18 ms·

Hackers claim they breached T-Mobile more than 100 times in 2022

533 points by mikece 4y ago

bastard_op 4y ago
They will pay the fines and keep doing business happily and another "we're sorry, it won't happen again..." The joys of being too big to fail.
- grugagag 4y ago
  Increase the fines tenfold or up them an order of magnitude till it’s no longer just a negligible cost of doing business
  - mikestew 4y ago
    Increase the fines tenfold or up them an order of magnitude... We get it, no need to repeat yourself. ;-)
nodesocket 4y ago
I don’t doubt it. My cell phone stopped working for a day, I called in and talked to somebody who I could barely understand and knew very little about basic security. I tried to explain multiple times that my account was probably SIM swapped and the support person completely ignored this security concern and just said I have fixed the issue on my end anything else I can help you with? Please rate me 5 star in the coming support survey.
- wkat4242 4y ago
  Pretty typical for most first line support though. Especially outsourced. It's hard to find people with languages and tech skills so most outsourcers just fulfill the former and cover the latter with endless infernal flowcharts. Really sucks when your problem is not on the chart. Escalating is usually discouraged by giving targets per day to the agents. I guess you're in the US so perhaps language isn't as much of an issue but a lot of US companies support from the Philippines now because they have a favourably perceived accent (unlike Indians which a lot of customers have come to associate with 'poor support' so it leads to kneejerk reactions *). But anyway in the Philippines it's now hard to find staff too. But anyway my point is that the support experience is not really related to internal IT competence. *) not my personal opinion but I have seen US companies in particular use this argument. Unlike in the UK where Indian accents are common. I worked on the contact center tech realm for 20 years.
- pitaj 4y ago
  Was this on T-Mobile? In my experience their support is actually quite good. I always get connected to someone in the US.
r053bud 4y ago
[flagged]
- JLCarveth 4y ago
  $0.13 and a "Sorry, it won't happen again."
  - pessimizer 4y ago
    "Although the settlement and the apology should not be misconstrued as an admission that we were responsible for anything that happened."
- welder 4y ago
  You didn't read the article. This isn't about a data leak, it's about being able to intercept SMS for any T-Mobile phone number.
  - testfrequency 4y ago
    Surely any enterprising criminal would do both sell and exploit users data…
    - outworlder 4y ago
      Not if they are doing a SIM swap. If they are paying $1k as claimed they are after far more interesting things in your accounts than just basic information to sell.
      - welder 4y ago
        It's common to target high value accounts for BTC. https://www.coindesk.com/policy/2022/10/20/two-us-men-sentenced-for-stealing-crypto-using-sim-swapping/ https://www.coindesk.com/policy/2022/10/20/two-us-men-senten...
  - r053bud 4y ago
jeffalo 4y ago
[dead]
OscarMcLaren 4y ago
[dead]
testfrequency 4y ago
You know, I’m starting to become slightly more serious about switching carriers solely based on how terrible it would be to experience SMS/Call diverting of my number. While I use a yubikey, OTP (where possible), and unique passwords…there’s still places where I have no choice and my number is my auth (or stupidly a reset option). I genuinely am happy with TMO service in the US, and frankly abroad it’s excellent…but I’d be lying if every single article I see about their security breaches reminds me I may be on borrowed time myself.
- welder 4y ago
  Unfortunately, most carriers (except ATT & Verizon) are just T-Mobile resellers... so you might think you're not using T-Mobile but you're still affected. Even if you use ATT or Verizon, the article mentions they're also hacked and SMS intercepted often.
  - forbiddenlake 4y ago
    Can you source "most" and define "carrier" specifically for your comment? Verizon and AT&T are the other of the big 3 carriers in the US, and they're not reselling T-Mobile. And all 3 have MNVOs (mobile virtual network operator) that resell and/or combine the networks of the big 3.
  - testfrequency 4y ago
    Honestly, I’d assume being on a MVNO carrier would actually protect you from this, as you’re simply roaming on the T-Mobile network through the carrier agreement. Even ATT and Verizon have roaming agreements. The issue is for T-Mobile direct customers, which obviously their internal systems have access to. I see no reason why T-Mobile would have access to users accounts at another company…
    - plexicle 4y ago
      https://www.theverge.com/2023/2/1/23580947/google-fi-mobile-tmobile-security-breach-data https://www.theverge.com/2023/2/1/23580947/google-fi-mobile-... "Google says that hackers may have accessed limited customer information via the compromised system, which includes phone numbers, SIM card serial numbers, account status, and mobile service plan data. The system did not contain personal customer information such as names, email addresses, payment card data, government IDs, passwords, or pin numbers." It's something, but not perfect.
photon12 4y ago
> T-Mobile declined to answer questions about what it may be doing to beef up employee authentication. But Nicholas Weaver, a researcher and lecturer at University of California, Berkeley’s International Computer Science Institute, said T-Mobile and all the major wireless providers should be requiring employees to use physical security keys for that second factor when logging into company resources. > “These breaches should not happen,” Weaver said. “Because T-Mobile should have long ago issued all employees security keys and switched to security keys for the second factor. And because security keys provably block this style of attack.” At what point do we consider industry self-regulation on this a total failure? You don't need to make Yubikeys a part of every auth workflow in your corporate enterprise if there are legacy systems/integrations, but you should at least do it for the things that can change customer mobile subscription details and there can't be any excuse.
- gjsman-1000 4y ago
  You assume that regulation can just make security magically happen. I see no reason to assume that premise to be correct in practice. It's not like the US Government hasn't been breached countless times or had Supreme Court opinions leaked; and it's not like corporations that really tried and should be examples of best practice haven't also been breached. Also, what law can prevent insider attacks? There's already plenty of laws making that illegal. There's no law that just "makes security happen" - and, actually, I would be fundamentally opposed to such a law because it turns security into a simple matter of compliance. "We're SCA compliant, therefore we're good!" And technology changes way too much - a security law that was written 10 years ago would be a disaster today. See South Korea's Banking Security laws for an example - they basically enshrined ActiveX in their law with roll-your-own-crypto to this day. And we know now that was a trash idea but nobody wants to take the blame for upsetting the security standards. https://palant.info/2023/01/02/south-koreas-online-security-dead-end/ https://palant.info/2023/01/02/south-koreas-online-security-... and https://www.nytimes.com/2022/07/08/business/korea-internet-explorer.html https://www.nytimes.com/2022/07/08/business/korea-internet-e...
  - photon12 4y ago
    I'm not calling for regulation on general security outcomes. I'm talking specifically about access controls on sensitive and highly privileged systems that have ripple impacts to consumer security, which should already be obvious best practice.
outworlder 4y ago
> Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobile user’s text messages and phone calls to another device. If they are doing all this through phishing and aren't being as successful with other networks there's some serious issue that's being overlooked. It's unclear from the article if this is due to training, lax security on internal tools, lack of two factor (as claimed in the article) or something else (even insiders). That's too bad, I've been on T-Mobile for years. Whenever I can I'll use yubikeys or OTP. But there's still a large number of sites and services that rely on SMS.
- wnevets 4y ago
  > But there's still a large number of sites and services that rely on SMS. I avoid using my actual phone number whenever possible and use a Google Voice number. Hacking Google Voice would require hacking my actual Google account instead of just tricking someone at the phone company.
  - nordsieck 4y ago
    > I avoid using my actual phone number whenever possible and use a Google Voice number. I do too. Sadly there are a number of sites/orgs that require you to use a mobile number. I don't really understand why.
  - computing 4y ago
    why do you think that? Presumably Google Voice uses a phone company downstream, which means if that company is hacked they can reassign your number to someone else and thus you have the classic SIM jacking attack.
    - wnevets 4y ago
      Which phone company does the hacker call to trick into believing they are Google?
      - 4y ago
LinuxBender 4y ago
Might it be time for the US government to step in using eminent domain, seize the company and merge it into a different provider? Are other providers more secure or do we just hear about T-Mobile the most? Who should take over T-Mobile? [Edit] The more I think about this, perhaps another path to resolution would be to remove limited liability protections from companies that repeatedly put their customers at risk, especially given that phones are used as financial transaction authenticators. Perhaps some bank regulations need to find their way onto cellular providers.
- usefulcat 4y ago
  And then we'd be down to what, two wireless carries in the US? AT&T already tried to acquire/merge with T-Mobile some years ago but it didn't go through. I forget why, but probably due to antitrust issues. And wasn't Sprint just acquired/merged with not long ago, by T-Mobile IIRC?
  - LinuxBender 4y ago
    And then we'd be down to what, two wireless carries in the US? I think you are correct. I don't like the idea of making a giant-bell yet once again but I also don't see a way to correct T-Mobiles obvious cavalier and brazen incompetence. Fines? Companies just factor that into the cost of doing business. Threat of losing their FCC license? I think collusion between business and government would drag that fight out for decades and probably even exacerbate the problem. March their leaders through town with a shame-nun? I don't know what would get real results quickly. Tack on some bigger fiduciary liabilities since phones are used to authenticate bank transactions? Perhaps if some powerful political leaders had nasty secrets revealed or lost money as a result of these hacks there might be action but that is a big if. That might never happen and that also assumes there is proper attribution.
  - SkyMarshal 4y ago
    > I forget why, but probably due to antitrust issues. And wasn't Sprint just acquired/merged with not long ago, by T-Mobile IIRC? Yes and yes. We're down to three big mobile telecoms now, ATT, Verizon, T-mobile/Sprint. At least MVNO's are allowed though, plenty of those.
streptomycin 4y ago
Which cell phone network would you guys recommend for people who care about security?
- bitcoinmoney 4y ago
  US mobile has good 2FA.
  - zamnos 4y ago
    Heads up that US mobile is an MVNO operating on T-Mobile and Verizon, so how good their 2FA system is irrelevant if hackers get deep enough into tmobile.
    - comte7092 4y ago
      “Deep enough” would be true of any mobile carrier, to date all of these attacks are SIM swapping, with social engineering/phishing being the attack vector. Not particularly deep. Attackers would have to social engineer the MVNO directly, which is certainly easier if they have data they’ve stolen from t-mobile first, but this isn’t a “they’ll get in no matter what because they’ve pwned T-Mobile so bad” scenario.
      - jelled 4y ago
        https://www.bleepingcomputer.com/news/security/google-fi-data-breach-let-hackers-carry-out-sim-swap-attacks/ https://www.bleepingcomputer.com/news/security/google-fi-dat... This article says that Google Fi customers were SIM swapped due to a T-Mobile breach. Even though "[t]here was no access to Google's systems or any systems overseen by Google."
        comte7092 4y ago
