6 ms·
In Australia it's mandated you're sent a message before rerouting or migrating to another provider. Surprised this isn't enforced in the other countries, it cos
by Mandatum 6y ago
In Australia it's mandated you're sent a message before rerouting or migrating to another provider. Surprised this isn't enforced in the other countries, it costs next to nothing to implement and is just an additional step in the account migration process.
I'd love to see companies allow for opt in additional security measures, like banks or telco's calling me - having a verbal password to confirm things, that level of security seems to only be available to VIPs.
- lxgr 6y agoI think this particular issue is specific to North America, due to peculiarities of the NANP phone number scheme (inter-provider texts are routed quite differently from voice calls, if I understand it correctly). In other countries, the two channels are more closely coupled (but SIM swap and/or number porting attacks are still possible, depending on the provider‘s security protocols).
- batiudrami 6y agoSIM swaps are relatively easy in Australia, requiring only some fairly simple social engineering of staff in a phone store. Number porting is trickier, requires a name and account number (or DOB in the case of a prepaid account) of the victim and they receive an SMS informing them their number was ported in advance.
- Mandatum 6y agoYeah getting thee account ID can be a pain, I've learned that the number in the UI and bill is not the identifier they want. Security by poor implementation.
- incompatible 6y agoI couldn't even get my own number ported in Australia (to a new provider on a new SIM). The old provider said the authentication failed. I gave up pretty quickly and just went with a new number.
- pabs3 6y agoI thought they require ID for buying SIMs in Australia, surely they also require ID for switching your number to a new SIM?
- paranoidrobot 6y agoThat requirement is there for new or ported-in services. But when you Sim swap, it's tied to the same account. So if you can convince the minimum wage hourly wage contract employee at a franchisee that you're the account holder, no worries. Worse, most of those stores are using generic accounts and/or passwords. Telstra years ago had a policy along the lines that store accounts could be not tied to a specific employee, so long as the store manager/team leader rotated the passwords and kept records. in reality it's something stupidly guessable that rotates only when required and all the staff know them. Optus effectively has the same thing - I had an issue getting a SIM established and sat with an employee for about an hour as they re-rolled the account about 10 times. By the end I knew the passwords for all the accounts in the store, plus other identifiers and numbers.
- tialaramex 6y ago> due to peculiarities of the NANP phone number scheme I suspect more like due to peculiarities of the United States of America. Such as a disinclination to regulate anything, trusting that somehow this time the most profitable course for corporations will also work out OK for its citizens even if it didn't on previous occasions. This report lists a long chain of buck-passing companies that have exploited an obvious defect and then escaped any responsibility for the consequences. Notice how the only work they made the hacker do was legal paperwork to cover their backsides, no actual technical countermeasures. Because nobody at these companies cared if it was used this way, they only wanted to make sure if they got sued they would be able to blame somebody else and get away with it.
- cabaalis 6y agoPretty sure a hacker would be perpetrating an actual, punishable-by-trial crime in forging those legal documents. That's generally the first regulation that the US imposes. A disinclination to regulate anything is a good idea in a society that generally punishes bad behavior after the behavior has been perpetrated. I would have doubts for instance about government regulating the process for sending and receiving SMS - would you want every new software or protocol to have to go through some kind of bureaucratic review before it can be used?
- kevin_thibedeau 6y agoThat doesn't work well when the criminals are working from a sunny foreign beach resort.
- coliveira 6y agoExactly, the only thing that the US achieves is creating thieves that have a propensity to go big fast, so they can forever evade the law.
- pdpi 6y agoA key part of regulation is placing the onus of solving problems on those best equipped to solve them. You don’t need the government to mandate what the protocols should be, you just fine carriers for allowing this sort of bad outcome and let them sort things out.
- tehwebguy 6y agoSomeone is going to have to take one for the team and SIM swap a senator if we ever want that requirement in the states.
- rkho 6y agoFollowed by a six month government contractor bidding process, two years of development hell, and a half-based solution that either doesn't work or requires fifty extra convoluted steps.
- wpietri 6y agoNah, it's cheaper and easier for them to mandate that the companies take care of it.
- eloisius 6y agoThey do but then the companies pay it forward to their customers. There’s a whole list of itemized fees on a cellular bill. Those aren’t collected “for” the government. The company is just itemizing it for you, probably so that they can neglect to advertise it in their contract sticker price.
- TuringNYC 6y agoAnd a monthly "Regulatory Recovery Fee" to make the customers pay for it in perpetuity.
- sevencolors 6y agoExcept they'll just punish the "hacker", make a big fuss about it, then the Telco's will donate money to the senator till they drop it.
- HenryBemis 6y ago> will donate money Sakari (and the likes) will complain that government regulation is keeping the food of the hard workers table, and the gov has no right to intervene to the free market!! In parallel they will 'lobby' (or as we call it in Europe "bribe") the key politicians and ask to a) either change that Bill down to the point that it is rendered useless, or b) cancel it altogether, and stock market will go up!!
- tsjq 6y agoSame in India too. And the reply SMS contains a code that needs to be given to the destination provider, for the MNP process to proceed.
- Mandatum 6y agoI've only seen this extra step implemented by some providers.. It's definitely not the norm.
