4 ms·
> Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobi
by outworlder 4y ago
> Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobile user’s text messages and phone calls to another device.
If they are doing all this through phishing and aren't being as successful with other networks there's some serious issue that's being overlooked. It's unclear from the article if this is due to training, lax security on internal tools, lack of two factor (as claimed in the article) or something else (even insiders).
That's too bad, I've been on T-Mobile for years. Whenever I can I'll use yubikeys or OTP. But there's still a large number of sites and services that rely on SMS.
- wnevets 4y ago> But there's still a large number of sites and services that rely on SMS. I avoid using my actual phone number whenever possible and use a Google Voice number. Hacking Google Voice would require hacking my actual Google account instead of just tricking someone at the phone company.
- nordsieck 4y ago> I avoid using my actual phone number whenever possible and use a Google Voice number. I do too. Sadly there are a number of sites/orgs that require you to use a mobile number. I don't really understand why.
- computing 4y agowhy do you think that? Presumably Google Voice uses a phone company downstream, which means if that company is hacked they can reassign your number to someone else and thus you have the classic SIM jacking attack.
- wnevets 4y agoWhich phone company does the hacker call to trick into believing they are Google?
- computing 4y agothey pay-off / trick a T-Mobile employee into re-assigning your Google Voice number to them. It's happened before with Google Fi, but I haven't seen any public information about this happening with Google Voice (yet)
- wnevets 4y ago> they pay-off / trick a T-Mobile employee into re-assigning your Google Voice number to them. Are you saying the Google Voice phone number lock is useless and that any carrier can just steal Google Voice numbers regardless of the lock status?
- computing 4y agohere is a link to a report of that happening to a Google Fi customer: https://old.reddit.com/r/GoogleFi/comments/10pjtie/google_fi_data_breach/j6kysv8/ https://old.reddit.com/r/GoogleFi/comments/10pjtie/google_fi... I don't work at Google and don't know if this is possible with Google Voice. However, Google Fi is their paid service, so I would assume that's the one they'd want to protect the most.
- wnevets 4y agoGoogle Fi has actual SIM cards and behaves like a regular carrier, Voice does not. There arent any SIM cards to be hijacked with Voice because it don't provide cell service.
- Loughla 4y agoBingo. Personal phone number for only friends and family. Google voice number from a nearby area code for literally everything else. It's a little more secure than my carrier. And as an added bonus, I can automatically send all incoming google voice calls to voicemail and not have to worry about missing a family emergency. If I get a phone call on my actual cell number, it's almost guaranteed to be someone I know closely.
- abawany 4y agoSame here, but note that a lot of banks have now started to look at the underlying carrier and often deny the use 'voip-like' services such as GV.
- raisedbyninjas 4y ago>If they are doing all this through phishing and aren't being as successful with other networks there's some serious issue that's being overlooked. A few years ago I had to regain control of an account that I had lost the credentials for. No problem, Tmo support just needed me to provide one of the last 5 phone numbers dialed. So yes, there are some serious issues overlooked.