        > These attacks are conducted using social engineering, where the threat actor impersonates the customer and requests that the number be ported to a new device for some reason. To convince the mobile carrier that they are the customer, they provide personal information exposed to phishing attacks and data breaches. > As the Google Fi data breach includes phone numbers, which can easily be linked to a customer's name, and the serial number of SIM cards, it would have made it even more convincing when contacting a mobile customer support representative. They used the data in the breach to social engineer the Google fi reps. Attackers still needed to get through Google’s customer support system to perform the SIM swaps.
jelled 4y ago
Was thinking about moving a line to Google Fi for this reason. I know they just resell T-Mobile bandwidth, but would they provide better account level security? Is it common for Google Fi customers to get SIM swapped?
- jareklupinski 4y ago
  yup https://www.bleepingcomputer.com/news/security/google-fi-data-breach-let-hackers-carry-out-sim-swap-attacks/ https://www.bleepingcomputer.com/news/security/google-fi-dat... my friend had google fi and was caught in this, among other things they had their instagram taken over. scary few days. thankfully their roommate works at meta... I think the only way to be really safe is to use one of the smaller MVNOs and never ever ever reveal who your carrier is
  - jelled 4y ago
    Thanks! Based on that article it seems that anyone who's reselling T-Mobile service would be vulnerable.
    - computing 4y ago
      Do we know if Google Voice also uses T-Mobile? If not, might be worthwhile to switch SMS 2FA to the Voice number if a service allows voip numbers.
      - BenjiWiebe 4y ago
        Google Voice isn't a wireless carrier. VoIP only.
        computing 4y ago
        This is part of my question. How does Google provision VoIP numbers? When someone calls / texts a VoIP number from a normal number, that call / SMS travels over normal wireless infrastructure. So VoIP numbers are still connected to the same infra, right?
geekifier 4y ago
It is an open secret that criminal groups also pay unscrupulous T-Mobile employees to assist with SIM-swap attacks. I am not sure at what scale this happens, as those instances _should_ be easy to trace and prosecute. But I have seen evidence of criminals reaching out and offering "side work" on the T-mobile subreddits, as an example. In those cases, hardware keys for employees would not help.
- londons_explore 4y ago
  > those instances _should_ be easy to trace and prosecute I suspect that the employees aren't merely doing a sim swap attack with their work login credentials. Like you say, they'd clearly get fired/prosecuted for that. Instead, I suspect criminal X buys a nice thing delivered to employee Y's house. Then, criminal X phones the helpdesk repeatedly till they get connected to employee Y during working hours. Then, they claim to own the phone number of victim Z, but have lost the phone, their id and everything else. But they manage to tell employee Y the answer to two of the secret questions "What is your gender", and "Did you use the internet in the last month?". The employee uses this, together with their judgement to proceed, according to company policy, and issue a new eSIM. Later, when anyone finds out, the call is listened to, and the employee can legitimately say they were just following policy.
  - vain_cain 4y ago
    Out of high school I've worked a couple of years for A1 telecom(in Croatia) in customer service. When someone called, all I was required to ask is their OIB(Personal identification number) and they could literally ask me for anything if it's a residential user. Want to cancel 20 numbers that still got 2 years until the contracts expire? Sure, let me do that for you. Want to change sim? Sure, just give me the new sim number. Want to add 5 tariffs to your plan? Sure, do you want phones with that? That was 6 years ago but I still got friends I talk to there, and not much has changed.
  - DrewADesign 4y ago
    I imagine getting someone job-fair hired under assumed credentials and ghosting after one full shift of abusing their access, or giving a very poorly paid CSR just enough cash to make it worth the risk is probably more straightforward, but I don't know anything about that stuff. Most restaurants/bars I worked at had hourly staff working under 'borrowed' SSNs and names for years, though.
eigenvalue 4y ago
Maybe it's just me, but I no longer trust news from Krebs ever since he got the Ubiquiti story so utterly wrong.
- photon12 4y ago
  There's enough purported primary source data here that I am inclined to believe this reporting entirely.
- 8kingDreux8 4y ago
  For those wondering... https://arstechnica.com/tech-policy/2022/03/ubiquiti-sues-journalist-alleging-defamation-in-coverage-of-data-breach/ https://arstechnica.com/tech-policy/2022/03/ubiquiti-sues-jo...
- mattw2121 4y ago
  I trust Krebs even more. He messed up, he knows it, and he's motivated to make sure it doesn't happen again.
Tijdreiziger 4y ago
The article doesn't make it clear which T-Mobiles are affected. The article seems to be US-centric, so, only T-Mobile US? Or all 13 Deutsche Telekom subsidiaries [1]? What about T-Mobile Netherlands, which was sold off by Deutsche Telekom but retains the T-Mobile name? [1] https://en.wikipedia.org/wiki/T-Mobile#Operations https://en.wikipedia.org/wiki/T-Mobile#Operations
LinuxBender 4y ago
I've been thinking about this a bit more and I think the right path forward is to impose the same fiduciary liabilities and regulations on cellular providers that banks enjoy. Phones are used as authentication devices for bank transactions. If cellular providers have to go through all the same audits of controls as banks and share the same fiduciary liabilities that may raise the bar for phishing attempts. This may also change the employment requirements for people at T-Mobile and there would be more scrutiny to weed out some of the bad apples or at least increase monitoring and auditing of transactions to provide more visibility to forensic teams.
- jameshart 4y ago
  > phones are used as authentication devices for banking transactions That’s the banks’ choice though. Are cellular providers selling them a secure authentication service? Or just an insecure best effort message delivery channel? But then of course the banks can ping that liability further upstream: as a customer, when you choose to opt in to SMS authentication, you’re the one vouching for the security of your cellphone provider, telling your bank ‘I trust their account security enough that if you send a message to this number you can assume the recipient is me’ So now you’re left going to your cell company and saying ‘since the bank said I could use you for auth, you’re properly secure right?’ And their answer is ‘lol no. check our t’s and c’s.’ And then you wind up saying ‘but I want to be able to assume that and I think my cell company should be liable if they aren’t’, and asking for the cellphone company to be regulated like a bank. Because banks are that good at deflecting liability.
  - LinuxBender 4y ago
    I think the legislation should be worded so that if a cellular provider does not want the fiduciary and regulatory requirements imposed on them, they must disable all SS7-to-MAPI SMS/text message gateways or any other form of non-E2EE unencrypted and unauthenticated communication. SIM swapping becomes less useful as encrypted applications take over MFA/2FA authentication meaning the attacker must acquire and unlock the phone itself rather than being able to impersonate it. Even voice communication must be encrypted when cell-to-cell so that Joe-Blow-Nobody and the President of the United States have exactly the same protection on their personal cell phones. If a company key use used for lawful intercept there must be a massive audit trail that makes it crystal clear who monitored what and for how long. No more pressuring people like me to give authorities unfettered and un-monitored lawful monitoring access.
mzs 4y ago
>“A huge reason this problem has been allowed to spiral out of control is because children play such a prominent role in this form of breach,” Nixon said. >Nixon said SIM-swapping groups often advertise low-level jobs on places like Roblox and Minecraft, online games that are extremely popular with young adolescent males. >… “They recruit children because they’re naive, you can get more out of them, and they have legal protections that other people over 18 don’t have.”
cbdumas 4y ago
The rise of SMS as a second factor for security across the web has raised the incentive for SIM-swapping tremendously. No one should be shocked that when tech companies start outsourcing their identity verification to cell phone providers those providers come under attack.
- jandrese 4y ago
  SMS as a second factor is almost a security downgrade. Phone companies are terrible, you shouldn't be trusting them with authentication. Plus it means you can't authenticate when your phone is out of coverage. Just a bad solution that shouldn't be used. TOTP is so easy to set up that it makes no sense to use SMS, and the even better hardware keys are only slightly less convenient.
  - twosdai 4y ago
    Most users don't know what the words sms or totp mean. I'm not saying that totp isn't easy to implement in the grand scheme of things, but for many people it's not straight forward to setup. Entering a cellphone number and responding to text messages is well known since we've been doing it for 20 something years now. I think totp would probably get more traction with normal users if people started calling it app verification, or something similar eventhough that is slightly incorrect.
  - ridgered4 4y ago
    SMS allows you to collect phone numbers which are quite good at identifying users for tracking and ad targeting though. And since most large tech companies are advertising companies (in whole or in part) it is no surprise they chose this as a second factor. Even if you try to avoid using SMS for 2FA they'll try to collect the number for account verification or recovery, with regular nags or lately go straight to extorting it out of you to continue to access purchased services or software.
    - deleted 4y ago
      [deleted]
donutpepperoni 4y ago
Would switching to an eSIM based phone offer any sort of risk mitigation in these scenarios?
- testfrequency 4y ago
  Zero
- aesh2Xa1 4y ago
  An eSIM will prevent a physical swap. However, an eSIM will not prevent a port-out of your phone number. To defend against port-out you should enable port protection. The name of such a feature varies by carrier, and T-Mobile seems to refer to it as "Takeover Protection."
upofadown 4y ago
In fairness, T-Mobile (and other phone companies) don't really want to provide no cost authentication for other entities. SIM swapping wouldn't be an issue if forces outside the control of the phone companies were not making it so profitable. If we need to legislate something, perhaps we should try to discourage this sort of thing in the first place. One company should not be allowed to paint a target on an uninvolved company for financial gain.
- flutas 4y ago
  > don't really want to provide no cost authentication for other entities Is the customer not paying for the cell phone plan? Nothing is “no cost” in this situation. The cost is just shifted to the consumer from the company in the form of requiring a phone number. > One company should not be allowed to paint a target on an uninvolved company for financial gain. Or, if T-Mobile and others did a good job in security for their networks and in turn their customers communications maybe they wouldn’t have this issue. IMO this comparison would be like claiming a gas station is responsible for your cars electronics not functioning properly.
ctvo 4y ago
I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both passwords to both accounts were kept the same. After I caught on to the above once I received my credit card statement, in November: - They attempted to purchase something with my credit card. Security mechanisms triggered, and a verification code was sent to my phone at 4am in the morning. They successfully validated and placed the order. My credit card company assures me they input the right verification code. - They applied for an Amazon credit card using my identity. It was auto approved, and they used the credit card to purchase ~5k worth of items. I moved everything off of that T-Mobile number, and switched over to GoogleFi (only to learn GoogleFi uses T-Mobile also... still better than T-Mobile directly I'm hoping). Edit: I also wiped my phone, eventually thought that wasn't far enough, and switched to a new device entirely. I'm still unsure how the above occurred, because some of it feels beyond the scope of a SIM-swap.
