9 ms·
Man sues AT&T over 'SIM Swap' hack allegedly involving employees
- pjy04 7y agoWasn’t there a pin on his account?
- ars 7y agoWould that have helped if there was an insider (AT&T supervisor) authorizing the transfer? i.e. can a supervisor override lack of a PIN?
- zaguios 7y agoEmployees are able to override the pin entering requirement. There is absolutely nothing you can do to stop this from happening if you happen to get targeted. (Speaking from experience)
- caleb-allen 7y agoIt is a liability to trust another party with keys to cryptocurrency with such high value. To step out of the regulated financial system is to open oneself up to these liabilities with little recourse. That is not to say that telecom companies should not fix this. They absolutely should.
- adrr 7y agoPin is last 4 of social which isn’t hard to get.
- wil421 7y agoNo it is not. My pin is not my or my wife’s social. I was able to choose whatever I wanted.
- wil421 7y agoExactly. I have a pin on my account after identity thieves opened a bunch of AT&T and Verizon accounts under my name (thanks Equifax!). Since this happened I’ve been in the AT&T stores when I bought an unlocked phone on two occasions. The employees at the store weren’t able to do a thing until I spoke with a special call center on the phone and did verifications. One time there was something wrong on their end and no one could do anything until the system to verify my pin was back up.
- cactus2093 7y agoIt’s better than nothing that AT&T finally allows pins at all, but one thing that’s insane about it is every time you log in on the web there’s a checkbox to never ask for your pin again. It’s exactly where you’d expect a checkbox for something like “remember me”, except it opens up a huge security hole in your account if you accidentally check it. Pins obviously have other issues that make no sense, like the incredibly low complexity allowed that would never be acceptable for a password. But even aside from that I guess AT&T also want everyone to turn their pin off? I hope they do lose a lawsuit and actually have to start giving a shit about pin swapping and make things more secure by default.
- sowbug 7y agoPretty sure that's only for the current device, not for the account.
- deleted 7y ago[deleted]
- dhruvrrp 7y agoWhen i upgraded my phone, I had to get a new (micro?) sim and they didn't even ask for my ID or the old sim.
- green-eclipse 7y agoAT&T employees on the inside were in on the scam. There's more details in this other article: https://www.foxla.com/news/fox-11-tracks-down-verizon-employee-accused-of-taking-bribes-from-sim-swap-hackers https://www.foxla.com/news/fox-11-tracks-down-verizon-employ...
- chii 7y agoThis is why SMS verification is insecure.
- deleted 7y ago[deleted]
- ghostpepper 7y agoI am not condoning or justifying criminal behaviour but I have to wonder why on earth he would have his life savings in cryptocurrency, protected only by SMS 2FA, if he knew someone else this had happened to?
- sdan 7y agoHe clearly isn’t educated enough (not to be mean). Especially if you’re going around with that much crypto always always remember: Not your keys, not your coins. Always store cold storage and set aside some for trading if you want. And if you’re trading, always use FIDO U2F physical keys.
- techsupporter 7y agoI wish him the best of luck but considering AT&T was a party in the big Supreme Court decision setting the precedent, I predict this falls down the dark hole of mandatory, binding arbitration about twelve minutes after the first hearing on a motion to dismiss and compel arbitration. We’ve collectively given up our rights to sue in many instances (including when signing up for HN-backed services run by people who should know better).
- xkcd-sucks 7y ago> (including when signing up for HN-backed services run by people who know they can get away with it)
- ikeboy 7y agoSo it gets moved to arbitration. If anything, it will move quicker and cost him less than a court case would.
- elliekelly 7y agoIf by “him” you mean AT&T, definitely.
- ikeboy 7y agoArbitration is cheaper for both parties than court, in general.
- sneeze-slayer 7y agoBinding arbitration is almost unilaterally bad for consumers. See: https://www.nytimes.com/2015/11/01/business/dealbook/arbitration-everywhere-stacking-the-deck-of-justice.html https://www.nytimes.com/2015/11/01/business/dealbook/arbitra...
- ikeboy 7y agoUnilaterally is not an accurate description. Your link has exactly one relevant sentence: >Roughly two-thirds of consumers contesting credit card fraud, fees or costly loans received no monetary awards in arbitration, according to The Times’s data. Note that 1. This excludes non monetary awards 2. The categories are cherry picked and they give us no data on arbitrations overall And even under those conditions they show a third of consumers win something, which is hardly a unilateral loss. And of course it's impossible to know how many of those cases were frivolous, and they didn't bother to compare to small claims court and see how consumers fare there. Anyway it's not relevant to this case, because he's not suing for one of those categories, plus he presumably has a lawyer (lots of arbitrations are done without lawyers and I'd bet that they have lower success rates).
- sdan 7y agoThis is exactly why I’m only faithful to FIDO U2F keys. Got a couple and ensure they’re safe. No one’s hacking my accounts unless they crack both my passwords and rob me physically... which at this point doesn’t seem like it’s going to happen.
- rb808 7y agoWhat happens if the keys get lost or destroyed? It seems like a never ending problem.
