7 ms·

Although I'm certainly no celebrity / important likely target of hackers, I'm interested in this just because recently I've gotten paranoid about my financial a

Although I'm certainly no celebrity / important likely target of hackers, I'm interested in this just because recently I've gotten paranoid about my financial accounts (after a company I used to work for finally went public and I was fortunate to cash out an amount of $). When hackers use such exploits, do they then basically have something like remote control over your phone, and can start exfiltrating data / manipulating apps while you're not paying attention? Or what do they do with it then? Are you able to tell, by seeing your phone slow down or start to have unexplained screen behaviors? Suppose that I'm logged into my Google apps on my phone, does that mean they have access to all my gmail, google docs, etc. as well? Do these kinds of exploits also exist/get used to target people on their laptops and desktop machines as well? Or is that a little less likely, since your phone is specifically identified with you and people can easily go after your known phone number? I wonder if there is some resource where people can read about how to detect and avoid such exploits and protect against them?

throw8932894 5y ago
Someone who has access to Pegasus is not going after finances. I had modest amount of ethereum on my PC, was hacked, but I still had control over my wallet. If you have $1M+ it should not be tied to your sim card, GMail account etc... If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups!
- markdown 5y ago
  > If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups! Using ones phone for banking, internet, and sms is completely normal. Saying that 99.9999999999999999% of the world population that owns smartphones is an idiot isn't helpful. The idiots are the governments of the world that haven't sanctioned Israel for allowing the continued trade of these cyberweapons by their citizens.
  - arghwhat 5y ago
    "99.9999999999999999%" of the world are not high-value targets with > $1M USD in assets. > The idiots are the governments of the world that haven't sanctioned Israel Sanctions against Israel are not going to make vulnerabilities and risks go away. It will just make life harder for a single provider.
  - throw8932894 5y ago
    - Epa095 5y ago
      >And your comment is just antisemitic. It's dangerous tossing that term around. There is enough real antisemitism in the world, and it's a real problem, we don't need to make-pretend extra. Critisism of the state of Israel does not equate antisemitism.
      - skinkestek 5y ago
        skinkestek 5y ago
        ok, I'll expand on this quickly: 1. The state of Israel is the only state in the area where both Jews and Arabs are welcome and have a place in government and legislative bodies. Much of the "legitimate criticism" of Israel isn't directed at the Arabs in Israel it seems to I claim thinly veiled hate against the Jewish part of the population. 2. If one argues that it is against the Jewish part of the population because they dominate then one cannot say it is against the state of Israel only because then the difference doesn't mean anything.
        KittenInABox 5y ago
        Genuinely asking, my understanding is that Israel the government considers itself a primarily Jewish ethnostate with policies in place to evict Arabs from their lands in order to put Jewish people in there. My understanding is that this is where a lot of criticism and advocacy for Palestine comes from. In that case, in order to criticize the treatment of Palestinians, one would be criticizing a policy that benefits primarily the Jews of Israel. By this logic, it is antisimetic to point out human rights abuses that benefit Israeli Jewish citizens? (I'm a layperson who isn't highly educated on this, and I'm aware that this conversation is complex and filled with nuance. I'm primarily asking to be educated about the matter based on the priors I have been told in the past.)
- closewith 5y ago
  In that case, the majority of the people in the world with more than $1MM are idiots.
  - solarkraft 5y ago
    The advantage of centralized services tied to your clear identity is that they do some diligence to ensure the person accessing your account is actually you. You (often) even have a reasonable recourse to undo things that have been done fraudulently.
- supernova87a 5y ago
  So you mean for example, you keep your Authenticator app on a device completely separate from your phone / disconnected from the internet?
  - solarkraft 5y ago
    2FA is a good option for securing your centralized accounts. But unfortunately, if you're logged in on your phone and your phone is hacked, well, it's still game over. For crypto currencies it may help to store them on a hardware wallet, since accessing your money will require explicit interaction. But, as far as I understand (please correct me, not up to date with the security mechanisms of hardware wallets), if your computer is compromised while doing it, you can still lose it.
    - ajkdhcb2 5y ago
      > if your computer is compromised while doing it, you can still lose it. The hardware wallet itself has a screen, and requires you to confirm your transactions, so generally not true
      - Semaphor 5y ago
        Just for people who don’t know, it’s shows relevant data regarding the transaction: Sum, currency, target address. Now, if you verify that data, you are safe… if the original address was correct. But as we are talking about a sophisticated targeted attack, where did you get the original address from? Because if it was your phone or your computer, we are back to step one, as that might already be manipulated.