- bitcoinmoney 4y ago
  This is why you don’t use sms as 2FA. And use iOS. We’re you using android?
  - seanw444 4y ago
    Or GrapheneOS. Or just stop visiting sketchy sites and running sketchy applications. That will eliminate 98% of your problems.
- dvngnt_ 4y ago
  I use Google voice for everything... except my bank because they said using T-Mobile is so much more safer than Google so I had to switch back
  - throwaway2203 4y ago
    I used to as well, but lots of places have stopped accepting VoIP numbers now. A bunch of them actually just silently fail to send messages, so you can be clicking SMS password reset and get nothing in your texts.
abvdasker 4y ago
I'm a Google Fi customer and experienced a very disconcerting fraud attack a year or 2 ago. I made an outbound call to the support number for my bank (I triple-checked that it was the correct number for the bank's support line). My call was routed to fraudsters impersonating my bank's support and I gave them all of my debit card information through what I initially thought was an authentication process. The 1) strange call quality, 2) that they asked for all of my card details and 3) the lack of an automated menu tipped me off and I realized pretty much immediately after the call was over that I had been scammed. I called the exact same support line a second time and got the actual customer service for my bank, at which point I promptly canceled my debit card (but not before the fraudsters performed what appeared to be a test charge of my card for $5 to a random merchant name in Connecticut). I had no idea this kind of attack was possible and I don't know how it works or whether it was related to the T-Mobile breach. Had the hackers attempted an account takeover using the information they collected from me they could conceivably have stolen all of my savings.
- pitaj 4y ago
  That could have actually been on your bank's side. An attacker could have compromised their phone system and is intermittently redirecting calls externally.
UncleMeat 4y ago
This is an interesting development. We've always known that sim swap attacks weren't hard. But I've largely understood them to be not scalable. You can sim swap almost anybody by calling Verizon on the phone. But you needed to call them. This, in my mind, largely meant that the risk of sim swap for most people was pretty low - certainly far lower than the risk of phishing. With this method, it scales. Pwn one person who has relevant system access and then you can sim swap as many people as you want. Now there really is a meaningful difference in security posture between sms and otp.
- vlovich123 4y ago
  Have you missed how much spam a regular phone was getting regularly? Doesn’t seem difficult to regather such an operation to do SIM swap attacks. With AI the mechanisms are even easier.
  - UncleMeat 4y ago
    I have no idea what you are talking about here. SIM swap and spam texts/calls are entirely different issues.
    - vlovich123 4y ago
      If it's scalable to mass call a good chunk of the US population, I'm sure it's scalable to mass call providers to socially engineer a SIM swap.
      - alex_sf 4y ago
        That's.. not how social engineering works.
      - UncleMeat 4y ago
        To perform a SIM swap I need an employee at Verizon or whatever to take some steps on their computer (or have their computer infected with a RAT). To call 100,000 people on the phone I just need a computer that can make phone calls.
RobinL 4y ago
I really enjoyed this episode of Darknet Diaries which tells the story of how some of these SIM swaps are done: https://darknetdiaries.com/transcript/112/ https://darknetdiaries.com/transcript/112/
0xbadcafebee 4y ago
Do you know how expensive it is to support physical keys for a large organization? I'm not talking about the cost of the key. I'm talking about how many people lose, break, or have another problem their keys (data corruption, software issues, USB port is broken, etc). You need dedicated staff at every physical location with all the support capability to troubleshoot those issues and replace keys. Every time a key doesn't work, that's one less person working, plus time taken up by support staff. The TCO is millions of dollars. It's much cheaper to use software tokens that have fewer failure modes and simpler support requirements. Even if you do use physical keys, malware on the machine from a phishing+0-day attack can simply wait for the user to log in with their physical key, and use an existing, valid session to inject an attack. This has existed for at least 15 years since I first saw the attack, and it still works great, even with FIDO2. What happens to T-Mobile if an attacker takes over an account, regardless of security method compromised? Basically nothing. Yeah, some customers get sim-swapped, who cares? T-Mobile has not lost any money. So there is no incentive for T-Mobile to have better security in those cases. Hence, no need for physical keys, which wouldn't stop all attacks anyway.
- photon12 4y ago
  The TTPs outlined in the article could absolutely be mitigated by use of hardware keys, and this would reduce customer risk. You are right about the liability and support calculation, but that doesn't mean it's OK to shift risk to the customer because it's too expensive. It is a failure to not have implemented a physical key deployment, and it must be treated as a failure.
melenaboija 4y ago
I recently saw this: https://www.gsma.com/futurenetworks/gsma-open-gateway-api-descriptions/ https://www.gsma.com/futurenetworks/gsma-open-gateway-api-de... It seems it should solve the SIM Swapping problem with an extra verification step, if the carriers have things right I guess.
SpaceManNabs 4y ago
How does one protect themselves from this? I have an iphone with esim and 2FA on most things, but there are still use cases that send codes via text.
- chatmasta 4y ago
  Most of these breaches happen because someone gets targeted - something about their public profile lands them on the radar of the hackers. Then the hackers dig into the profile looking for associated phone numbers. So to mitigate this, you could (1) reduce your public profile, which is out of scope here, and/or (2) minimize phone number exposure. You want to make it impossible for someone targeting you to locate the phone number you use for 2FA on a particular site. To minimize phone number exposure, you want to send the phone number to as few third parties as you can. You don't want it to show up in any databases, including in breached databases from hacks of companies where you stored your phone number for 2FA purposes. Unfortunately this means the only true solution is a unique phone number per account with SMS 2FA, but that's obviously not practical. So what can you do? A VOIP number like one from Google Voice is the next best solution for receiving 2FA SMS codes to a dedicated number that you keep separately from your personal phone number. This way you receive texts purely through software and don't expose yourself to SIM swapping at the Mobile ISP level. Unfortunately, some providers won't accept Google Voice or VOIP numbers, so for them you're back to square one... maybe as a backup option (only for those sites), you could use a cheap phone with a pay-as-you-go plan; it's not great, because you're still vulnerable to SIM swapping, but at least you have a dedicated number for SMS 2FA. Looking at the problem more widely, it would be nice if my phone or mobile ISP could solve this problem for me, with something akin to disposable phone numbers (think Apple Private Relay, or temporary credit card numbers from the bank) or a dedicated 2FA code relaying service (think Authy or Google Authenticator - in fact, maybe they could offer SMS numbers as a feature, although that seems at least as dangerous as the status quo).
  - SpaceManNabs 4y ago
    I guess I am screwed. Breaches for lastpass and twitter alone link my phone and email and websites :(
alewi481 4y ago
This follows on the unpopular news story that T-Mobile will be requiring you to give them your debit card or bank account information to continue to qualify for their Autopay discount. https://www.cnet.com/tech/mobile/t-mobile-is-dropping-its-autopay-credit-card-discount-in-may/ https://www.cnet.com/tech/mobile/t-mobile-is-dropping-its-au...
- SkyMarshal 4y ago
  How would you do autopay without giving them either a credit card or bank wire info? Seems at least one of those is required.
  - alewi481 4y ago
    The story is that they’re no longer allowing you to get the AutoPay discount with a credit card so you’ll have to set up AutoPay with a debit card or bank account by May to continue to receive the discount.
IronWolve 4y ago
Wasn't just t-mobile, some of the 3rd party connected services ran by other companies that tie into the mobile networks for most major carriers got hacked also. Caller ID services and Iphone Provisioning. Its way worse than the media/public even knows. Its networks built on networks, with api's everywhere. Also, TMO allows you to enable 2FA but ignores it when enabled, still allows you to sign on with email/pass.
narrator 4y ago
The cool thing about T-Mobile is they don't ask for your SSN or care about what name you give if you do pre-paid in cash. This anonymity means that if the bad guys call up T-Mobile and know all your details and they even have a compromised employee with full access, the bad guys still can't find out your real IMEI or phone number and do a sim swap. Another benefit is that, with all the cell phone location selling going on, they can't find your true location either!
- bubbleRefuge 4y ago
  You can put a customer service password on your tmobile account to avoid anyone calling customer service without that password to make any changes. This is separate from your online portal password.
  - narrator 4y ago
    That still doesn't fix the compromised employee problem. If they can match your identity with your phone number, and have full access to t-mobile they can sim swap. Sure, Google could have compromised employees, but I trust Google's security, especially their internal security, much more than T-Mobile.
user3939382 4y ago
Look at Equifax. The government imposes no penalties on these corporations (i.e. who own the government) for this kind of negligence, or worse. The field of competition is very limited, and most consumers I'd guess are either unaware of these problems, feel helpless about them, or don't understand their significance. So what's the pressure exerted on T-Mobile to invest in this problem? There's very little. Unfortunately, for a system with such a big footprint and given the complexity, you'd need a huge amount of pressure to have a meaningful impact on the problem.
Buttons840 4y ago
The security situation with these companies shows no signs of improving. My hot take is to make many forms of hacking legal so long as the hacker reports their findings to the government. Let's have a free for all where every white hat and grey hat hacker gets to test the security of all companies, no permission from the companies required. Otherwise, it's only black hats that get to do the hacking, and they won't tell anyone when the find a vulnerability. Everyone wins except for the companies who will be embarrassed they can't build a secure system to save their life. And they won't be able to legally bully someone for pressing F12 anymore. This is important, it's a national security issue. Extreme measures like this are justified. Some hacks, such as DDoS attacks might have to remain illegal. But otherwise, unless your proven to be stealing and selling data, let there be strong legal protections for those who responsibly report vulnerabilities. And this is practical too. With vulnerability bounties you can solve the problem just by throwing money at it. But bounties can't be an opt-in thing, the companies who need them most are not opting-in.
- photon12 4y ago
  Lack of knowledge of vulnerability is not the limiting factor in this case. All a "free for all" would do in this case is make more noise in which malicious actors can hide in the logs.
  - Buttons840 4y ago
    Are you saying they're aware of all these vulnerabilities? Why don't they fix them? Can one of the wealthiest companies in the nation not fix vulnerabilities they're already aware of? What is the limiting factor here? Competence? My conspiracy theory is that my idea will never be implemented because it would expose the "job creator" class to an objective measure of their competence, and they would not fare well. Headlines like "97% of US organizations are incapable of building secure systems" would not be fun.
