4 ms·
Device ID > "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones" SMS > "... repo
by yonixw 6y ago
Device ID
> "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones"
SMS
> "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs"
GPS
> "spoofed GPS locations the device was known to use."
If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day vulnerabilities).
The only solution might be to ban certain phone models (usually the cheap ones...)
- lmm 6y agoIssue their own hardware tokens to customers? A FIDO NFC key can be pretty cheap, though I guess the really low-end phones might not have NFC.
- kube-system 6y agoSMS is mostly popular today because it’s user friendly. I can’t imagine that most users would like carrying around separate hardware tokens. I would imagine there’s some point at which there’s an equilibrium between fraud costs and customer acquisition/retention costs.
- lmm 6y agoMine lives on my keyring and is smaller than my house key or bike key, and I'd argue holding it against the back of my phone is actually more user friendly than typing in a number from a text message.
- kube-system 6y agoIt's convenient if you have one. If you had one for each financial institution you deal with, it might be a different story.
- lmm 6y agoIt's a smaller inconvenience than one more key on my keyring, so a handful of them wouldn't be a big problem.
- Cthulhu_ 6y agoYes, off-device 2FA like a yubikey or the stuff I described in another comment. Anything that involves using your bank card and a secret that only you know (like a PIN code), separate from your account details.
- yonixw 6y agoAren't yubikey require NFC or USB OTG? My phone support neither. Is expensive phones the only solution? If so then my blacklist solution still stands.
- wlesieutre 6y agoThere are dedicated hardware tokens that don't require any particular support on your phone, you copy the number just like if you were using an app to generate TOTP codes except it's on a little LCD screen instead. https://www.cdw.com/product/RSA-SecurID-SID700-Enterprise-plus-hardware-token/3568618 https://www.cdw.com/product/RSA-SecurID-SID700-Enterprise-pl... Phone apps have largely replaced them but for my bank I wouldn't mind having a separate device that's not internet connected. But they cause other issues, like being one more little device to lose and not providing accessibility features like a phone app does (good luck if you're blind).
- sbarre 6y agoYet another example of why SMS shouldn't be used for 2FA ever. Besides the fact that Sim-swap attacks are still super common, if they've compromised the Android devices themselves (as is implied in the article) then they could grab the Device ID that way and potentially add some SMS-forwarding malware perhaps?
- vmception 6y agoThey probably run a mobile app ad network for a freemium game and know which phone numbers pay the most. Would explain the preparedness for phone emulation and the thought of it too. Same regarding GPS, this is really prevalent on darknet market tutorials and services, where you get the ID and credit card of someone (large markets for that called fullz) and then find a compromised windows computer near that residential/billing address (there are whole markets for that called rpc, sorted by bandwidth and location) and then run the credit card but from a computer near where the owner lives, to avoid being flagged. What happened here seems to be a mixture of those concepts, to address bank accounts without getting flagged.