        deleted 5y ago
        [deleted]
- rosndo 5y ago
  Haha. It’s regular government employees who get access to Pegasus. I’d be shocked if it had never been used in an unauthorized manner for straight up financial crimes.
caaqil 5y ago
The capabilities depend on the specific exploit but if you're dealing with something like Pegasus, the answer is yes to almost all those questions. > I wonder if there is some resource where people can read about how to detect and avoid such exploits and protect against them? Protecting against the cutting edge of current nation-state attacks [1] is... well, it's not impossible but it's up there. Just don't be important/interesting enough to catch their wrath is the TL;DR. That said, see: https://docs.mvt.re/en/latest/introduction/ https://docs.mvt.re/en/latest/introduction/ [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
lmilcin 5y ago
Make sure your big $$$ are not available easily. Find a bank/brokerage that will actually do their job verifying you before they dispense your money. You are not able to defend yourself from targeted attacks. Period. It is one thing to try to defend from attacks of opportunity (ie. viruses, ransomware, etc.) and another from people who actually know their job and for some reason find yourself attractive target. Thus, the best way to respond is to not make yourself attractive target in the first place and if you need to have attractive things somewhere -- separate them from everything else.
- brian_herman 5y ago
  Putnam investments are really hard to get money out of. For example, I tried to cash in an annuity, and it required a medallion certificate by another bank. A medallion certificate is like a notary but is only done by another bank.
  - rdtsc 5y ago
    Depends how motivated the attackers are. They can try to find another bank with weaker rules, perhaps open an account there first. I needed one of those things, and shopped around for a bit. And while all the big names would refuse, had waiting periods, fees, other requirements, a local credit union gave me one after signing up for a savings account immediately with a minimal or no fee.
    - xoa 5y ago
      >Depends how motivated the attackers are. They can try to find another bank with weaker rules, perhaps open an account there first. That isn't really incentivized in this case. Assuming by medallion certificate they meant "medallion signature guarantee" [0] as established by SEC Rule 17 Ad-15 [1], a core part of the system there is that the financial institution granting it accepts liability for any forgery, up to a specified prefix amount (and the transaction will be rejected if the stamp isn't enough to cover the transaction amount). So if they "find another bank with weaker rules" who gets them to issue a stamp for a few hundred grand they are on the hook for that loss. As a result, it's actually taken pretty seriously at least for significant amounts of money. This specific area isn't one where the guarantor gets to shrug their shoulders about it. Since they're going to be on the hook for hundreds of thousands to millions if they get it wrong, you need to be a known, established customer to even try, go in person, and someone higher level is absolutely going to looking at it personally. And even if an attacker did get past all that, the whole point is the one being attacked still hasn't lost anything. >a local credit union gave me one after signing up for a savings account immediately with a minimal or no fee. What prefix though? How did you check out in terms of signup (long history as resident? local connections?)? Lots of stuff goes on behind the scenes. An F alpha prefix ($100k surety, credit union) isn't the same thing as a Z ($14 million surety). ---- 0: https://www.mybanktracker.com/blog/investing/medallion-signature-guarantee-277286 https://www.mybanktracker.com/blog/investing/medallion-signa... 1: https://www.law.cornell.edu/cfr/text/17/240.17Ad-15 https://www.law.cornell.edu/cfr/text/17/240.17Ad-15
Ekaros 5y ago
And this is why I hate this whole mobile app thing. Sure show me the data, but for any actual transfer action I much prefer having to use the old fashioned one-time password list. At least then they need multiple things and it is not remote.
hdjjhhvvhga 5y ago
When I received a huge amount of cash some years ago, my outlook changed completely. The first thing to do was to split the money in order not to keep everything in one basket. I choose banks with unvieldy, problematic protection schemes that are awkward to use. And I set up a dedicated old laptop for banking (which still works). My biggest paranoia wasn't about remote access though. I was really afraid someone could counterfeit my ID and just cash out as much as they could get away with. Fortunately, it hasn't happened to me.
cascom 5y ago
Give written instructions to your bank requiring them know to engage in transactions over a certain amount without a certain set of verification procedures (for example a call back with a prearranged password for any wire was one that I had with my old bank), and have them acknowledge receipt in writing as well. In the unlikely/unfortunate event that your money is stolen - recouping from the financial institution will be more straightforward if they didn’t follow procedures and you can prove it.
- supernova87a 5y ago
  What typical retail bank allows you to set such kinds of custom procedures?
  - BenjiWiebe 5y ago
    I'm curious about that too, but don't forget you can talk to your banker directly without going through a random commenter on the internet. :) I'm pretty sure my bank won't do that though, since I'm currently mainly using an online-only bank.