    - photon12 4y ago
      You can read lots of comments in these threads about the cost/benefit analysis of mitigating the vulnerabilities. And whenever that cost/benefit calculation gets very complex, the default is to not get too worked up about fixing the status quo because "it's complicated."
exabrial 4y ago
Just a reminder: SMS is not a "Second Factor". Please everyone stop putting this into products.
DyslexicAtheist 4y ago
Some of the comments here seem to argue that creating legislation that demands basic security baselines will not get the job done. In fact in a recent interview[1] Jen Easterly (head of CISA gov) fell into the same trap (assuming because she didn't want to upset tech company lobby groups) so her message was reduced to shouting into the void (asking vendors "please be-good"): > Addressing these issues requires a long-term approach and not simply a new set of regulations or industry standards. Easterly said it will require the leaders of technology companies to focus explicitly on building safer products, provide transparency into their development and manufacturing processes, and an understanding that the burden of safety should not fall solely (or even mainly) on customers. I'm right now struggling to get a bunch of US IoT companies to agree on a very basic set of security standards that would allow more interoperability. All we're asking are basic best practice to anyone working in security (e.g. ETSI 303 645). And the reason why I'm struggling is because in the EU these baselines are becoming the law as of 1st Aug. 2024 with the Radio Equipment Directive (RED). And in addition these same kind of guardrails will also become law with the Cybersec Resilience Act in 2025 expanded to the cloud and mobile apps. So this thing is coming and the US which has a lot better standards (thanks to NIST but lacks legalization due to power of lobby groups) looks like a total laggard here to a point where it becomes embarrassing. Nobody in their right minds would argue there are unreasonable provisions in these proposals for RED (or the CRA). Yet all the US based vendors who do not sell into EU markets shout "bloody murder". And it's hilarious how they're all grandstanding about "how dare the communist EU is telling business how to innovate". Legislation works. Begging vendors to come up with better controls by themselves will not. Anyone who has spent even a single day working in security in a company where security isn't part of their core value proposition (or isn't _the_ product) will know the only way to enforce even the most basic security and safety controls[2] is by legislation. You want a unified charging standard for EV? Make it the law! You want a single type of charger for all phones? Make it the law. You want your coding standards to meet guidelines for functional safety? Make them law. You want to eliminate OWASP Top-10 from production code? Make it the law. [1] https://duo.com/decipher/strong-security-has-to-be-a-standard-feature https://duo.com/decipher/strong-security-has-to-be-a-standar... [2] entirely related: The Humble History of the Crash Test Dummy https://www.motorbiscuit.com/the-humble-history-of-the-crash-test-dummy/ https://www.motorbiscuit.com/the-humble-history-of-the-crash...
coreyog 4y ago
I worked for TMobile for 4 days in 2021. I don't usually apply to big companies but money was tight because pandemic and I needed a job quick. I was assigned to work on the config server (think in-house developed consul or etcd) and it was awful. "If this specific config value is being set by Service A then what is actually written should be twice the given value, but if Service B is reading the value, return 1/3 of the value as an HTTP form body instead of JSON." By Thursday I got a call about a new position and I left so quick that the recruiters black listed me. TMobile getting hacked is a "when" not an "if"
- tpmx 4y ago
  > I don't usually apply to big companies but money was tight because pandemic and I needed a job quick. So T-Mobile offered you a "quick job" that immediately gave you access to their inner sanctum? These threads are a hoot.
- roncesvalles 4y ago
  >config server (think in-house developed consul or etcd) and it was awful. "If this specific config value is being set by Service A then what is actually written should be twice the given value, but if Service B is reading the value, return 1/3 of the value as an HTTP form body instead of JSON." People say dev salaries are way too high but this is basically what internal systems look like at all the places that refuse to pay fair market value.
- latency-guy2 4y ago
  > TMobile getting hacked is a "when" not an "if" I think something more accurate is > TMobile getting hacked is a 'how many times', not a when But adjust further... > All cell providers getting hacked is a 'how many times', not a 'which'
- BeFlatXIII 4y ago
  > By Thursday I got a call about a new position and I left so quick that the recruiters black listed me. That's one way to reduce headhunting spam.
  - 4y ago
gz5 4y ago
No silver bullet but many of these types of attacks would be mitigated, or at least made much more expensive and difficult for the attackers, if we had wider adoption of Yubikey, Webauthn etc. type otp solutions which are more resistant to phishing, keyloggers etc. In practice, what are the barriers to adoption which folks are seeing, and what can we do about it?
- PassageNick 4y ago
  This is a great question. I think the biggest barrier to adoption is lack of end user demand for the service. That is followed by people not understanding/believing the incredible increase in user experience and security. It's almost like people think it is too good to be true.
aidenn0 4y ago
I'm on an MVNO that uses T-Mobile. I recently got 100s of "verify your number" sign-ups from over a dozen services. Could this have been part of an (attempted?) sim swapping attack?
burna_aws_acct 4y ago
One random factoid I notice is that AWS and Microsoft just announced launch of Open Gateway. Noticeably missing from that list of Telecom Providers is... T-Mobile. I'm sure it's mere coincidence, albeit a noticeable coincidence. " Initial carriers that have signed up to Open Gateway are América Móvil, AT&T, Axiata, Bharti Airtel, China Mobile, Deutsche Telekom, e& Group, KDDI, KT, Liberty Global, MTN, Orange, Singtel, Swisscom, STC, Telefónica, Telenor, Telstra, TIM, Verizon and Vodafone. " Link: https://techcrunch.com/2023/02/26/mobile-carriers-team-up-with-aws-microsoft-to-launch-open-gateway-a-set-of-twilio-like-apis-to-tap-network-services/ https://techcrunch.com/2023/02/26/mobile-carriers-team-up-wi...
mikece 4y ago
This is why I buy service from Mint mobile using a fake name, a burner email address, and a prepaid debit card purchased at Walmart. Go to town with that info, hackers!
- SkyMarshal 4y ago
  Is it easy to refill that prepaid debit card?
idiotsecant 4y ago
My approach to this is to use a google voice phone number where all SMS get sent to email. The voice account and the gmail account are the same google account which is secure by hardware 2FA yubikey login. I have a cell phone with an entirely different number that I use for non-2FA things so if it gets compromised i'm OK. I do access that email from that phone, so I suppose i'm a bit vulnerable to targeted phone theft, but SIM swapping shouldn't be a problem, I don't think? In the opinion of HN is this the most secure way to do it while still allowing me to use services that force SMS based 2FA (almost everything) ? Is there a better way?
- throwayphilsphr 4y ago
  This works pretty well until google decides to block your account randomly one day.
  - idiotsecant 4y ago
    Is this something that happens sometimes? I guess I hadn't considered that very likely but maybe I should be more concerned.
  - hot_gril 4y ago
    My Google Voice keeps randomly losing its phone number. I haven't bothered figuring out why, maybe inactivity, but it doesn't matter cause I've already crossed it off as something to rely on.
sourcecodeplz 4y ago
One solution is to keep two phone numbers. Your regular number that everyone knows and a second prepaid SIM that you use online only.
grammers 4y ago
Wow, if true, this sounds like really, really bad security protocols.
__MatrixMan__ 4y ago
Shame on T-Mobile. That said, perhaps everybody using SMS 2FA is equally culpable (e.g. most banks). Nobody who has worked at a mobile carrier would ever think that they're ready to be high-value targets. So it's puzzling that the banks are so eager to put them in that position.
- ashwagary 4y ago
  The order of shaming should be: 1. Businesses using insecure channels to do authentication and validation. 2. Mobile carriers
  - __MatrixMan__ 4y ago
    Oh you're right, I had it backwards. Perhaps the carriers should be trying to PR-hack this into more people's minds. I'm imagining an authorized pen-tester program which lets authenticated users achieve an atomic sim-swap (i.e. the creds were intercepted but the swap-back occurred immediately after, so as not to deny additional service to the victim).
ed25519FUUU 4y ago
I believe this. I have a single credit card that I use only for our T-Mobile bill on autopay (the credit card offers insurance on my phones via this method). About 2 months ago I noticed $15 charges very cleverly disguised as Amazon prime. The only giveaway was that it said the number was entered manually. Everyone with T-Mobile autopay should check immediate for an Amazon prime charge that was manually entered.
deafpolygon 4y ago
Correction: Hackers breached T-Mobile more than 100 times in 2022
w_for_wumbo 4y ago
I see people jumping towards regulation, but that has the side-effect of making it even more difficult for there to be any competition against these monopolies. What we really need is legitimate competition, to enable consumers to vote with their wallet and move to a competitor that takes the security of their customer's private data seriously.
- mike_d 4y ago
  > making it even more difficult for there to be any competition against these monopolies If your snappy upstart cellular network can't afford to give out Yubikeys to employees, I don't want you interconnecting with the rest of the phone system.
  - photon12 4y ago
    Also, startups have such an advantage now that there is an ecosystem of COTS and SaaS tooling that can help you do a complete integration strategy. It's arguable MFA regulations would advantage startups because they don't have to deal with the complexity of legacy network piecemeal integration. I planned and did the roll out of Yubikeys at the last place I worked, before there was a dollar in sales, and the lifecycle could be supported with 2 people (minutes at most out of each day for support) and an integration to our HR platform that automated procurement and mailing of keys.
- munchler 4y ago
  Ah, the libertarian dream. Unfortunately, utilities such as phone service are often close to natural monopolies, due to the infrastructure overhead.
hk1337 4y ago
This was at least couple of decades ago but I remember how they would send your password to your phone over SMS.
- SkyMarshal 4y ago
  Yup, just over one decade ago actually: https://plaintextoffenders.com/post/4567498592/t-mobilenet https://plaintextoffenders.com/post/4567498592/t-mobilenet And more recently in 2018: https://plaintextoffenders.com/post/174100751368/meint-mobileat-internet-and-telecommunications https://plaintextoffenders.com/post/174100751368/meint-mobil... A few more in the master list here: https://github.com/plaintextoffenders/plaintextoffenders/blob/master/offenders.csv https://github.com/plaintextoffenders/plaintextoffenders/blo...
gojomo 4y ago
Seems plausible. Suffered a SIM-hijack attack via T-Mobile a few years ago. Set a giant extra arbitrary password for account changes after that - but they essentially don't ask for it. Fairly regularly they show notices of breaches via email or when logging in. Don't use a mere mobile number for the backup access to anything inportant!
KerryJones 4y ago
Anyone who is privacy/security savvy, is there anything that can be done to protect my data as a T-Mobile user? I avoid 2FA SMS authentication wherever I can (use Authenticator for most things)
Aleksdev 4y ago
I believe it. I opened up at mobile account and I would get random advertisement text messages.
AceyMan 4y ago
Ironically, today I got a promotional SMS from Tmo offering — wait for it — checking & savings accounts from them. Uhhh ... hard pass.
GRACE44 4y ago
[dead]
GRACE44 4y ago
[dead]
6451937099 4y ago
[dead]
6451937099 4y ago
[dead]
deightonarnette 4y ago
[dead]

