12 ms·

Coinbase made everyone whole, and the attackers stole the credentials (not because of Coinbase's fault) ahead of time, and the attackers had to perform a "SIM s

• 8BPATUNNTBU 5y ago
  >> Coinbase made everyone whole No, I don't think they have. The document says they will, not that they have. I personally know someone who was had 2FA and tends to be security knowledgeable and was struck by this on 6/7, which is well past their claimed date, so either they are lying or the hacking continues undetected. He has had no ability to get anyone on the phone who will help with the issue. He lost less than $2,000, but it is ridiculous how crypto currency combines the worst of the wild west with the worst of banking with the worst of crappy customer service.
  • toomuchtodo 5y ago
    > but it is ridiculous how crypto currency combines the worst of the wild west with the worst of banking with the worst of crappy customer service. Crypto's value is because it is the wild west. Otherwise, it'd be gold: custodians holding the commodity for owners, most of it locked in cold storage, fully regulated, and governments pursuing theft whenever reported. Eventually, the end state desired will be reached (regulation, customer service, insurance, pursuit of value theft, etc), it's just taking time for governments and Big Finance to catch up. EDIT: https://www.cnbc.com/2021/10/01/defi-protocol-compound-mistakenly-gives-away-millions-to-users.html https://www.cnbc.com/2021/10/01/defi-protocol-compound-mista... (DeFi bug accidentally gives $90 million to users, founder begs them to return it) https://en.wikipedia.org/wiki/Cryptocurrency_and_crime https://en.wikipedia.org/wiki/Cryptocurrency_and_crime
    • rednerrus 5y ago
      We already have all of those things.
    • gregwebs 5y ago
      Bitcoin is a self custody asset just like gold, and IMHO that and it's de-centralized exchange is actually where all the value comes from if it has any. People do own gold and store it on their own property as well. Gold owners also use responsible custodians when they don't store the gold themselves. I think bitcoin owners do not do the same because they want to have easy access to trading and there aren’t companies that both operate trading and are either responsible custodians or make it easy to use a different custodian for storage.
    • wpietri 5y ago
      So if its value is in it not being regulated and you think governments will catch up, you're saying that it will eventually become worthless. If so, I agree. I'm just surprised to see it stated so baldly.
  • Seattle3503 5y ago
    Some exchanges have good customer service, but Coinbase isn't one of them. They went the route of minimizing customer support staff that many tech companies do.
  • webinvest 5y ago
    Big difference! I have personal experience of Coinbase emailing me (in writing!) that I’d get a bank overdraft fee refunded from their system-wide mistake of double-charging cryptocurrency orders. This happened right before their IPO. Long story short, I was never refunded despite raising two support tickets. :(
• lambic 5y ago
  *Californian government.
  • deleted 5y ago
    [deleted]
• detaro 5y ago
  > had to perform a "SIM swap" type attack on the users. source? I kind of doubt that's something coinbase would call a flaw in their system?
  • vngzs 5y ago
    In the linked PDF, Coinbase does not claim to have knowledge of a vulnerability in their system (edit: though it does note "the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process," I interpreted that as "we supported SMS account recovery at all" which is inherently broken [0]). The requisite two-factor bypass is detailed in the linked pdf: > Even with the information described above, additional authentication is required in order to access your Coinbase account. However, in this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account. My guess is, because funds were stolen from users' accounts, the CA breach notification laws apply and this needed to be disclosed as such. However, that doesn't necessarily mean that Coinbase was technically "breached," only that customer accounts were compromised. If the attacker controls your personal email associated with Coinbase, accompanying passwords, and phone number, and you use SMS 2FA, then your funds were stolen. Otherwise, they were safe. That's my reading of the article. [0]: https://krebsonsecurity.com/2019/08/who-owns-your-wireless-service-crooks-do/ https://krebsonsecurity.com/2019/08/who-owns-your-wireless-s...
    • deleted 5y ago
      [deleted]
    • detaro 5y ago
      They also say "we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process". What did they update if it wasn't due to a weakness on their side? EDIT: on reading some of their docs, recovery is supposed to be followed by the user submitting ID documents etc before they get full access back - maybe that's the part they didn't do before or that could somehow be circumvented? (which is a flaw, but still requires intercepting the SMS to use?)