sersi 5y ago
I have a separate phone specifically used for banking (since banks require me to install their 2fa app on my phone) and have a unique sim card that I only use for banks. It's not 100% foolproof I guess but at least it reduces my risk.
- Scoundreller 5y ago
  Ah, i see SMS and account insecurity has increased the telecom’s revenue. The security lapses will only get worse.
  - sersi 5y ago
    That's entirely true, but then again, that second sim card costs me 20 usd a year, so it's a cheap insurance.
    - danlugo92 5y ago
      What provide if in America may I ask? Cheapest non voip I've been able to find is 120/yr
      - BenjiWiebe 5y ago
        Check US Mobile. I haven't used them, but I've noticed when shopping for cheap plans that they let you build a plan that's really cheap if you don't need much.
        danlugo92 5y ago
        thx
dhx 5y ago
Once an attacker has gained root access to the device they can: 1. Access any data on the device regardless of application security (including applications that may request a separate password be entered as this password entry can be captured). This access includes logging into web services (e-mail included) pretending to be your phone and downloading or manipulating information stored or transmitted by the service. 2. Enable the microphone and cameras at any time. 3. Track location at any time via enabling GPS or monitoring for nearby WiFi, Bluetooth of cell tower device IDs. 4. Modify the user interface to report incorrect status, for example, incorrect battery level, GPS disabled when it's really enabled, incorrect data transfer amounts, etc. 5. Connect to other devices via WiFi or Bluetooth and interrogate them to find other devices or people nearby, and potentially attack those devices too. An attacker can achieve similar outcomes with root access into other electronic devices--laptops, tablets, desktop computers, watches, TVs, WiFi-enabled LED light bulbs, home appliances, cars, etc. Obviously what can do with a device depends on the sensors contained within (must have a camera sensor to secretly take images or video). Unless the attacker is reckless with turning on the video camera, microphone, GPS, WiFi, Bluetooth, etc all at once and draining battery much faster than expected, or transferring large amounts of data, you generally wouldn't notice anything different about your device. You would also probably have a hard time actively detecting the attack as the implant would be constantly watching for signs of debugging/investigation and disable/delete itself in such situations. Generally the implant would be non-persistent only residing in volatile memory of the device that would be forgotten soon after the device is powered down. Regardless of persistence, capturing the implant from the device would be very difficult and expensive to perform for an individual, but within reach of a state actor or security researchers with a lot of time on their hands to accomplish should they have the patience. It an implant were to be persistent and survive a device reboot, you could rapidly turn off the device (physically cut power from the battery), desolder the non-volatile memory chips and recover data similar to the process shown in [1]. There would be more steps involved if the device is encrypted (for example key is held in a TPM) but as you know the password to unlock the device, you could just ask the TPM nicely to give up the key. Failing that, there is FIB editing or other attacks against TPMs to recover keys. See [2] and [3] for some examples. To detect a non-persistent implant, you'd follow a similar process but would have to quickly cool the volatile memory chip (see [3]) and then cut lines to the chip and insert new probes instead of desoldering it (the heat from desoldering would result in the volatile memory being cleared too quickly). Apple's Secure Enclave processor, as an example of a growing trend, encrypts and decrypts blocks of data stored in and retrieved from volatile memory so you'd additionally need to attack the Secure Enclave processor to retrieve the required keys to decrypt the volatile memory with. The irony is that same security features which are designed to keep your device secure also inadvertently makes it prohibitively time consuming and expensive to inspect your device to detect a hidden implant in use. If you're concerned you could be a target (investigative journalists for example), the best approach is probably to assume the device is always compromised and use non-technological approaches to avoid or frustrate an attacker. Or perhaps you could find security researchers who'd love nothing more than finding and unraveling the secrets of a sophisticated implant (see [5]). [1] https://www.youtube.com/watch?v=nXDUhhyY2rE&t=133s https://www.youtube.com/watch?v=nXDUhhyY2rE&t=133s (recover data Samsung Galaxy directly from phone memory | HDD Recovery Services) [2] https://www.youtube.com/watch?v=-vnik_iUuUs https://www.youtube.com/watch?v=-vnik_iUuUs (Exposing The Deep-Secure Elements Of Smartcards | Christopher Tarnovsky | hardwear.io USA 2019) [3] https://www.youtube.com/watch?v=M46Ol4gltbI https://www.youtube.com/watch?v=M46Ol4gltbI (Focused Ion Beam TEM Lamella Prep Tutorial | Nicholas Rudawski) [4] https://www.youtube.com/watch?v=Ej-Nr79bVjg https://www.youtube.com/watch?v=Ej-Nr79bVjg (Cold Boot Attacks on Encryption Keys | J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten | 17th USENIX Security Symposium 2008) [5] https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...
javajosh 5y ago