533 points by mikece 4y ago

They will pay the fines and keep doing business happily and another "we're sorry, it won't happen again..." The joys of being too big to fail.

grugagag 4y ago
Increase the fines tenfold or up them an order of magnitude till it’s no longer just a negligible cost of doing business
- mikestew 4y ago
  Increase the fines tenfold or up them an order of magnitude... We get it, no need to repeat yourself. ;-)

nodesocket 4y ago

I don’t doubt it. My cell phone stopped working for a day, I called in and talked to somebody who I could barely understand and knew very little about basic security. I tried to explain multiple times that my account was probably SIM swapped and the support person completely ignored this security concern and just said I have fixed the issue on my end anything else I can help you with? Please rate me 5 star in the coming support survey.

wkat4242 4y ago
Pretty typical for most first line support though. Especially outsourced. It's hard to find people with languages and tech skills so most outsourcers just fulfill the former and cover the latter with endless infernal flowcharts. Really sucks when your problem is not on the chart. Escalating is usually discouraged by giving targets per day to the agents. I guess you're in the US so perhaps language isn't as much of an issue but a lot of US companies support from the Philippines now because they have a favourably perceived accent (unlike Indians which a lot of customers have come to associate with 'poor support' so it leads to kneejerk reactions *). But anyway in the Philippines it's now hard to find staff too. But anyway my point is that the support experience is not really related to internal IT competence. *) not my personal opinion but I have seen US companies in particular use this argument. Unlike in the UK where Indian accents are common. I worked on the contact center tech realm for 20 years.
pitaj 4y ago
Was this on T-Mobile? In my experience their support is actually quite good. I always get connected to someone in the US.

r053bud 4y ago

[flagged]

JLCarveth 4y ago
$0.13 and a "Sorry, it won't happen again."
- pessimizer 4y ago
  "Although the settlement and the apology should not be misconstrued as an admission that we were responsible for anything that happened."
welder 4y ago
You didn't read the article. This isn't about a data leak, it's about being able to intercept SMS for any T-Mobile phone number.
- testfrequency 4y ago
  Surely any enterprising criminal would do both sell and exploit users data…
  - outworlder 4y ago
    Not if they are doing a SIM swap. If they are paying $1k as claimed they are after far more interesting things in your accounts than just basic information to sell.
    - welder 4y ago
      It's common to target high value accounts for BTC. https://www.coindesk.com/policy/2022/10/20/two-us-men-sentenced-for-stealing-crypto-using-sim-swapping/ https://www.coindesk.com/policy/2022/10/20/two-us-men-senten...
- r053bud 4y ago

jeffalo 4y ago

[dead]

OscarMcLaren 4y ago

[dead]

testfrequency 4y ago

You know, I’m starting to become slightly more serious about switching carriers solely based on how terrible it would be to experience SMS/Call diverting of my number. While I use a yubikey, OTP (where possible), and unique passwords…there’s still places where I have no choice and my number is my auth (or stupidly a reset option). I genuinely am happy with TMO service in the US, and frankly abroad it’s excellent…but I’d be lying if every single article I see about their security breaches reminds me I may be on borrowed time myself.

welder 4y ago
Unfortunately, most carriers (except ATT & Verizon) are just T-Mobile resellers... so you might think you're not using T-Mobile but you're still affected. Even if you use ATT or Verizon, the article mentions they're also hacked and SMS intercepted often.
- forbiddenlake 4y ago
  Can you source "most" and define "carrier" specifically for your comment? Verizon and AT&T are the other of the big 3 carriers in the US, and they're not reselling T-Mobile. And all 3 have MNVOs (mobile virtual network operator) that resell and/or combine the networks of the big 3.
- testfrequency 4y ago
  Honestly, I’d assume being on a MVNO carrier would actually protect you from this, as you’re simply roaming on the T-Mobile network through the carrier agreement. Even ATT and Verizon have roaming agreements. The issue is for T-Mobile direct customers, which obviously their internal systems have access to. I see no reason why T-Mobile would have access to users accounts at another company…
  - plexicle 4y ago
    https://www.theverge.com/2023/2/1/23580947/google-fi-mobile-tmobile-security-breach-data https://www.theverge.com/2023/2/1/23580947/google-fi-mobile-... "Google says that hackers may have accessed limited customer information via the compromised system, which includes phone numbers, SIM card serial numbers, account status, and mobile service plan data. The system did not contain personal customer information such as names, email addresses, payment card data, government IDs, passwords, or pin numbers." It's something, but not perfect.

photon12 4y ago

> T-Mobile declined to answer questions about what it may be doing to beef up employee authentication. But Nicholas Weaver, a researcher and lecturer at University of California, Berkeley’s International Computer Science Institute, said T-Mobile and all the major wireless providers should be requiring employees to use physical security keys for that second factor when logging into company resources. > “These breaches should not happen,” Weaver said. “Because T-Mobile should have long ago issued all employees security keys and switched to security keys for the second factor. And because security keys provably block this style of attack.” At what point do we consider industry self-regulation on this a total failure? You don't need to make Yubikeys a part of every auth workflow in your corporate enterprise if there are legacy systems/integrations, but you should at least do it for the things that can change customer mobile subscription details and there can't be any excuse.

gjsman-1000 4y ago
You assume that regulation can just make security magically happen. I see no reason to assume that premise to be correct in practice. It's not like the US Government hasn't been breached countless times or had Supreme Court opinions leaked; and it's not like corporations that really tried and should be examples of best practice haven't also been breached. Also, what law can prevent insider attacks? There's already plenty of laws making that illegal. There's no law that just "makes security happen" - and, actually, I would be fundamentally opposed to such a law because it turns security into a simple matter of compliance. "We're SCA compliant, therefore we're good!" And technology changes way too much - a security law that was written 10 years ago would be a disaster today. See South Korea's Banking Security laws for an example - they basically enshrined ActiveX in their law with roll-your-own-crypto to this day. And we know now that was a trash idea but nobody wants to take the blame for upsetting the security standards. https://palant.info/2023/01/02/south-koreas-online-security-dead-end/ https://palant.info/2023/01/02/south-koreas-online-security-... and https://www.nytimes.com/2022/07/08/business/korea-internet-explorer.html https://www.nytimes.com/2022/07/08/business/korea-internet-e...
- photon12 4y ago
  I'm not calling for regulation on general security outcomes. I'm talking specifically about access controls on sensitive and highly privileged systems that have ripple impacts to consumer security, which should already be obvious best practice.

outworlder 4y ago

> Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobile user’s text messages and phone calls to another device. If they are doing all this through phishing and aren't being as successful with other networks there's some serious issue that's being overlooked. It's unclear from the article if this is due to training, lax security on internal tools, lack of two factor (as claimed in the article) or something else (even insiders). That's too bad, I've been on T-Mobile for years. Whenever I can I'll use yubikeys or OTP. But there's still a large number of sites and services that rely on SMS.

wnevets 4y ago
> But there's still a large number of sites and services that rely on SMS. I avoid using my actual phone number whenever possible and use a Google Voice number. Hacking Google Voice would require hacking my actual Google account instead of just tricking someone at the phone company.
- nordsieck 4y ago
  > I avoid using my actual phone number whenever possible and use a Google Voice number. I do too. Sadly there are a number of sites/orgs that require you to use a mobile number. I don't really understand why.
- computing 4y ago
  why do you think that? Presumably Google Voice uses a phone company downstream, which means if that company is hacked they can reassign your number to someone else and thus you have the classic SIM jacking attack.
  - wnevets 4y ago
    Which phone company does the hacker call to trick into believing they are Google?
    - 4y ago

LinuxBender 4y ago

Might it be time for the US government to step in using eminent domain, seize the company and merge it into a different provider? Are other providers more secure or do we just hear about T-Mobile the most? Who should take over T-Mobile? [Edit] The more I think about this, perhaps another path to resolution would be to remove limited liability protections from companies that repeatedly put their customers at risk, especially given that phones are used as financial transaction authenticators. Perhaps some bank regulations need to find their way onto cellular providers.

usefulcat 4y ago
And then we'd be down to what, two wireless carries in the US? AT&T already tried to acquire/merge with T-Mobile some years ago but it didn't go through. I forget why, but probably due to antitrust issues. And wasn't Sprint just acquired/merged with not long ago, by T-Mobile IIRC?
- LinuxBender 4y ago
  And then we'd be down to what, two wireless carries in the US? I think you are correct. I don't like the idea of making a giant-bell yet once again but I also don't see a way to correct T-Mobiles obvious cavalier and brazen incompetence. Fines? Companies just factor that into the cost of doing business. Threat of losing their FCC license? I think collusion between business and government would drag that fight out for decades and probably even exacerbate the problem. March their leaders through town with a shame-nun? I don't know what would get real results quickly. Tack on some bigger fiduciary liabilities since phones are used to authenticate bank transactions? Perhaps if some powerful political leaders had nasty secrets revealed or lost money as a result of these hacks there might be action but that is a big if. That might never happen and that also assumes there is proper attribution.
- SkyMarshal 4y ago
  > I forget why, but probably due to antitrust issues. And wasn't Sprint just acquired/merged with not long ago, by T-Mobile IIRC? Yes and yes. We're down to three big mobile telecoms now, ATT, Verizon, T-mobile/Sprint. At least MVNO's are allowed though, plenty of those.

streptomycin 4y ago

Which cell phone network would you guys recommend for people who care about security?

bitcoinmoney 4y ago
US mobile has good 2FA.
- zamnos 4y ago
  Heads up that US mobile is an MVNO operating on T-Mobile and Verizon, so how good their 2FA system is irrelevant if hackers get deep enough into tmobile.
  - comte7092 4y ago
    “Deep enough” would be true of any mobile carrier, to date all of these attacks are SIM swapping, with social engineering/phishing being the attack vector. Not particularly deep. Attackers would have to social engineer the MVNO directly, which is certainly easier if they have data they’ve stolen from t-mobile first, but this isn’t a “they’ll get in no matter what because they’ve pwned T-Mobile so bad” scenario.
    - jelled 4y ago
      https://www.bleepingcomputer.com/news/security/google-fi-data-breach-let-hackers-carry-out-sim-swap-attacks/ https://www.bleepingcomputer.com/news/security/google-fi-dat... This article says that Google Fi customers were SIM swapped due to a T-Mobile breach. Even though "[t]here was no access to Google's systems or any systems overseen by Google."
      - comte7092 4y ago
        > These attacks are conducted using social engineering, where the threat actor impersonates the customer and requests that the number be ported to a new device for some reason. To convince the mobile carrier that they are the customer, they provide personal information exposed to phishing attacks and data breaches. > As the Google Fi data breach includes phone numbers, which can easily be linked to a customer's name, and the serial number of SIM cards, it would have made it even more convincing when contacting a mobile customer support representative. They used the data in the breach to social engineer the Google fi reps. Attackers still needed to get through Google’s customer support system to perform the SIM swaps.