- sliken 7y agoGet 2 keys, keep one in a safe place. Add both to your important accounts. Then also setup TOTP, so if you lose both keys and have a working cell phone with the app installed you can still login.
- song 7y agoThat's if important accounts allow you to do that. For example AWS only allow one MFA key
- sdan 7y agoI have one at work/keep on my computer and one at home. Some websites allow TOTP which is still safer than SMS, but if I lose one, I'll get another one while I use the 2nd.
- rb808 7y ago> I have one at work This seems really easy to steal. > one at home Most people I know have been burgled too.
- munchbunny 7y agoKeep two or three, put one in a bank or a safe at home. That should be enough redundancy for most people. As long as you can still get in to revoke/enroll stuff you should be okay. It’s not so much a problem as it is a balance of security, redundancy, and effort. You decide where you want to be on that balance of considerations.
- asdfasgasdgasdg 7y agoThis is exactly the kind of thing that needs to start happening to actually motivate the companies to stop allowing this BS. Good luck! Also, don't have your life savings in crypto, but if you must, then please for the love of everything holy don't put it someplace where a SIM swap attack is enough to get it out. Irreversible transactions are kind of the whole point of it, so you need to be much more careful with crypto credentials than, say, your bank password or credit card.
- delfinom 7y agoAnd they'll just hide their binding arbitration clauses.
- sliken 7y agoIndeed, listen to NIST: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
- cik 7y agoIt's rather sad that Canadian banks still view SMS as the best way forward. They'll text you, they'll email you, they'll validate over the phone... all of which are really this same problem. I'm waiting for the days our banks will accept multiple 2FA solutions.
- smnrchrds 7y agoAnd when you (unavoidably) get hacked, they tell you it's your fault and that it sucks to be you, because you are not getting that money back. https://www.cbc.ca/news/business/banks-deny-compensation-online-fraud-security-1.5322982 https://www.cbc.ca/news/business/banks-deny-compensation-onl...
- nothrabannosir 7y agoThis is insane. How are banks not liable for fraud in Canada? The incentives couldn't be worse.
- sdan 7y agoIf you're into crypto, remember: Not your keys, not your coins.
- deleted 7y ago[deleted]
- usaphp 7y ago> and within minutes, the hackers had stolen $1.8 million in cryptocurrency from him > It essentially destroyed our financial future, our entire life savings was stolen Who keeps their entire life savings in crypto?
- judge2020 7y agoWith that much money not using a hardware wallet is short-sighted.
- tyingq 7y agoEven that leaves it in a crazy volatile currency. Adrenaline junkie I guess, assuming it really was their life savings.
- sdan 7y agoI guess you can call most cryptocurrencies volatile but some like BTC and ETH have so much marketcap that it's getting a bit better. Some people truly believe in crypto (and even institutions are... they store in Bakkt) and I guess you have to respect that (pretty sure they understand the risk as well).
- tyingq 7y agoNot faulting them for having significant sums there. But "life savings"? Ouch.
- wmf 7y agoYes, BTC is "only" down 23% in the last month.
- sdan 7y agoI don't want to argue, but it's up 15% since last year (if you bought/sold right you could've also make 400% since last year. I don't personally have anything in crypto, but am watching enthusiastically from the sidelines (and given it's down 23% in the last month is one reason why). At the end of the day you have to look at it from a bigger picture. Since the next halfing is happening in a year, prices will most likely go up (speculation).
- deleted 7y ago[deleted]
- twillio-truth 7y agoSTOP SENSORING ME HACKER NEWS: But wait there is more keep following Twillio... I will reiterate Twillio!!!!!!!!!!!!!! INVESTIGATION ITS TIME!!!!
- fortran77 7y agoHe's got good evidence. The SIM-swappers have actually been convicted. ATT says it's "an industry" problem, but it's 100% their problem. They are doing nothing to stop employees from robbing their customers. Of course the victim could probably have protected his "life savings" better, but that's not the point.
- mikelward 7y agoTheir employees and their systems. Ideally it wouldn't be possible for a single employee to do this.
- dehrmann 7y agoAT&T's going to say "you don't own that phone number--it's ours--and we never said it was intended for verifying your identity. Take it up with whoever stole your number and your--wait, someone stole your cryptocurrency? You realize banks are insured against mistakes like this and bitcoin wallets aren't, right?"
- dev_dull 7y agoLosing your life’s savings in an irrevocable way is a feature of crypto currency. Not a bug!
- aeternum 7y agoExcept AT&T themselves use the phone number as a form of identity verification / 2nd factor so that argument doesn't really hold up. Also insurance doesn't always hold up in cases like this, especially if the company was aware of the weakness and chose to do nothing about it.
- theamk 7y agoWell, most companies, AT&T including, do not have truly irreversible actions. If someone steals your account this way, with enough complaining you will likely get it back, mostly, eventually. Same thing with traditional banking. This breaks down for internet giants which provide free services which can still be very valuable, like gmail, and that’s why they are moving away from it.