Arguing from first principles, the first step in detecting a problem is to know your device's baseline operation. This means knowing the bevvy of processes that are running, the resources they use, and the messages they send and to which hosts. With this baseline, you can now see if something is going wrong - a process you don't recognize, connecting to hosts you don't recognize, and so on. Of course, this is also the step where almost everyone, including devs, fail. How many devs know their phone to this degree? Even for our laptops, we tend to give way too much leeway to 3rd party binaries, and allow the environment to get so noisy that any kind of signal is impossible to detect. It's a depressing trade-off we (almost) all make for convenience, using the (almost) good enough assumption that we're safe in the herd. It's actually a very, very dumb assumption and I feel like it's something of a hacker golden age because of it, and as long as they don't get too greedy and spook the herd, the gravy train is here to stay. On argument against doing even this is that a hacker can take steps to hide their process. This has happened on PCs, with rootkits that hide certain processes. This may happen for phone malware, if only to make it harder to automate detection and removal, if not to guard against watchful users (of which there are precious few). In terms of capability, I speculate that the best an attacker can achieve is a sticky, privileged process that accepts arbitrary commands at runtime, which can be used to read the disk, analyze other running processes, install and exfil sensor data, etc. From the attacker's POV for high value targets, it probably feels like ssh'ing into a mystery box, and "see what you can do" - and they probably have a (growing) library of scripts to check for easy, juicy things. (I would guess that they would hate to see bespoke applications that have to be understood and reversed to get value out of.)
- overfl0w 5y ago
  >In terms of capability, I speculate that the best an attacker can achieve is a sticky, privileged process that accepts arbitrary commands at runtime, which can be used to read the disk, analyze other running processes, install and exfil sensor data, etc. The worst-case scenario would be if the attacker somehow manages to rewrite your motherboard and/or SSD's firmware with a malicious firmware. And even if you reinstall your OS - he still manages to re-install the rootkit afterwards. I've only read about such type of malware but never have I seen or heard of anything like that in the wild.
fsflover 5y ago
If you care about this, consider using a security-oriented OS on desktop based on hardware virtualization: https://qubes-os.org https://qubes-os.org. In this case, if you use your phone only to confirm the transactions (as the second factor), you should be safe enough.
- nicce 5y ago
  How can you prove that this is more secure against state level actors than iOS which have billions (?) of users? In modern phones there are multiple levels of sandboxing already. If some state really wants to target you, I would say that this is more insecure solution. The most common OS are very heavily tested because of the user amount. These "secure" operating systems have niche amount of users which further reduces the amount of testing. And this is the only helping factor you - it is more beneficial to target operating systems which have a larger adaption. You need to be on high priority that they start developing exploits only for you who is using some random OS.
  - fsflover 5y ago
    > How can you prove that this is more secure against state level actors than iOS which have billions (?) of users? By comparing the number of exploits? Qubes relies on Xen, which is used by very big targets, so should be under constant attacks. Qubes uses hardware (VT-d) virtualization, which AFAIK was last time broken by the Qubes founder in 2003: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).
    - nicce 5y ago
      > By comparing the number of exploits? Qubes relies on Xen, which is used by very big targets, so should be under constant attacks This is often giving quite misleading conclusions based on what I just said - iOS for example is much more popular and heavily tested - of course the amount of exploits is much larger, because it is also much more interesting target as many are using it. How many people are using phones/laptops which are based on Xen? Xen is commonly used on server side - not by those guys who are holding the interesting stuff on their personal devices.
notyourday 5y ago
Open two more accounts at your bank. Code the first accounts as "deposit only", automatically reject any withdrawal requests against that account. Code this account for sweep to the second account every night. Activate positive pay[0] on the second account. Do not ever give anyone access to the second account. Code the 3rd account for positive pay. That's the only account you are going to withdraw the money from. Stop using debit cards. Only use credit cards. Pay them via positive pay from the 3rd account. Stop using pull. Only use push. Only target the 3rd account with positive pay as the source of funds. You should look at family office setups anyway. It used to be something that was done at 100M level but these days the services became cheap enough that it makes sense at 10M level. [0] Switch to a bank that supports positive pay for all electronic transactions.
cjbprime 5y ago
It's actually easier for an attacker on desktops/laptops. Phones have excellent sandboxing and defenses by comparison. The ideal attacker would find a way to silently steal a credential (e.g. session cookie) from your phone, then use it on a different device. That's not going to be something that makes a lot of noise on your device itself.