jelled 4y ago

Was thinking about moving a line to Google Fi for this reason. I know they just resell T-Mobile bandwidth, but would they provide better account level security? Is it common for Google Fi customers to get SIM swapped?

jareklupinski 4y ago
yup https://www.bleepingcomputer.com/news/security/google-fi-data-breach-let-hackers-carry-out-sim-swap-attacks/ https://www.bleepingcomputer.com/news/security/google-fi-dat... my friend had google fi and was caught in this, among other things they had their instagram taken over. scary few days. thankfully their roommate works at meta... I think the only way to be really safe is to use one of the smaller MVNOs and never ever ever reveal who your carrier is
- jelled 4y ago
  Thanks! Based on that article it seems that anyone who's reselling T-Mobile service would be vulnerable.
  - computing 4y ago
    Do we know if Google Voice also uses T-Mobile? If not, might be worthwhile to switch SMS 2FA to the Voice number if a service allows voip numbers.
    - BenjiWiebe 4y ago
      Google Voice isn't a wireless carrier. VoIP only.
      - computing 4y ago
        This is part of my question. How does Google provision VoIP numbers? When someone calls / texts a VoIP number from a normal number, that call / SMS travels over normal wireless infrastructure. So VoIP numbers are still connected to the same infra, right?

geekifier 4y ago

It is an open secret that criminal groups also pay unscrupulous T-Mobile employees to assist with SIM-swap attacks. I am not sure at what scale this happens, as those instances _should_ be easy to trace and prosecute. But I have seen evidence of criminals reaching out and offering "side work" on the T-mobile subreddits, as an example. In those cases, hardware keys for employees would not help.

londons_explore 4y ago
> those instances _should_ be easy to trace and prosecute I suspect that the employees aren't merely doing a sim swap attack with their work login credentials. Like you say, they'd clearly get fired/prosecuted for that. Instead, I suspect criminal X buys a nice thing delivered to employee Y's house. Then, criminal X phones the helpdesk repeatedly till they get connected to employee Y during working hours. Then, they claim to own the phone number of victim Z, but have lost the phone, their id and everything else. But they manage to tell employee Y the answer to two of the secret questions "What is your gender", and "Did you use the internet in the last month?". The employee uses this, together with their judgement to proceed, according to company policy, and issue a new eSIM. Later, when anyone finds out, the call is listened to, and the employee can legitimately say they were just following policy.
- vain_cain 4y ago
  Out of high school I've worked a couple of years for A1 telecom(in Croatia) in customer service. When someone called, all I was required to ask is their OIB(Personal identification number) and they could literally ask me for anything if it's a residential user. Want to cancel 20 numbers that still got 2 years until the contracts expire? Sure, let me do that for you. Want to change sim? Sure, just give me the new sim number. Want to add 5 tariffs to your plan? Sure, do you want phones with that? That was 6 years ago but I still got friends I talk to there, and not much has changed.
- DrewADesign 4y ago
  I imagine getting someone job-fair hired under assumed credentials and ghosting after one full shift of abusing their access, or giving a very poorly paid CSR just enough cash to make it worth the risk is probably more straightforward, but I don't know anything about that stuff. Most restaurants/bars I worked at had hourly staff working under 'borrowed' SSNs and names for years, though.

eigenvalue 4y ago

Maybe it's just me, but I no longer trust news from Krebs ever since he got the Ubiquiti story so utterly wrong.

photon12 4y ago
There's enough purported primary source data here that I am inclined to believe this reporting entirely.
8kingDreux8 4y ago
For those wondering... https://arstechnica.com/tech-policy/2022/03/ubiquiti-sues-journalist-alleging-defamation-in-coverage-of-data-breach/ https://arstechnica.com/tech-policy/2022/03/ubiquiti-sues-jo...
mattw2121 4y ago
I trust Krebs even more. He messed up, he knows it, and he's motivated to make sure it doesn't happen again.

Tijdreiziger 4y ago

The article doesn't make it clear which T-Mobiles are affected. The article seems to be US-centric, so, only T-Mobile US? Or all 13 Deutsche Telekom subsidiaries [1]? What about T-Mobile Netherlands, which was sold off by Deutsche Telekom but retains the T-Mobile name? [1] https://en.wikipedia.org/wiki/T-Mobile#Operations https://en.wikipedia.org/wiki/T-Mobile#Operations

LinuxBender 4y ago

I've been thinking about this a bit more and I think the right path forward is to impose the same fiduciary liabilities and regulations on cellular providers that banks enjoy. Phones are used as authentication devices for bank transactions. If cellular providers have to go through all the same audits of controls as banks and share the same fiduciary liabilities that may raise the bar for phishing attempts. This may also change the employment requirements for people at T-Mobile and there would be more scrutiny to weed out some of the bad apples or at least increase monitoring and auditing of transactions to provide more visibility to forensic teams.

jameshart 4y ago
> phones are used as authentication devices for banking transactions That’s the banks’ choice though. Are cellular providers selling them a secure authentication service? Or just an insecure best effort message delivery channel? But then of course the banks can ping that liability further upstream: as a customer, when you choose to opt in to SMS authentication, you’re the one vouching for the security of your cellphone provider, telling your bank ‘I trust their account security enough that if you send a message to this number you can assume the recipient is me’ So now you’re left going to your cell company and saying ‘since the bank said I could use you for auth, you’re properly secure right?’ And their answer is ‘lol no. check our t’s and c’s.’ And then you wind up saying ‘but I want to be able to assume that and I think my cell company should be liable if they aren’t’, and asking for the cellphone company to be regulated like a bank. Because banks are that good at deflecting liability.
- LinuxBender 4y ago
  I think the legislation should be worded so that if a cellular provider does not want the fiduciary and regulatory requirements imposed on them, they must disable all SS7-to-MAPI SMS/text message gateways or any other form of non-E2EE unencrypted and unauthenticated communication. SIM swapping becomes less useful as encrypted applications take over MFA/2FA authentication meaning the attacker must acquire and unlock the phone itself rather than being able to impersonate it. Even voice communication must be encrypted when cell-to-cell so that Joe-Blow-Nobody and the President of the United States have exactly the same protection on their personal cell phones. If a company key use used for lawful intercept there must be a massive audit trail that makes it crystal clear who monitored what and for how long. No more pressuring people like me to give authorities unfettered and un-monitored lawful monitoring access.

mzs 4y ago

>“A huge reason this problem has been allowed to spiral out of control is because children play such a prominent role in this form of breach,” Nixon said. >Nixon said SIM-swapping groups often advertise low-level jobs on places like Roblox and Minecraft, online games that are extremely popular with young adolescent males. >… “They recruit children because they’re naive, you can get more out of them, and they have legal protections that other people over 18 don’t have.”

cbdumas 4y ago

The rise of SMS as a second factor for security across the web has raised the incentive for SIM-swapping tremendously. No one should be shocked that when tech companies start outsourcing their identity verification to cell phone providers those providers come under attack.

jandrese 4y ago
SMS as a second factor is almost a security downgrade. Phone companies are terrible, you shouldn't be trusting them with authentication. Plus it means you can't authenticate when your phone is out of coverage. Just a bad solution that shouldn't be used. TOTP is so easy to set up that it makes no sense to use SMS, and the even better hardware keys are only slightly less convenient.
- twosdai 4y ago
  Most users don't know what the words sms or totp mean. I'm not saying that totp isn't easy to implement in the grand scheme of things, but for many people it's not straight forward to setup. Entering a cellphone number and responding to text messages is well known since we've been doing it for 20 something years now. I think totp would probably get more traction with normal users if people started calling it app verification, or something similar eventhough that is slightly incorrect.
- ridgered4 4y ago
  SMS allows you to collect phone numbers which are quite good at identifying users for tracking and ad targeting though. And since most large tech companies are advertising companies (in whole or in part) it is no surprise they chose this as a second factor. Even if you try to avoid using SMS for 2FA they'll try to collect the number for account verification or recovery, with regular nags or lately go straight to extorting it out of you to continue to access purchased services or software.
  - deleted 4y ago
    [deleted]

donutpepperoni 4y ago

Would switching to an eSIM based phone offer any sort of risk mitigation in these scenarios?

testfrequency 4y ago
Zero
aesh2Xa1 4y ago
An eSIM will prevent a physical swap. However, an eSIM will not prevent a port-out of your phone number. To defend against port-out you should enable port protection. The name of such a feature varies by carrier, and T-Mobile seems to refer to it as "Takeover Protection."

upofadown 4y ago

In fairness, T-Mobile (and other phone companies) don't really want to provide no cost authentication for other entities. SIM swapping wouldn't be an issue if forces outside the control of the phone companies were not making it so profitable. If we need to legislate something, perhaps we should try to discourage this sort of thing in the first place. One company should not be allowed to paint a target on an uninvolved company for financial gain.

flutas 4y ago
> don't really want to provide no cost authentication for other entities Is the customer not paying for the cell phone plan? Nothing is “no cost” in this situation. The cost is just shifted to the consumer from the company in the form of requiring a phone number. > One company should not be allowed to paint a target on an uninvolved company for financial gain. Or, if T-Mobile and others did a good job in security for their networks and in turn their customers communications maybe they wouldn’t have this issue. IMO this comparison would be like claiming a gas station is responsible for your cars electronics not functioning properly.

ctvo 4y ago

I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compromised In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order. Both passwords to both accounts were kept the same. After I caught on to the above once I received my credit card statement, in November: - They attempted to purchase something with my credit card. Security mechanisms triggered, and a verification code was sent to my phone at 4am in the morning. They successfully validated and placed the order. My credit card company assures me they input the right verification code. - They applied for an Amazon credit card using my identity. It was auto approved, and they used the credit card to purchase ~5k worth of items. I moved everything off of that T-Mobile number, and switched over to GoogleFi (only to learn GoogleFi uses T-Mobile also... still better than T-Mobile directly I'm hoping). Edit: I also wiped my phone, eventually thought that wasn't far enough, and switched to a new device entirely. I'm still unsure how the above occurred, because some of it feels beyond the scope of a SIM-swap.