- zaphirplane 6y agoThat is so sane, seriously sometimes it boggles the mind how banks to online stores will sms you to confirm ur identity yet sim swap is easy as it
- katbyte 6y agoIn Canada with tell you can put a “lock” on your account so there is additional steps like going into a store with is to remove it before you can port a number of sim swap (I think) Still don’t use my phone number on my google accounts thou
- mike_d 6y agoYou can do the same in the US. However the bad guys just recruit low level retail employees to do the SIM swaps (which happens in Canada too).
- contingencies 6y agoNice one. My neighbour chaired the Australian inter-carrier roundtable implementing mobile phone number portability. I will send him a note! Other cool hacks of his: automatic video advertising scheduling system once saved Channel 9(?) from airing a gas oven ad during a Holocaust documentary. Scored a bonus for that one.
- zaphirplane 6y agoThe ads are scheduled to be shown automatically? I thought advisers choose the show and pay for it
- efreak 6y agoHow is that a hack?
- cskinner 6y agoBack in the early days of mobile number portability the majority of telcos put in systems to make porting out harder, e.g. getting an unlock code. This gave them a chance to keep the customer when they called up. Regulators (particularly in Europe) soon put a stop to that to promote competition. While this was good, the majority of regulators failed to put in a consumer protection mechanism to stop identity theft through account stealing. The article describes a more insiduous attack, as the mobile account is still active (hiding the existence of the attack from the user), but the message destination has been rerouted, making all the linked accounts that use SMS as their 2FA also vulnerable.
- heroprotagonist 6y agoI tried to get T-Mobile to stop giving my location to anyone that hits their APIs with a 'Yes I have permission' flag set. There's no opt-out for it, and no enforcement of the permission requirement. Their support had me snail mail a letter to some PO box. I never got a response. And now they're going to start outright selling their customer activity after forcibly un-opt-outing* everyone who opted out in their privacy settings previously.. *un-opt-outing -- ??? I don't know what to call this. It's not 'opting-in' since nobody has a choice.. 'resetting user selection without notification or consent' seems too mild and wordy.
- Sleepytime 6y agoI haven't heard anything about a t-mobile api leaking that data and my searches doetsn't return anything of value, can you provide more details?
- heroprotagonist 6y agoIt's not just T-Mobile, it was most US carriers. Some examples: - Vice paid a bounty hunter $300 to track a phone number [1] - Police have paid these services to avoid warrant requirements, and corrections facilities use aggregator services to track numbers that inmates have calls with [2][3] Apparently carriers claim to have stopped after getting fined $200m last year [4]. It was typically done through aggregators. EG, services that have similar access to multiple carriers and in turn expose a single endpoint to their own customers. The aggregators pass on responsibility for obtaining consent to their end customers. Again, with no enforcement or ability for a target to opt out. The only protection is an authentication requirement. But that just confirms you have a valid credential. Which you get either as an aggregator (to tmobile/other carrier directly), or as the client to an aggregator (to the aggregator's API to query multiple carriers). Though even that authentication requirement has failed in the past, like when LocationSmart had a public demo page exploited. Inspection of the requests the page sent made it trivial to replay them with any phone number, skipping any consent checking. They just had to add "privacyConsent":"True" to the payload [5]. But yeah, it sounds like that is less of a worry now. Instead, T-mobile is selling the location data, and basically anything whatever usage data they collect from your phone with their root-privileged app to advertising networks. They say it's a Although their privacy page has this statement [6]: > We do not use or share Customer Proprietary Network Information (“CPNI”) or precise location data for advertising unless you give us your express permission. The 'express permission' here is deceptive. Users default to permit this, so it's hardly 'express'. Further, they recently mass reset user preferences to clear the opt-out setting for users who previously opted out. Without consent. So basically everyone is 'consenting' unless they very recently opted-out. Though I have little faith they won't change this from underneath their users again in the future. No doubt in the fine print of one of those 'annual privacy notices' or some such. Still, if the wording and definition of 'express consent' is questionable above, they word it more explicitly in the more detailed privacy policy [7]: > We and others may also use information about your usage, device, location, and demographics to serve you personalized ads, measure performance of those ads, and conduct analytics and reporting. Their privacy page is deceptive about how anonymized their collection is [6]: > When we share this information with third parties, it is not tied to your name or information that directly identifies you. Instead, we tie it to your mobile advertising identifier or another unique identifier. Tying it to a mobile advertising id, or any kind of unique identifier, is not de-identification. It is trivial to tie this to an email or a larger profile generated by an advertising network and combine with, say, your desktop web browser. Or any account you login with that is associated to your email.. It's despicable. But sorry, I'll stop ranting now. [1] https://www.vice.com/en/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile https://www.vice.com/en/article/nepxbz/i-gave-a-bounty-hunte... [2] https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html https://www.nytimes.com/2018/05/10/technology/cellphone-trac... [3] https://www.zdnet.com/article/us-cell-carriers-selling-access-to-real-time-location-data/ https://www.zdnet.com/article/us-cell-carriers-selling-acces... [4] https://www.nationalheraldindia.com/international/over-dollar200-million-fine-for-major-us-carriers-for-selling-user-location-data https://www.nationalheraldindia.com/international/over-dolla... [5] https://www.robertxiao.ca/hacking/locationsmart/ https://www.robertxiao.ca/hacking/locationsmart/ [6] https://www.t-mobile.com/privacy-center/our-practices/privacy-policy https://www.t-mobile.com/privacy-center/our-practices/privac... [7] https://www.t-mobile.com/privacy-center/education-and-resources/advertising-analytics https://www.t-mobile.com/privacy-center/education-and-resour...