throw8932894 5y ago

Someone who has access to Pegasus is not going after finances. I had modest amount of ethereum on my PC, was hacked, but I still had control over my wallet. If you have $1M+ it should not be tied to your sim card, GMail account etc... If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups!

markdown 5y ago
> If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups! Using ones phone for banking, internet, and sms is completely normal. Saying that 99.9999999999999999% of the world population that owns smartphones is an idiot isn't helpful. The idiots are the governments of the world that haven't sanctioned Israel for allowing the continued trade of these cyberweapons by their citizens.
- arghwhat 5y ago
  "99.9999999999999999%" of the world are not high-value targets with > $1M USD in assets. > The idiots are the governments of the world that haven't sanctioned Israel Sanctions against Israel are not going to make vulnerabilities and risks go away. It will just make life harder for a single provider.
- throw8932894 5y ago
  - Epa095 5y ago
    >And your comment is just antisemitic. It's dangerous tossing that term around. There is enough real antisemitism in the world, and it's a real problem, we don't need to make-pretend extra. Critisism of the state of Israel does not equate antisemitism.
    - skinkestek 5y ago
      - skinkestek 5y ago
        ok, I'll expand on this quickly: 1. The state of Israel is the only state in the area where both Jews and Arabs are welcome and have a place in government and legislative bodies. Much of the "legitimate criticism" of Israel isn't directed at the Arabs in Israel it seems to I claim thinly veiled hate against the Jewish part of the population. 2. If one argues that it is against the Jewish part of the population because they dominate then one cannot say it is against the state of Israel only because then the difference doesn't mean anything.
        KittenInABox 5y ago
        Genuinely asking, my understanding is that Israel the government considers itself a primarily Jewish ethnostate with policies in place to evict Arabs from their lands in order to put Jewish people in there. My understanding is that this is where a lot of criticism and advocacy for Palestine comes from. In that case, in order to criticize the treatment of Palestinians, one would be criticizing a policy that benefits primarily the Jews of Israel. By this logic, it is antisimetic to point out human rights abuses that benefit Israeli Jewish citizens? (I'm a layperson who isn't highly educated on this, and I'm aware that this conversation is complex and filled with nuance. I'm primarily asking to be educated about the matter based on the priors I have been told in the past.)
closewith 5y ago
In that case, the majority of the people in the world with more than $1MM are idiots.
- solarkraft 5y ago
  The advantage of centralized services tied to your clear identity is that they do some diligence to ensure the person accessing your account is actually you. You (often) even have a reasonable recourse to undo things that have been done fraudulently.
supernova87a 5y ago
So you mean for example, you keep your Authenticator app on a device completely separate from your phone / disconnected from the internet?
- solarkraft 5y ago
  2FA is a good option for securing your centralized accounts. But unfortunately, if you're logged in on your phone and your phone is hacked, well, it's still game over. For crypto currencies it may help to store them on a hardware wallet, since accessing your money will require explicit interaction. But, as far as I understand (please correct me, not up to date with the security mechanisms of hardware wallets), if your computer is compromised while doing it, you can still lose it.
  - ajkdhcb2 5y ago
    > if your computer is compromised while doing it, you can still lose it. The hardware wallet itself has a screen, and requires you to confirm your transactions, so generally not true
    - Semaphor 5y ago
      Just for people who don’t know, it’s shows relevant data regarding the transaction: Sum, currency, target address. Now, if you verify that data, you are safe… if the original address was correct. But as we are talking about a sophisticated targeted attack, where did you get the original address from? Because if it was your phone or your computer, we are back to step one, as that might already be manipulated.
      - deleted 5y ago
        [deleted]
rosndo 5y ago
Haha. It’s regular government employees who get access to Pegasus. I’d be shocked if it had never been used in an unauthorized manner for straight up financial crimes.