bitcoinmoney 4y ago
This is why you don’t use sms as 2FA. And use iOS. We’re you using android?
- seanw444 4y ago
  Or GrapheneOS. Or just stop visiting sketchy sites and running sketchy applications. That will eliminate 98% of your problems.
dvngnt_ 4y ago
I use Google voice for everything... except my bank because they said using T-Mobile is so much more safer than Google so I had to switch back
- throwaway2203 4y ago
  I used to as well, but lots of places have stopped accepting VoIP numbers now. A bunch of them actually just silently fail to send messages, so you can be clicking SMS password reset and get nothing in your texts.

abvdasker 4y ago

I'm a Google Fi customer and experienced a very disconcerting fraud attack a year or 2 ago. I made an outbound call to the support number for my bank (I triple-checked that it was the correct number for the bank's support line). My call was routed to fraudsters impersonating my bank's support and I gave them all of my debit card information through what I initially thought was an authentication process. The 1) strange call quality, 2) that they asked for all of my card details and 3) the lack of an automated menu tipped me off and I realized pretty much immediately after the call was over that I had been scammed. I called the exact same support line a second time and got the actual customer service for my bank, at which point I promptly canceled my debit card (but not before the fraudsters performed what appeared to be a test charge of my card for $5 to a random merchant name in Connecticut). I had no idea this kind of attack was possible and I don't know how it works or whether it was related to the T-Mobile breach. Had the hackers attempted an account takeover using the information they collected from me they could conceivably have stolen all of my savings.

pitaj 4y ago
That could have actually been on your bank's side. An attacker could have compromised their phone system and is intermittently redirecting calls externally.

UncleMeat 4y ago

This is an interesting development. We've always known that sim swap attacks weren't hard. But I've largely understood them to be not scalable. You can sim swap almost anybody by calling Verizon on the phone. But you needed to call them. This, in my mind, largely meant that the risk of sim swap for most people was pretty low - certainly far lower than the risk of phishing. With this method, it scales. Pwn one person who has relevant system access and then you can sim swap as many people as you want. Now there really is a meaningful difference in security posture between sms and otp.

vlovich123 4y ago
Have you missed how much spam a regular phone was getting regularly? Doesn’t seem difficult to regather such an operation to do SIM swap attacks. With AI the mechanisms are even easier.
- UncleMeat 4y ago
  I have no idea what you are talking about here. SIM swap and spam texts/calls are entirely different issues.
  - vlovich123 4y ago
    If it's scalable to mass call a good chunk of the US population, I'm sure it's scalable to mass call providers to socially engineer a SIM swap.
    - alex_sf 4y ago
      That's.. not how social engineering works.
    - UncleMeat 4y ago
      To perform a SIM swap I need an employee at Verizon or whatever to take some steps on their computer (or have their computer infected with a RAT). To call 100,000 people on the phone I just need a computer that can make phone calls.

RobinL 4y ago

I really enjoyed this episode of Darknet Diaries which tells the story of how some of these SIM swaps are done: https://darknetdiaries.com/transcript/112/ https://darknetdiaries.com/transcript/112/

0xbadcafebee 4y ago

Do you know how expensive it is to support physical keys for a large organization? I'm not talking about the cost of the key. I'm talking about how many people lose, break, or have another problem their keys (data corruption, software issues, USB port is broken, etc). You need dedicated staff at every physical location with all the support capability to troubleshoot those issues and replace keys. Every time a key doesn't work, that's one less person working, plus time taken up by support staff. The TCO is millions of dollars. It's much cheaper to use software tokens that have fewer failure modes and simpler support requirements. Even if you do use physical keys, malware on the machine from a phishing+0-day attack can simply wait for the user to log in with their physical key, and use an existing, valid session to inject an attack. This has existed for at least 15 years since I first saw the attack, and it still works great, even with FIDO2. What happens to T-Mobile if an attacker takes over an account, regardless of security method compromised? Basically nothing. Yeah, some customers get sim-swapped, who cares? T-Mobile has not lost any money. So there is no incentive for T-Mobile to have better security in those cases. Hence, no need for physical keys, which wouldn't stop all attacks anyway.

photon12 4y ago
The TTPs outlined in the article could absolutely be mitigated by use of hardware keys, and this would reduce customer risk. You are right about the liability and support calculation, but that doesn't mean it's OK to shift risk to the customer because it's too expensive. It is a failure to not have implemented a physical key deployment, and it must be treated as a failure.

melenaboija 4y ago

I recently saw this: https://www.gsma.com/futurenetworks/gsma-open-gateway-api-descriptions/ https://www.gsma.com/futurenetworks/gsma-open-gateway-api-de... It seems it should solve the SIM Swapping problem with an extra verification step, if the carriers have things right I guess.

SpaceManNabs 4y ago

How does one protect themselves from this? I have an iphone with esim and 2FA on most things, but there are still use cases that send codes via text.

chatmasta 4y ago
Most of these breaches happen because someone gets targeted - something about their public profile lands them on the radar of the hackers. Then the hackers dig into the profile looking for associated phone numbers. So to mitigate this, you could (1) reduce your public profile, which is out of scope here, and/or (2) minimize phone number exposure. You want to make it impossible for someone targeting you to locate the phone number you use for 2FA on a particular site. To minimize phone number exposure, you want to send the phone number to as few third parties as you can. You don't want it to show up in any databases, including in breached databases from hacks of companies where you stored your phone number for 2FA purposes. Unfortunately this means the only true solution is a unique phone number per account with SMS 2FA, but that's obviously not practical. So what can you do? A VOIP number like one from Google Voice is the next best solution for receiving 2FA SMS codes to a dedicated number that you keep separately from your personal phone number. This way you receive texts purely through software and don't expose yourself to SIM swapping at the Mobile ISP level. Unfortunately, some providers won't accept Google Voice or VOIP numbers, so for them you're back to square one... maybe as a backup option (only for those sites), you could use a cheap phone with a pay-as-you-go plan; it's not great, because you're still vulnerable to SIM swapping, but at least you have a dedicated number for SMS 2FA. Looking at the problem more widely, it would be nice if my phone or mobile ISP could solve this problem for me, with something akin to disposable phone numbers (think Apple Private Relay, or temporary credit card numbers from the bank) or a dedicated 2FA code relaying service (think Authy or Google Authenticator - in fact, maybe they could offer SMS numbers as a feature, although that seems at least as dangerous as the status quo).
- SpaceManNabs 4y ago
  I guess I am screwed. Breaches for lastpass and twitter alone link my phone and email and websites :(

alewi481 4y ago

This follows on the unpopular news story that T-Mobile will be requiring you to give them your debit card or bank account information to continue to qualify for their Autopay discount. https://www.cnet.com/tech/mobile/t-mobile-is-dropping-its-autopay-credit-card-discount-in-may/ https://www.cnet.com/tech/mobile/t-mobile-is-dropping-its-au...

SkyMarshal 4y ago
How would you do autopay without giving them either a credit card or bank wire info? Seems at least one of those is required.
- alewi481 4y ago
  The story is that they’re no longer allowing you to get the AutoPay discount with a credit card so you’ll have to set up AutoPay with a debit card or bank account by May to continue to receive the discount.

IronWolve 4y ago

Wasn't just t-mobile, some of the 3rd party connected services ran by other companies that tie into the mobile networks for most major carriers got hacked also. Caller ID services and Iphone Provisioning. Its way worse than the media/public even knows. Its networks built on networks, with api's everywhere. Also, TMO allows you to enable 2FA but ignores it when enabled, still allows you to sign on with email/pass.

narrator 4y ago

The cool thing about T-Mobile is they don't ask for your SSN or care about what name you give if you do pre-paid in cash. This anonymity means that if the bad guys call up T-Mobile and know all your details and they even have a compromised employee with full access, the bad guys still can't find out your real IMEI or phone number and do a sim swap. Another benefit is that, with all the cell phone location selling going on, they can't find your true location either!

bubbleRefuge 4y ago
You can put a customer service password on your tmobile account to avoid anyone calling customer service without that password to make any changes. This is separate from your online portal password.
- narrator 4y ago
  That still doesn't fix the compromised employee problem. If they can match your identity with your phone number, and have full access to t-mobile they can sim swap. Sure, Google could have compromised employees, but I trust Google's security, especially their internal security, much more than T-Mobile.

user3939382 4y ago

Look at Equifax. The government imposes no penalties on these corporations (i.e. who own the government) for this kind of negligence, or worse. The field of competition is very limited, and most consumers I'd guess are either unaware of these problems, feel helpless about them, or don't understand their significance. So what's the pressure exerted on T-Mobile to invest in this problem? There's very little. Unfortunately, for a system with such a big footprint and given the complexity, you'd need a huge amount of pressure to have a meaningful impact on the problem.

Buttons840 4y ago

The security situation with these companies shows no signs of improving. My hot take is to make many forms of hacking legal so long as the hacker reports their findings to the government. Let's have a free for all where every white hat and grey hat hacker gets to test the security of all companies, no permission from the companies required. Otherwise, it's only black hats that get to do the hacking, and they won't tell anyone when the find a vulnerability. Everyone wins except for the companies who will be embarrassed they can't build a secure system to save their life. And they won't be able to legally bully someone for pressing F12 anymore. This is important, it's a national security issue. Extreme measures like this are justified. Some hacks, such as DDoS attacks might have to remain illegal. But otherwise, unless your proven to be stealing and selling data, let there be strong legal protections for those who responsibly report vulnerabilities. And this is practical too. With vulnerability bounties you can solve the problem just by throwing money at it. But bounties can't be an opt-in thing, the companies who need them most are not opting-in.

photon12 4y ago
Lack of knowledge of vulnerability is not the limiting factor in this case. All a "free for all" would do in this case is make more noise in which malicious actors can hide in the logs.
- Buttons840 4y ago
  Are you saying they're aware of all these vulnerabilities? Why don't they fix them? Can one of the wealthiest companies in the nation not fix vulnerabilities they're already aware of? What is the limiting factor here? Competence? My conspiracy theory is that my idea will never be implemented because it would expose the "job creator" class to an objective measure of their competence, and they would not fare well. Headlines like "97% of US organizations are incapable of building secure systems" would not be fun.
  - photon12 4y ago
    You can read lots of comments in these threads about the cost/benefit analysis of mitigating the vulnerabilities. And whenever that cost/benefit calculation gets very complex, the default is to not get too worked up about fixing the status quo because "it's complicated."

exabrial 4y ago

Just a reminder: SMS is not a "Second Factor". Please everyone stop putting this into products.