• space_rock 5y ago
  Agree. Although I would like coinbase to move away from SMS 2fa
  • agumonkey 5y ago
    I don't know about you, but in the days of smartphones, login + mail + sms seems pointless. The only lock is the pin code / fingerprint on your phone, since when that is unlocked, the attacker gets to trigger all validation steps.
    • opheliate 5y ago
      The important part is having physical access to the phone. A targeted attack against you now requires a physical element, rather than being entirely online.
      • danuker 5y ago
        Assuming the phone is not remotely exploited.
      • willvarfar 5y ago
        Agree with everything you say, but add to that a lot of sms 2fa exploits are sim or redirection attacks. It’s possible to get access to a phone number without access to the phone. Here’s an old story of a friend who had a weird talk with someone who had redirected their phone: https://williame.github.io/post/24949768311.html https://williame.github.io/post/24949768311.html
  • mdavis6890 5y ago
    They already support other forms of 2FA, so I guess you mean they should turn off support for SMS. Keep in mind that for many users the alternative is no 2FA at all (they don't browse HN and Krebs), which is much, much worse. Coinbase should continue doing what they are doing, which is to support SMS, and educate and encourage users where possible to use something else instead.
• syshum 5y ago
  They would not be required to have all that info for an attacker to steal if it was not for the ridiculous reporting and KYC laws of the US
• sangnoir 5y ago
  > ... the attackers had to perform a "SIM swap" type attack on the users Minor nitpick: I find your framing problematic as it transfers "burden of security" to the end-users over a process that did not involve them: this was not an attack on the users - it was an attack on the telecoms infrastructure. I have a similar gripe against "identity theft", which really ought to be "fraud against corporation X, using false identity" - however, that framing is necessary to make consumers accept, by default, the burden of clearing debts they were never party to simply because the defrauded party did not have adequately verify perpetrators identity.
  • heleninboodler 5y ago
    A point very well made by Mitchell and Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
    • tompazourek 5y ago
      This is brilliant.
  • vngzs 5y ago
    I agree. From Coinbase's perspective, they ought to defend their infrastructure against fraud, whether that is a direct attack on the users, an attack on the users' telcos, or insider activity directly. From the telco's perspective, they have a responsibility to stop SMS and SIM fraud, and our regulations have failed to properly hold them accountable in this domain. I would add that the users have some responsibility for losing their emails/passwords, but my initial framing insufficiently demands responsibility for the service providers in this instance. The service providers should be expected to take all reasonable steps to prevent fraud on their platforms, and that should include extra scrutiny of SMS-based authentication mechanisms (e.g., identity verification). This is why Coinbase paid them back, accepting some responsibility for the fraud.
    • sangnoir 5y ago
      I fully agree that users are not absolved of all responsibilities or vigilance (e.g. over passwords/devices). I think the legal framework has to be overhauled to clarify the culpability of all parties involved, rather than the current "Sucks to be you" attitude towards consumers, who are the least powerful, and have the least agency in these issues.
• nickthemagicman 5y ago
  if they did a SIM swap that means that they compromised the user's phone, if I'm not mistaken.
  • sneak 5y ago
    You are mistaken. A SIM swap is a compromise at the carrier, not the handset.
    • nickthemagicman 5y ago
      Ah so how is this Coinbases fault I also dont understand? Seems like a carrier issue.
      • sneak 5y ago
        Coinbase shouldn't have been using SMS as 2FA to begin with. They also had a security bug in their SMS-based recovery system, according to other commenters in the thread.
• RangerScience 5y ago
  Huh. 3 or so years ago, I got SIM-swapped and they ran away with my Coinbase crypto, and CB definitely never made me whole.
• tgtweak 5y ago
  It was not a simswap/simjack attack, they exploited an oversight in coinbase's password-reset 2fa to send the challenge code for one user to another user's phone number.