caaqil 5y ago

The capabilities depend on the specific exploit but if you're dealing with something like Pegasus, the answer is yes to almost all those questions. > I wonder if there is some resource where people can read about how to detect and avoid such exploits and protect against them? Protecting against the cutting edge of current nation-state attacks [1] is... well, it's not impossible but it's up there. Just don't be important/interesting enough to catch their wrath is the TL;DR. That said, see: https://docs.mvt.re/en/latest/introduction/ https://docs.mvt.re/en/latest/introduction/ [1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

lmilcin 5y ago

Make sure your big $$$ are not available easily. Find a bank/brokerage that will actually do their job verifying you before they dispense your money. You are not able to defend yourself from targeted attacks. Period. It is one thing to try to defend from attacks of opportunity (ie. viruses, ransomware, etc.) and another from people who actually know their job and for some reason find yourself attractive target. Thus, the best way to respond is to not make yourself attractive target in the first place and if you need to have attractive things somewhere -- separate them from everything else.

brian_herman 5y ago
Putnam investments are really hard to get money out of. For example, I tried to cash in an annuity, and it required a medallion certificate by another bank. A medallion certificate is like a notary but is only done by another bank.
- rdtsc 5y ago
  Depends how motivated the attackers are. They can try to find another bank with weaker rules, perhaps open an account there first. I needed one of those things, and shopped around for a bit. And while all the big names would refuse, had waiting periods, fees, other requirements, a local credit union gave me one after signing up for a savings account immediately with a minimal or no fee.
  - xoa 5y ago
    >Depends how motivated the attackers are. They can try to find another bank with weaker rules, perhaps open an account there first. That isn't really incentivized in this case. Assuming by medallion certificate they meant "medallion signature guarantee" [0] as established by SEC Rule 17 Ad-15 [1], a core part of the system there is that the financial institution granting it accepts liability for any forgery, up to a specified prefix amount (and the transaction will be rejected if the stamp isn't enough to cover the transaction amount). So if they "find another bank with weaker rules" who gets them to issue a stamp for a few hundred grand they are on the hook for that loss. As a result, it's actually taken pretty seriously at least for significant amounts of money. This specific area isn't one where the guarantor gets to shrug their shoulders about it. Since they're going to be on the hook for hundreds of thousands to millions if they get it wrong, you need to be a known, established customer to even try, go in person, and someone higher level is absolutely going to looking at it personally. And even if an attacker did get past all that, the whole point is the one being attacked still hasn't lost anything. >a local credit union gave me one after signing up for a savings account immediately with a minimal or no fee. What prefix though? How did you check out in terms of signup (long history as resident? local connections?)? Lots of stuff goes on behind the scenes. An F alpha prefix ($100k surety, credit union) isn't the same thing as a Z ($14 million surety). ---- 0: https://www.mybanktracker.com/blog/investing/medallion-signature-guarantee-277286 https://www.mybanktracker.com/blog/investing/medallion-signa... 1: https://www.law.cornell.edu/cfr/text/17/240.17Ad-15 https://www.law.cornell.edu/cfr/text/17/240.17Ad-15

Ekaros 5y ago

And this is why I hate this whole mobile app thing. Sure show me the data, but for any actual transfer action I much prefer having to use the old fashioned one-time password list. At least then they need multiple things and it is not remote.

hdjjhhvvhga 5y ago

When I received a huge amount of cash some years ago, my outlook changed completely. The first thing to do was to split the money in order not to keep everything in one basket. I choose banks with unvieldy, problematic protection schemes that are awkward to use. And I set up a dedicated old laptop for banking (which still works). My biggest paranoia wasn't about remote access though. I was really afraid someone could counterfeit my ID and just cash out as much as they could get away with. Fortunately, it hasn't happened to me.

cascom 5y ago

Give written instructions to your bank requiring them know to engage in transactions over a certain amount without a certain set of verification procedures (for example a call back with a prearranged password for any wire was one that I had with my old bank), and have them acknowledge receipt in writing as well. In the unlikely/unfortunate event that your money is stolen - recouping from the financial institution will be more straightforward if they didn’t follow procedures and you can prove it.

supernova87a 5y ago
What typical retail bank allows you to set such kinds of custom procedures?
- BenjiWiebe 5y ago
  I'm curious about that too, but don't forget you can talk to your banker directly without going through a random commenter on the internet. :) I'm pretty sure my bank won't do that though, since I'm currently mainly using an online-only bank.

sersi 5y ago

I have a separate phone specifically used for banking (since banks require me to install their 2fa app on my phone) and have a unique sim card that I only use for banks. It's not 100% foolproof I guess but at least it reduces my risk.