- camkego 7y agoThe amazing thing is with Wells Fargo that if you have a RSA SecurID 2FA FOB for access to your bank accounts, and you have a phone number configured for the account, you can use EITHER the 2FA RSA one-time pin, OR SMS verification to log into your bank account web page. I mean this is a bank, are these guys for real?
- dboreham 7y agoYes, although there is actually a lower transaction limit on sessions initiated with SMS 2FA vs SecurID.
- dvdbloc 7y agoWhich almost furthers the point that this is bad, isn’t this an acknowledgement by them that SMS 2FA is less secure? If it’s less secure and you have SecurID, why can’t I disable SMS?
- d-sc 7y agoThere is support cost for disabling sms. While you may be technically inclined to be comfortable with disabling sms, they have to balance the cost of hacking vs support cost for all users.
- 2sk21 7y agoThats really bad. Chase doesn't even offer the option of non-phone 2FA
- gjs278 7y agoI was also sim swapped. maybe I should join.
- runn1ng 7y agoThe lesson here is not to sue AT&T. The lesson here is to stop investing in cryptocurrency.
- colejohnson66 7y agoSo it’s all the guy’s fault for the problem and AT&T has no fault? Could it be they both made a mistake?
- exabrial 7y agoThis is why sms as 2FA is terrible: cell phone companies are not hardened.
- sfteus 7y agoHad this happen to me last week. Thankfully they only tried to get into a few e-mail accounts, which I was quick enough to get into, kill their session, and recover them before any real damage was done. AT&T of course claimed it was impossible for that to happen, despite a different phone showing up in my account, a bunch of unexplained SMS messages I never received, and two calls accessing my voicemail that I didn't make. Currently working on finishing moving passwords from a Google account to my password manager and resetting them all, as well as replacing anything that uses an SMS 2FA with a time based authenticator or other alternative where possible. Planning on getting a FIDO key to use where I can. Also setting up a Voice number on an account that's used for nothing else besides 2FA in the instances where there is no better form of authentication.
- bitcoinmoney 7y agoHow did they know your email password and phone number at the same time?
- sfteus 7y agoThe main e-mail they targeted was included in several breaches, specifically of note the CafePress and Yahoo breaches, but various others as well. I would wager they just compiled data from each until they found something that worked.
- r1ch 7y agoA scary amount of services will let you reset a password over SMS.
- sfteus 7y agoEven more scary with the Yahoo account in particular, I have it set up as an app-based authentication, so I get a popup on my phone if someone tries to log in. However, when they (I assume) clicked the "I don't have access to this, send an SMS instead" message, that notification immediately disappeared, so I didn't even have time to hit the "don't allow" button before it was no longer an option. Google at least seems to have this right, in that when they attempted to do the same with those, the notification was still there. I also received a separate "request to reset account password" which stated it would take like 15 days to occur, and I was given the option to cancel it. Regardless, I think I'm going to try to go hardware key with an TOTP app backup for 2FA going forward, wherever possible.
- dev_dull 7y agoI’ve mostly disabled 2fa via phone where alternatives exist. Unfortunately some services (such as twitter) require you to verify a number (you can sign up, but you’ll quickly be account-locked without providing a number) I’m still wondering why I can’t use Touch ID to do U2F...
- MaxGabriel 7y agoTouch ID support for WebAuthn is live in the latest Chrome!
- darkhorn 7y agoHow do you know if someone has obtained a SIM card with your identity? Do you have a web site for this, like https://www.turkiye.gov.tr/mobil-hat-sorgulama https://www.turkiye.gov.tr/mobil-hat-sorgulama ?
- wmf 7y agoUsually your phone stops working because your old SIM card gets disabled.
- rwmurrayVT 7y agoYou can also add an authorized user or open up an entirely new line. You won't notice until you receive your bill.
- wmf 7y agoWouldn't a new line have a different phone number which wouldn't allow these hacks?
- rwmurrayVT 7y agoYes. It won't allow the number take over, but you will end up with 1+ new iPhones in hand for the attacker. You can swap the number at any point afterward easier than just setting up a new phone at the store with a suspecting employee.
- darkhorn 7y agoWhat if they obtain a SIM card from another mobile provider with a different phone number?
- arminiusreturns 7y agoTo me this is more about the lack of internal controls and auditing of those controls at ATT. I know someone who is a supervisor fairly high up with them and I suspect has abused that power to spy on an ex, but she assures me "he can't because of the internal flags"... I figure there are a multitude of ways around that. Events like this don't give me confidence that I am wrong.
- gertrunde 7y agoI love the response: "This is an industry problem." Translation: "All telcos are equally bad at this, so who are you going to switch to? So why should we bother fixing it? What's in it for us?"
- geofft 7y ago> When FOX 11 reached out to AT&T for comment on the SIM swap lawsuits against them, the company responded “This is an industry problem,” and referred us to the CTIA for more information. And AT&T is the industry leader.
- snappieT 7y agoI don't even see how it's an industry problem - AT&T didn't do thorough verification before swapping the SIM, there's nothing broader about it.
- megous 7y agoPhone number is not something you own, it's just a record on someone else's computer system. It's really weird that it passes as "something you own" part of multi-factor auth for so many serious companies.
- deleted 7y ago[deleted]