3 ms·
In order to access your Coinbase account, these third parties first needed prior knowledge of the email address, password, and phone number associated with your
by jefftk 5y ago
In order to access your Coinbase account, these third parties first needed prior knowledge of the email
address, password, and phone number associated with your Coinbase account, as well as access to your
personal email inbox. While we are not able to determine conclusively how these third parties gained
access to this information, this type of campaign typically involves phishing attacks ...
Even with the information described above, additional authentication is required in order to access your
Coinbase account. However, in this incident, for customers who use SMS texts for two-factor
authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in
order to receive an SMS two-factor authentication token and gain access to your account.
We will be depositing funds into your account equal to the value of the currency improperly removed
from your account at the time of the incident. Some customers have already been reimbursed -- we will
ensure all customers affected receive the full value of what you lost
- Fiahil 5y agoWell, it's not like Coinbase should be blamed for all of it. It's a combination of their customer's poor hygiene + a flaw in Coinbase’s SMS Account Recovery process. At least they will be reimbursed, and everyone should walk happy.
- vngzs 5y agoAnyone care to speculate what the flaw in their SMS recovery flow actually was? It's hard for me to think there's even a safe way to implement SMS based account recovery. They would be smarter to just turn it off.
- floatingatoll 5y agoI do not have specific answer for Coinbase. Typically, the flaw would be in modifying one of the form inputs to get the code delivered to a different phone number. That usually works out to either modifying the "destination number" client-side form value, or swapping in an edited/reused session token from a different login session's MFA challenge, to exploit missing ownership checks on the various underlying pkey object IDs.
- gowld 5y agoSMS is fundamentally insecure, yes. But this sounds like a problem in the webapp that prepares and sends SMS messages, not SMS itself.
- gowld 5y ago> everyone should walk happy. The reimbursement comes from somewhere. Investors may not be happy. "everything is securities fraud" https://www.google.com/search?q=%22everything+is+securities+fraud%22 https://www.google.com/search?q=%22everything+is+securities+...
- latchkey 5y agoI'm guessing their insurance didn't cover it since it related to insecure account practices. So this is likely from their own revenues. https://help.coinbase.com/en/coinbase/other-topics/legal-policies/how-is-coinbase-insured https://help.coinbase.com/en/coinbase/other-topics/legal-pol... I don't see the connection with your link to securities fraud though.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]