Scoundreller 5y ago
Ah, i see SMS and account insecurity has increased the telecom’s revenue. The security lapses will only get worse.
- sersi 5y ago
  That's entirely true, but then again, that second sim card costs me 20 usd a year, so it's a cheap insurance.
  - danlugo92 5y ago
    What provide if in America may I ask? Cheapest non voip I've been able to find is 120/yr
    - BenjiWiebe 5y ago
      Check US Mobile. I haven't used them, but I've noticed when shopping for cheap plans that they let you build a plan that's really cheap if you don't need much.
      - danlugo92 5y ago
        thx

dhx 5y ago

Once an attacker has gained root access to the device they can: 1. Access any data on the device regardless of application security (including applications that may request a separate password be entered as this password entry can be captured). This access includes logging into web services (e-mail included) pretending to be your phone and downloading or manipulating information stored or transmitted by the service. 2. Enable the microphone and cameras at any time. 3. Track location at any time via enabling GPS or monitoring for nearby WiFi, Bluetooth of cell tower device IDs. 4. Modify the user interface to report incorrect status, for example, incorrect battery level, GPS disabled when it's really enabled, incorrect data transfer amounts, etc. 5. Connect to other devices via WiFi or Bluetooth and interrogate them to find other devices or people nearby, and potentially attack those devices too. An attacker can achieve similar outcomes with root access into other electronic devices--laptops, tablets, desktop computers, watches, TVs, WiFi-enabled LED light bulbs, home appliances, cars, etc. Obviously what can do with a device depends on the sensors contained within (must have a camera sensor to secretly take images or video). Unless the attacker is reckless with turning on the video camera, microphone, GPS, WiFi, Bluetooth, etc all at once and draining battery much faster than expected, or transferring large amounts of data, you generally wouldn't notice anything different about your device. You would also probably have a hard time actively detecting the attack as the implant would be constantly watching for signs of debugging/investigation and disable/delete itself in such situations. Generally the implant would be non-persistent only residing in volatile memory of the device that would be forgotten soon after the device is powered down. Regardless of persistence, capturing the implant from the device would be very difficult and expensive to perform for an individual, but within reach of a state actor or security researchers with a lot of time on their hands to accomplish should they have the patience. It an implant were to be persistent and survive a device reboot, you could rapidly turn off the device (physically cut power from the battery), desolder the non-volatile memory chips and recover data similar to the process shown in [1]. There would be more steps involved if the device is encrypted (for example key is held in a TPM) but as you know the password to unlock the device, you could just ask the TPM nicely to give up the key. Failing that, there is FIB editing or other attacks against TPMs to recover keys. See [2] and [3] for some examples. To detect a non-persistent implant, you'd follow a similar process but would have to quickly cool the volatile memory chip (see [3]) and then cut lines to the chip and insert new probes instead of desoldering it (the heat from desoldering would result in the volatile memory being cleared too quickly). Apple's Secure Enclave processor, as an example of a growing trend, encrypts and decrypts blocks of data stored in and retrieved from volatile memory so you'd additionally need to attack the Secure Enclave processor to retrieve the required keys to decrypt the volatile memory with. The irony is that same security features which are designed to keep your device secure also inadvertently makes it prohibitively time consuming and expensive to inspect your device to detect a hidden implant in use. If you're concerned you could be a target (investigative journalists for example), the best approach is probably to assume the device is always compromised and use non-technological approaches to avoid or frustrate an attacker. Or perhaps you could find security researchers who'd love nothing more than finding and unraveling the secrets of a sophisticated implant (see [5]). [1] https://www.youtube.com/watch?v=nXDUhhyY2rE&t=133s https://www.youtube.com/watch?v=nXDUhhyY2rE&t=133s (recover data Samsung Galaxy directly from phone memory | HDD Recovery Services) [2] https://www.youtube.com/watch?v=-vnik_iUuUs https://www.youtube.com/watch?v=-vnik_iUuUs (Exposing The Deep-Secure Elements Of Smartcards | Christopher Tarnovsky | hardwear.io USA 2019) [3] https://www.youtube.com/watch?v=M46Ol4gltbI https://www.youtube.com/watch?v=M46Ol4gltbI (Focused Ion Beam TEM Lamella Prep Tutorial | Nicholas Rudawski) [4] https://www.youtube.com/watch?v=Ej-Nr79bVjg https://www.youtube.com/watch?v=Ej-Nr79bVjg (Cold Boot Attacks on Encryption Keys | J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten | 17th USENIX Security Symposium 2008) [5] https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...

