5 ms·
One man lost his life savings in a SIM hack, you can try to protect yourself
- dehrmann 7y ago> Ross had approximately $1 million stored in two [cyrptocurrency] exchanges when he was attacked, according to a report by investigators. You know what happens if someone tries this with your brokerage? It takes three days, not one hour, there's a name on the destination account (know your customer), it takes days (at least) to withdraw money from it, and there's a medallion signature on the transfer, so your brokerage is on the hook for it. There's a reason fraudsters are targeting cryptocurrency exchanges: arguably less security, but more importantly, it's easy to quickly and irreversibly transfer the money.
- _bxg1 7y agoI only skimmed the first couple paragraphs but I immediately wondered why no financial protections came into play. That explains it. Sort of a misleading headline.
- ahaseeb 7y agoOnly half of the US deposits are FDIC insured AFAIK
- perl4ever 7y ago"there's a medallion signature on the transfer, so your brokerage is on the hook for it" I'm...not sure that's how it works. Yes, common sense suggests it's much more difficult with conventional financial assets, but is that signature guarantee or whatever you call it protecting you or the institution? In the sense that, if someone successfully forges one, what actually happens next?
- lawfulcactus 7y agoFrom Wikipedia[0]: > A medallion signature guarantee is a guarantee by the transferring financial institution that the signature is genuine and the financial institution accepts liability for any forgery. [0] https://en.m.wikipedia.org/wiki/Medallion_signature_guarantee#Guarantee https://en.m.wikipedia.org/wiki/Medallion_signature_guarante...
- perl4ever 7y agoI'm not sure I understand that. Because the signature guarantee isn't "by" the transferring financial institution, is it? You want to transfer an account from "A" to "B" and you get the guarantee from someone that provides guarantees, call them "C". And if someone forges the guarantee, then "C" never did guarantee anything, so why would they be liable, let alone "A" and "B"? Maybe I'm forgetting how this works... ...reading the wikipedia page, it sounds like the idea is to deal with forgeries of signatures provided to the guarantor. Not with forgeries of the guarantor's approval. Then again, maybe you can't really forge a guarantee as long as it can be looked up or invalidated by their database.
- battery_cowboy 7y agoI think what they are saying is that in the banking system is nearly impossible to steal someone's life savings via a hack and get away with it, or at least if you do they have insurance at the brokerage to cover it.
- Stierlitz 7y agoHow is someone persuading your provider to transfer your number to another provider, a hack?
- dehrmann 7y agoSocial engineering. > Hi, AT&T, I was at the bar last night and I lost my phone. I still have my old phone, though. Can you help me transfer it? Mother's maiden name? Why yes, it is on whitepages.com!
- Stierlitz 7y ago@guessmyname: ‘It sounds like you are not aware of the existence of the term “Social Engineering”.’ Sorry for the delay in answering, “Social Engineering” is not hacking. Manipulating the SS7 protocols for nefarious ends, could be considered hacking. https://blog.securegroup.com/phone-hacking-through-ss7-is-frighteningly-easy-and-effective https://blog.securegroup.com/phone-hacking-through-ss7-is-fr...
- _bxg1 7y agoAnything where you're accessing or affecting an informational system in a malicious way could be called a hack. Social engineering is a mainstay at Def Con.
- ahaseeb 7y agoThere is so much information available online on you which is sufficient for any one to hack you
- garmaine 7y agoYou call the provider's help line and tell the minimum wage call center worker on the other end that your phone has been stolen and you want to assign it to a new SIM code.
- ahaseeb 7y agoNot in our case where we go through 11 step process. In addition to this our staff is highly trained and everytime a request is made, we assume it's an attack
- pcurve 7y agoSomeone tricked ATT that led to swim swap and this guy losing $1 million. Yet ATT "disputes the allegation and intent to prove it in court"? I get the fact that the real crook is the thief, but surely ATT is at least partly negligent. How much are they responsible?
- lotsofpulp 7y agoEveryone is trying to make phone networks the liable party because it’s cheap for them, and the phone networks don’t want to be the liable party. Even the federal government (SSA) uses SMS as 2FA for proof of identity. And unlucky people are caught in the middle.