  • vngzs 5y ago
    I haven't been able to verify these sort of claims any more than I've been able to speculate it was blanket telco Letters-of-Authorization (LoAs) [0][1] or classic SIM swaps that resulted in the account takeovers. I'm not claiming you're wrong, but given the timing of the LoA fraud and the attacks, it seemed likely to me that this was not an actual web vulnerability. What makes you believe a specific exploit like that existed against Coinbase's 2FA? And if it existed, then why wasn't that caught in a routine pentest? [0]: https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s... [1]: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
    • tyingq 5y ago
      Coinbase themselves called it "a flaw in Coinbase’s SMS Account Recovery process".[1] I don't think they would have used that phrasing if it were individually simjacked phones. [1] https://oag.ca.gov/system/files/09-24-2021%20Customer%20Notification.pdf https://oag.ca.gov/system/files/09-24-2021%20Customer%20Noti...
      • vngzs 5y ago
        With only the pdf to go on, I address the "flaw" in more detail in these comment threads [0] [1]. In short, I believe the "flaw" is likely to be "we used SMS for identity verification, without additional necessary scrutiny." The technical barrier to entry for accruing and using breach databases is near-zero [2], same with the barrier to SMS fraud. Both are routine and easy methods for criminal groups with no special technical abilities, and therefore they are likely. Since the onus is on Coinbase to do identity verification in account recovery, a large number of successful takeovers would be a "flaw" in their process, even if it's not a technical flaw (which I would expect to be expressed in language like "vulnerability"). Accepting untrusted, unauthenticated user input as a SMS verification number would be a serious login-related flaw, and certainly Coinbase pentests their login pages. Any competent pentester would discover such a flaw. So between "Coinbase shipped a critical and obvious login flaw to prod" and "a routine and common criminal tactic was employed successfully against them," I find the latter more likely. [0]: https://news.ycombinator.com/item?id=28720101 https://news.ycombinator.com/item?id=28720101 [1]: https://news.ycombinator.com/item?id=28720520 https://news.ycombinator.com/item?id=28720520 [2]: https://xkcd.com/2176/ https://xkcd.com/2176/
• tobstarrr 5y ago
  Question as they did not mention Sim Swap in the email. Was this confirmed somewhere? "the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account". I'm personally more familiar with incidents using SMS stealers (mobile malware) or use of SS7 vulnerabilites due to my job. Telcos in our country (europe) run tight security on SIM swaps. I was surprised about their recommendation to use time-based OTPs. They basically have the same attack vectors as SMS minus independent channel sign-what-you-see capabilites. Edit: Answer was in other comments
• hourislate 5y ago
  >(not because of Coinbase's fault) From the Coinbase statement >the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process Your speculation and conjecture dismisses you from any and all future discussions on this matter. You have demonstrated that your are unfit to comment.
• 5faulker 5y ago
  Funny that Canada is the other way around (gov.ca)
• amznthrwaway 5y ago
  Attackers did not have to perform a sim-swap attack. Coinbase provided a refund of the dollar value of the assets when they were taken, _not_ a return of the same assets. I’d appreciate if you update your comment to be accurate; though I fully understand that you are being intentionally dishonest out of disrespect to HN users. And I fully understand that dishonest comments like yours are considered to be absolutely acceptable by Dan Gackle.
• mmaunder 5y ago
  > "Breach" may be the required term for the Californian government, but this wouldn't qualify to most people as a traditional breach 6000 customers affected. If it wasn't a YC company you'd never say that.
• hartator 5y ago
  > i.e., compromise of Coinbase's infrastructure How is this not? 2FA is not to 2FA is you can recover your account with just a text. It does seem a bad engineering decision on their side.
• biushdfjsdf 5y ago
  Even though I stopped using coinbase, I appreciate the company compared to others because: 1) They had a reasonable account recovery process after I lost my phone and therefore google authenticator. Binance's process was needlessly annoying and pointless, kucoin straight up decided this was a good opportunity to just block my account completely and steal my money, even after email verification, as well as me supplying all emails they sent me about account activity. 2) They were the most transparent about new requirements about identity verification than others, and still allow withdrawals without verification. 3) Best UI in the game.