5 ms·

Had this happen to me last week. Thankfully they only tried to get into a few e-mail accounts, which I was quick enough to get into, kill their session, and rec

by sfteus 7y ago

Had this happen to me last week. Thankfully they only tried to get into a few e-mail accounts, which I was quick enough to get into, kill their session, and recover them before any real damage was done. AT&T of course claimed it was impossible for that to happen, despite a different phone showing up in my account, a bunch of unexplained SMS messages I never received, and two calls accessing my voicemail that I didn't make. Currently working on finishing moving passwords from a Google account to my password manager and resetting them all, as well as replacing anything that uses an SMS 2FA with a time based authenticator or other alternative where possible. Planning on getting a FIDO key to use where I can. Also setting up a Voice number on an account that's used for nothing else besides 2FA in the instances where there is no better form of authentication.

bitcoinmoney 7y ago
How did they know your email password and phone number at the same time?
- sfteus 7y ago
  The main e-mail they targeted was included in several breaches, specifically of note the CafePress and Yahoo breaches, but various others as well. I would wager they just compiled data from each until they found something that worked.
- r1ch 7y ago
  A scary amount of services will let you reset a password over SMS.
  - sfteus 7y ago
    Even more scary with the Yahoo account in particular, I have it set up as an app-based authentication, so I get a popup on my phone if someone tries to log in. However, when they (I assume) clicked the "I don't have access to this, send an SMS instead" message, that notification immediately disappeared, so I didn't even have time to hit the "don't allow" button before it was no longer an option. Google at least seems to have this right, in that when they attempted to do the same with those, the notification was still there. I also received a separate "request to reset account password" which stated it would take like 15 days to occur, and I was given the option to cancel it. Regardless, I think I'm going to try to go hardware key with an TOTP app backup for 2FA going forward, wherever possible.
lotsofpulp 7y ago
Did you have a PIN setup with ATT? I am trying to figure out which of their employees can modify the account without the PIN.
- rwmurrayVT 7y ago
  There are thousands of AT&T and Verizon accounts for sale online with PIN, SSN, DoB, email address, email password, etc. Some of them are paired with known bank account login information, credit report, etc. They're less than 300 USD.. Once you have the phone and information you can either use fake ID + SSN + phone to use established credit line at a retailer or if you have banking information perform a wire transfer. It's rampant.
- thatguy0900 7y ago
  As of a year or two ago when I worked at a authorized att dealer, manager logins can access any account without a pin and any employee can access prepaid accounts without a pin. Edit:for whatever its worth att does keep a record of what employees accessed an account and when, and notes when managers bypass the pin, so doing this an an employee seems really stupid to me.
  - sfteus 7y ago
    Interesting, I figured since they claimed that wasn't possible that they didn't keep records. I'll have to go bug them again to see if they can investigate it further. I'm not sure if this was an instance of targeted social engineering or an employee, though I would assume the former is more likely.
    - thatguy0900 7y ago
      I'm not sure what customer service policy is about telling customers but in store at least we definetely had a notes section of every account with breakdowns of what internal usernames accessed the accounts and when. The fraud dept I assume would be the ones to look at who the employees were from the usernames but we didn't handle that kind of stuff at the authorized retailer stores so no advice to give you unfortunately :/
sneeze-slayer 7y ago
One thing I've noticed lately is that Google Voice numbers are working with fewer and fewer companies. For example, I don't think that they work with Wells Fargo or Chase. Wells Fargo said flat out that the phone number can't be validated.
- sfteus 7y ago
  That's interesting, I appreciate the heads up. I'll have to see if I can find some other workaround whenever that pops up.
  - 29083011397778 7y ago
    I've been using Voip.ms to pretty reasonable success. They support most SMS short codes, and everything else I've needed it for has worked as a voice call.
vonseel 7y ago
Are things like this usually targeted, I.e. the hackers know enough about you to know who you are and you probably know their names or at least know someone they know? How do hackers even pick their targets?

by sfteus 7y ago

bitcoinmoney 7y ago

How did they know your email password and phone number at the same time?

sfteus 7y ago
The main e-mail they targeted was included in several breaches, specifically of note the CafePress and Yahoo breaches, but various others as well. I would wager they just compiled data from each until they found something that worked.
r1ch 7y ago
A scary amount of services will let you reset a password over SMS.
- sfteus 7y ago
  Even more scary with the Yahoo account in particular, I have it set up as an app-based authentication, so I get a popup on my phone if someone tries to log in. However, when they (I assume) clicked the "I don't have access to this, send an SMS instead" message, that notification immediately disappeared, so I didn't even have time to hit the "don't allow" button before it was no longer an option. Google at least seems to have this right, in that when they attempted to do the same with those, the notification was still there. I also received a separate "request to reset account password" which stated it would take like 15 days to occur, and I was given the option to cancel it. Regardless, I think I'm going to try to go hardware key with an TOTP app backup for 2FA going forward, wherever possible.

lotsofpulp 7y ago

Did you have a PIN setup with ATT? I am trying to figure out which of their employees can modify the account without the PIN.

rwmurrayVT 7y ago
There are thousands of AT&T and Verizon accounts for sale online with PIN, SSN, DoB, email address, email password, etc. Some of them are paired with known bank account login information, credit report, etc. They're less than 300 USD.. Once you have the phone and information you can either use fake ID + SSN + phone to use established credit line at a retailer or if you have banking information perform a wire transfer. It's rampant.
thatguy0900 7y ago
As of a year or two ago when I worked at a authorized att dealer, manager logins can access any account without a pin and any employee can access prepaid accounts without a pin. Edit:for whatever its worth att does keep a record of what employees accessed an account and when, and notes when managers bypass the pin, so doing this an an employee seems really stupid to me.
- sfteus 7y ago
  Interesting, I figured since they claimed that wasn't possible that they didn't keep records. I'll have to go bug them again to see if they can investigate it further. I'm not sure if this was an instance of targeted social engineering or an employee, though I would assume the former is more likely.
  - thatguy0900 7y ago
    I'm not sure what customer service policy is about telling customers but in store at least we definetely had a notes section of every account with breakdowns of what internal usernames accessed the accounts and when. The fraud dept I assume would be the ones to look at who the employees were from the usernames but we didn't handle that kind of stuff at the authorized retailer stores so no advice to give you unfortunately :/

sneeze-slayer 7y ago

One thing I've noticed lately is that Google Voice numbers are working with fewer and fewer companies. For example, I don't think that they work with Wells Fargo or Chase. Wells Fargo said flat out that the phone number can't be validated.

sfteus 7y ago
That's interesting, I appreciate the heads up. I'll have to see if I can find some other workaround whenever that pops up.
- 29083011397778 7y ago
  I've been using Voip.ms to pretty reasonable success. They support most SMS short codes, and everything else I've needed it for has worked as a voice call.

vonseel 7y ago

Are things like this usually targeted, I.e. the hackers know enough about you to know who you are and you probably know their names or at least know someone they know? How do hackers even pick their targets?