javajosh 5y ago

Arguing from first principles, the first step in detecting a problem is to know your device's baseline operation. This means knowing the bevvy of processes that are running, the resources they use, and the messages they send and to which hosts. With this baseline, you can now see if something is going wrong - a process you don't recognize, connecting to hosts you don't recognize, and so on. Of course, this is also the step where almost everyone, including devs, fail. How many devs know their phone to this degree? Even for our laptops, we tend to give way too much leeway to 3rd party binaries, and allow the environment to get so noisy that any kind of signal is impossible to detect. It's a depressing trade-off we (almost) all make for convenience, using the (almost) good enough assumption that we're safe in the herd. It's actually a very, very dumb assumption and I feel like it's something of a hacker golden age because of it, and as long as they don't get too greedy and spook the herd, the gravy train is here to stay. On argument against doing even this is that a hacker can take steps to hide their process. This has happened on PCs, with rootkits that hide certain processes. This may happen for phone malware, if only to make it harder to automate detection and removal, if not to guard against watchful users (of which there are precious few). In terms of capability, I speculate that the best an attacker can achieve is a sticky, privileged process that accepts arbitrary commands at runtime, which can be used to read the disk, analyze other running processes, install and exfil sensor data, etc. From the attacker's POV for high value targets, it probably feels like ssh'ing into a mystery box, and "see what you can do" - and they probably have a (growing) library of scripts to check for easy, juicy things. (I would guess that they would hate to see bespoke applications that have to be understood and reversed to get value out of.)

overfl0w 5y ago
>In terms of capability, I speculate that the best an attacker can achieve is a sticky, privileged process that accepts arbitrary commands at runtime, which can be used to read the disk, analyze other running processes, install and exfil sensor data, etc. The worst-case scenario would be if the attacker somehow manages to rewrite your motherboard and/or SSD's firmware with a malicious firmware. And even if you reinstall your OS - he still manages to re-install the rootkit afterwards. I've only read about such type of malware but never have I seen or heard of anything like that in the wild.

fsflover 5y ago

If you care about this, consider using a security-oriented OS on desktop based on hardware virtualization: https://qubes-os.org https://qubes-os.org. In this case, if you use your phone only to confirm the transactions (as the second factor), you should be safe enough.

nicce 5y ago
How can you prove that this is more secure against state level actors than iOS which have billions (?) of users? In modern phones there are multiple levels of sandboxing already. If some state really wants to target you, I would say that this is more insecure solution. The most common OS are very heavily tested because of the user amount. These "secure" operating systems have niche amount of users which further reduces the amount of testing. And this is the only helping factor you - it is more beneficial to target operating systems which have a larger adaption. You need to be on high priority that they start developing exploits only for you who is using some random OS.
- fsflover 5y ago
  > How can you prove that this is more secure against state level actors than iOS which have billions (?) of users? By comparing the number of exploits? Qubes relies on Xen, which is used by very big targets, so should be under constant attacks. Qubes uses hardware (VT-d) virtualization, which AFAIK was last time broken by the Qubes founder in 2003: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).
  - nicce 5y ago
    > By comparing the number of exploits? Qubes relies on Xen, which is used by very big targets, so should be under constant attacks This is often giving quite misleading conclusions based on what I just said - iOS for example is much more popular and heavily tested - of course the amount of exploits is much larger, because it is also much more interesting target as many are using it. How many people are using phones/laptops which are based on Xen? Xen is commonly used on server side - not by those guys who are holding the interesting stuff on their personal devices.

notyourday 5y ago

Open two more accounts at your bank. Code the first accounts as "deposit only", automatically reject any withdrawal requests against that account. Code this account for sweep to the second account every night. Activate positive pay[0] on the second account. Do not ever give anyone access to the second account. Code the 3rd account for positive pay. That's the only account you are going to withdraw the money from. Stop using debit cards. Only use credit cards. Pay them via positive pay from the 3rd account. Stop using pull. Only use push. Only target the 3rd account with positive pay as the source of funds. You should look at family office setups anyway. It used to be something that was done at 100M level but these days the services became cheap enough that it makes sense at 10M level. [0] Switch to a bank that supports positive pay for all electronic transactions.

cjbprime 5y ago

It's actually easier for an attacker on desktops/laptops. Phones have excellent sandboxing and defenses by comparison. The ideal attacker would find a way to silently steal a credential (e.g. session cookie) from your phone, then use it on a different device. That's not going to be something that makes a lot of noise on your device itself.