifax later disputed this figure. On the other hand I'm sure I saw something about banks etc being able to subscribe to services that would give them background information about a mobile number (ie if the number has been recently ported).

darkhorn 7y ago

In Turkey if you change your SIM card you cannot login to your bank account (web site, app). Yeah, even if you are in same mobile operator with your same phone number. How does my bank know that I have changed my SIM card? I think that they have API between mobile operator, government, and bank. For example I can see my mobile and land line numbers from my e-government account.

kamyarg 7y ago
App is able to access the sim unique identifier. - https://en.wikipedia.org/wiki/SIM_card#ICCID https://en.wikipedia.org/wiki/SIM_card#ICCID - https://stackoverflow.com/a/38032034/1329429 https://stackoverflow.com/a/38032034/1329429 But I am not sure about website, maybe they have integration with the operators to check last sim change date and compare it to their last know trusted sim or check the last time your phone was audited? You need to generate one time codes in TR banks afaik.
- darkhorn 7y ago
  https://m.garantibbva.com.tr/mobile-tr/bireysel/subesiz/internet_bankaciligi/guvenlik/genel_bilgiler.page https://m.garantibbva.com.tr/mobile-tr/bireysel/subesiz/inte... >Numara taşıma, 4.5G veya başka nedenlerle yapılan SIM kart değişikliklerinden sonra, Garanti BBVA İnternet Bankacılığı ve Garanti BBVA Mobil’e girişte kullanılan tek kullanımlık şifreler güvenliğiniz için bloke edilmektedir. "Due to switching to another provider, 4G, or for whatever reason if you change your SIM card your password is blocked for both the app and internet banking." >Blokenizi kaldırmak için Garanti BBVA Şubelerine uğrayabilir ya da 444 0 333 no’lu Garanti BBVA Müşteri İletişim Merkezi’ni arayabilirsiniz. "In order to remove the password block you will need either to visit the one of our banks or call us." Logging to Garanti requires 2FA. You can either use your password + SMS, or your password + one time code generator, in the past there was also password + mobile sign. In Turkey 2FA is required by law in banking. This law is in action since for, I think 5-6 years. Also, it is easy to implement this "notify the bank if SIM has changed" because all the banks (except few state banks which are in Ankara) and mobile operators (3) are all located in Istanbul.

Semaphor 7y ago

In Germany, you have an extra PIN (called PUK) that is required for these things (alternatively show up with your ID at a store). So unless someone has that, it’s not as much of a problem.