- EGreg 7y agoThe same Federal Government says not to use SMS for 2FA, for quite a while: https://www.pindrop.com/blog/nist-explains-proposed-ban-on-sms-for-2fa/ https://www.pindrop.com/blog/nist-explains-proposed-ban-on-s... Why should we use outdated and vulnerable networks when social engineering is all you need to steal stuff? This from 2012: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/amp https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking... I encourage everyone to use a hard to guess email alias (foo+bar@gmail.com) for your LOGIN — not password. This thwarts many of these attacks! “Sir, let’s reset your password. What is your email please?” “foo@gmail.com” “Sorry, we have no such user.” “Really? But—“ “Really.”
- lotsofpulp 7y agoATT’s login is the phone number itself.
- ahaseeb 7y agoThrough Efani.com we do take responsibility which is backed by $5M insurance policy.
- lotsofpulp 7y ago
- swizzler 7y agoEnfani (previously don't port) has a product to prevent this: https://efani.com/ https://efani.com/ I haven't used it. I want to, but haven't wanted to deal with changing my family plan. It does make me more interested in a dual-sim phone.
- xivzgrev 7y agoThat’s interesting - I wonder how it actually works, other than some hand wavy military technology? I want to know how it would’ve prevented this social engineering attack
- ahaseeb 7y agoHey - I am Haseeb Founder of Efani. So we deploy atleast 11 ways to authenticate a user over couple of weeks to make sure that this is a legitimate request + use some manual & automated processes to kill any illegal attempt
- ryanlol 7y agoSo how do you protect against attacks on your MNOs? Sure, you can make porting difficult. That doesn’t get you very far.
- ahaseeb 7y agoCan you be more specific with your question ? All the port out are blocked by default & no have access to your account # + our UI & our system is in different silos . Finally we've a $5M insurance policy
- ryanlol 7y agoFor most users the problem is someone intercepting their text messages and then using that access to rob them. Port-outs are one way to accomplish this, but certainly not the only way. Can you defend against sim swap attacks if your MNO is compromised, how? Where can I read more about your insurance policy? I can’t find any specific details on your website.
- htk 7y agoOne could argue that the greatest weakness in this case is in holding your life savings in cryptocurrency.
- ahaseeb 7y agoHave happened to people having a bank account as well
- battery_cowboy 7y agoNot only that, but holding it in a way that they can get to it. If I had a million bucks in crypto, I'd have a few geographically separate offline laptops with the codes on them, fully encrypted, as cold storage.
- ahaseeb 7y agoPeople are generally lazy and it has happened to non-crypto folks too where other information was stolen
- battery_cowboy 7y agoIt's rare to impossible to do this to a regular bank account, and if they did, the bank would be liable. Crypto is a great solution for some stuff, but it's not a pancea to solve every problem.
- crobertsbmw 7y agoSIM companies could prevent a lot of cases by trying to call or text the phone that is currently active on the SIM. If AT&T would have called the number then it’s likely this could have been prevented.
- ahaseeb 7y agoATT is built around selling you cheap plans and the SOPs are not that strong. There are 1000s of ports every days so they want to make it simple for their employees
- LatteLazy 7y agoNo actual guide on how to protect yourself. In fact, none of the carriers listed seem to do anything remotely effective. Seems like the best answer is to not reuse passwords, use complex passwords and avoid giving "real" answers to security questions. And if course, don't keep your life savings in an account that can be withdrawn entirely on a moments notice...
- ahaseeb 7y agoI have been a victim 4 times which is the reason I built Efani.com
- byteshock 7y agoCould you explain how your company defends against these attacks? From a quick look at your website, it looks like you are offering prepaid services through different providers similar to H20 Wireless. You claim to offer protection but give no detail on it except that you use "military grade protection".
- ahaseeb 7y agoYes updating the website this week with complete information. Our arrangement is somewhat similar to any other MVNO with just that we've blocked sim port attacks & have specific measures in place along with a $5M insurance
- kranner 7y agoAnother step one can take is to use a separate number for authorising banking transactions. This number should be 'unlisted', i.e. not shared with anyone but your bank(s).
- hn_throwaway_99 7y agoShould never use phone number as a second factor with a crypto exchange. At the very least use an authenticator app, better yet hardware keys.
- ahaseeb 7y agohttps://www.issms2fasecure.com/ https://www.issms2fasecure.com/ This is a great resource on this issue