DyslexicAtheist 4y ago

Some of the comments here seem to argue that creating legislation that demands basic security baselines will not get the job done. In fact in a recent interview[1] Jen Easterly (head of CISA gov) fell into the same trap (assuming because she didn't want to upset tech company lobby groups) so her message was reduced to shouting into the void (asking vendors "please be-good"): > Addressing these issues requires a long-term approach and not simply a new set of regulations or industry standards. Easterly said it will require the leaders of technology companies to focus explicitly on building safer products, provide transparency into their development and manufacturing processes, and an understanding that the burden of safety should not fall solely (or even mainly) on customers. I'm right now struggling to get a bunch of US IoT companies to agree on a very basic set of security standards that would allow more interoperability. All we're asking are basic best practice to anyone working in security (e.g. ETSI 303 645). And the reason why I'm struggling is because in the EU these baselines are becoming the law as of 1st Aug. 2024 with the Radio Equipment Directive (RED). And in addition these same kind of guardrails will also become law with the Cybersec Resilience Act in 2025 expanded to the cloud and mobile apps. So this thing is coming and the US which has a lot better standards (thanks to NIST but lacks legalization due to power of lobby groups) looks like a total laggard here to a point where it becomes embarrassing. Nobody in their right minds would argue there are unreasonable provisions in these proposals for RED (or the CRA). Yet all the US based vendors who do not sell into EU markets shout "bloody murder". And it's hilarious how they're all grandstanding about "how dare the communist EU is telling business how to innovate". Legislation works. Begging vendors to come up with better controls by themselves will not. Anyone who has spent even a single day working in security in a company where security isn't part of their core value proposition (or isn't _the_ product) will know the only way to enforce even the most basic security and safety controls[2] is by legislation. You want a unified charging standard for EV? Make it the law! You want a single type of charger for all phones? Make it the law. You want your coding standards to meet guidelines for functional safety? Make them law. You want to eliminate OWASP Top-10 from production code? Make it the law. [1] https://duo.com/decipher/strong-security-has-to-be-a-standard-feature https://duo.com/decipher/strong-security-has-to-be-a-standar... [2] entirely related: The Humble History of the Crash Test Dummy https://www.motorbiscuit.com/the-humble-history-of-the-crash-test-dummy/ https://www.motorbiscuit.com/the-humble-history-of-the-crash...

coreyog 4y ago

I worked for TMobile for 4 days in 2021. I don't usually apply to big companies but money was tight because pandemic and I needed a job quick. I was assigned to work on the config server (think in-house developed consul or etcd) and it was awful. "If this specific config value is being set by Service A then what is actually written should be twice the given value, but if Service B is reading the value, return 1/3 of the value as an HTTP form body instead of JSON." By Thursday I got a call about a new position and I left so quick that the recruiters black listed me. TMobile getting hacked is a "when" not an "if"

tpmx 4y ago
> I don't usually apply to big companies but money was tight because pandemic and I needed a job quick. So T-Mobile offered you a "quick job" that immediately gave you access to their inner sanctum? These threads are a hoot.
roncesvalles 4y ago
>config server (think in-house developed consul or etcd) and it was awful. "If this specific config value is being set by Service A then what is actually written should be twice the given value, but if Service B is reading the value, return 1/3 of the value as an HTTP form body instead of JSON." People say dev salaries are way too high but this is basically what internal systems look like at all the places that refuse to pay fair market value.
latency-guy2 4y ago
> TMobile getting hacked is a "when" not an "if" I think something more accurate is > TMobile getting hacked is a 'how many times', not a when But adjust further... > All cell providers getting hacked is a 'how many times', not a 'which'
BeFlatXIII 4y ago
> By Thursday I got a call about a new position and I left so quick that the recruiters black listed me. That's one way to reduce headhunting spam.
- 4y ago

gz5 4y ago

No silver bullet but many of these types of attacks would be mitigated, or at least made much more expensive and difficult for the attackers, if we had wider adoption of Yubikey, Webauthn etc. type otp solutions which are more resistant to phishing, keyloggers etc. In practice, what are the barriers to adoption which folks are seeing, and what can we do about it?

PassageNick 4y ago
This is a great question. I think the biggest barrier to adoption is lack of end user demand for the service. That is followed by people not understanding/believing the incredible increase in user experience and security. It's almost like people think it is too good to be true.

aidenn0 4y ago

I'm on an MVNO that uses T-Mobile. I recently got 100s of "verify your number" sign-ups from over a dozen services. Could this have been part of an (attempted?) sim swapping attack?

burna_aws_acct 4y ago

One random factoid I notice is that AWS and Microsoft just announced launch of Open Gateway. Noticeably missing from that list of Telecom Providers is... T-Mobile. I'm sure it's mere coincidence, albeit a noticeable coincidence. " Initial carriers that have signed up to Open Gateway are América Móvil, AT&T, Axiata, Bharti Airtel, China Mobile, Deutsche Telekom, e& Group, KDDI, KT, Liberty Global, MTN, Orange, Singtel, Swisscom, STC, Telefónica, Telenor, Telstra, TIM, Verizon and Vodafone. " Link: https://techcrunch.com/2023/02/26/mobile-carriers-team-up-with-aws-microsoft-to-launch-open-gateway-a-set-of-twilio-like-apis-to-tap-network-services/ https://techcrunch.com/2023/02/26/mobile-carriers-team-up-wi...

mikece 4y ago

This is why I buy service from Mint mobile using a fake name, a burner email address, and a prepaid debit card purchased at Walmart. Go to town with that info, hackers!

SkyMarshal 4y ago
Is it easy to refill that prepaid debit card?

idiotsecant 4y ago

My approach to this is to use a google voice phone number where all SMS get sent to email. The voice account and the gmail account are the same google account which is secure by hardware 2FA yubikey login. I have a cell phone with an entirely different number that I use for non-2FA things so if it gets compromised i'm OK. I do access that email from that phone, so I suppose i'm a bit vulnerable to targeted phone theft, but SIM swapping shouldn't be a problem, I don't think? In the opinion of HN is this the most secure way to do it while still allowing me to use services that force SMS based 2FA (almost everything) ? Is there a better way?

throwayphilsphr 4y ago
This works pretty well until google decides to block your account randomly one day.
- idiotsecant 4y ago
  Is this something that happens sometimes? I guess I hadn't considered that very likely but maybe I should be more concerned.
- hot_gril 4y ago
  My Google Voice keeps randomly losing its phone number. I haven't bothered figuring out why, maybe inactivity, but it doesn't matter cause I've already crossed it off as something to rely on.

sourcecodeplz 4y ago

One solution is to keep two phone numbers. Your regular number that everyone knows and a second prepaid SIM that you use online only.

grammers 4y ago

Wow, if true, this sounds like really, really bad security protocols.

__MatrixMan__ 4y ago

Shame on T-Mobile. That said, perhaps everybody using SMS 2FA is equally culpable (e.g. most banks). Nobody who has worked at a mobile carrier would ever think that they're ready to be high-value targets. So it's puzzling that the banks are so eager to put them in that position.

ashwagary 4y ago
The order of shaming should be: 1. Businesses using insecure channels to do authentication and validation. 2. Mobile carriers
- __MatrixMan__ 4y ago
  Oh you're right, I had it backwards. Perhaps the carriers should be trying to PR-hack this into more people's minds. I'm imagining an authorized pen-tester program which lets authenticated users achieve an atomic sim-swap (i.e. the creds were intercepted but the swap-back occurred immediately after, so as not to deny additional service to the victim).

ed25519FUUU 4y ago

I believe this. I have a single credit card that I use only for our T-Mobile bill on autopay (the credit card offers insurance on my phones via this method). About 2 months ago I noticed $15 charges very cleverly disguised as Amazon prime. The only giveaway was that it said the number was entered manually. Everyone with T-Mobile autopay should check immediate for an Amazon prime charge that was manually entered.

deafpolygon 4y ago

Correction: Hackers breached T-Mobile more than 100 times in 2022

w_for_wumbo 4y ago

I see people jumping towards regulation, but that has the side-effect of making it even more difficult for there to be any competition against these monopolies. What we really need is legitimate competition, to enable consumers to vote with their wallet and move to a competitor that takes the security of their customer's private data seriously.

mike_d 4y ago
> making it even more difficult for there to be any competition against these monopolies If your snappy upstart cellular network can't afford to give out Yubikeys to employees, I don't want you interconnecting with the rest of the phone system.
- photon12 4y ago
  Also, startups have such an advantage now that there is an ecosystem of COTS and SaaS tooling that can help you do a complete integration strategy. It's arguable MFA regulations would advantage startups because they don't have to deal with the complexity of legacy network piecemeal integration. I planned and did the roll out of Yubikeys at the last place I worked, before there was a dollar in sales, and the lifecycle could be supported with 2 people (minutes at most out of each day for support) and an integration to our HR platform that automated procurement and mailing of keys.
munchler 4y ago
Ah, the libertarian dream. Unfortunately, utilities such as phone service are often close to natural monopolies, due to the infrastructure overhead.

hk1337 4y ago

This was at least couple of decades ago but I remember how they would send your password to your phone over SMS.

SkyMarshal 4y ago
Yup, just over one decade ago actually: https://plaintextoffenders.com/post/4567498592/t-mobilenet https://plaintextoffenders.com/post/4567498592/t-mobilenet And more recently in 2018: https://plaintextoffenders.com/post/174100751368/meint-mobileat-internet-and-telecommunications https://plaintextoffenders.com/post/174100751368/meint-mobil... A few more in the master list here: https://github.com/plaintextoffenders/plaintextoffenders/blob/master/offenders.csv https://github.com/plaintextoffenders/plaintextoffenders/blo...

gojomo 4y ago

Seems plausible. Suffered a SIM-hijack attack via T-Mobile a few years ago. Set a giant extra arbitrary password for account changes after that - but they essentially don't ask for it. Fairly regularly they show notices of breaches via email or when logging in. Don't use a mere mobile number for the backup access to anything inportant!

KerryJones 4y ago

Anyone who is privacy/security savvy, is there anything that can be done to protect my data as a T-Mobile user? I avoid 2FA SMS authentication wherever I can (use Authenticator for most things)

Aleksdev 4y ago

I believe it. I opened up at mobile account and I would get random advertisement text messages.

AceyMan 4y ago

Ironically, today I got a promotional SMS from Tmo offering — wait for it — checking & savings accounts from them. Uhhh ... hard pass.

GRACE44 4y ago

[dead]

GRACE44 4y ago

[dead]

6451937099 4y ago

[dead]

6451937099 4y ago

[dead]

deightonarnette 4y ago

[dead]