9 ms·
I was a victim of this last October and November on a T-Mobile number. This is what occurred: - My Gmail account was compromised - My Amazon account was compr
by ctvo 4y ago
I was a victim of this last October and November on a T-Mobile number. This is what occurred:
- My Gmail account was compromised
- My Amazon account was compromised
In Gmail, they added a filter to hide any shipping or customer service messages from Amazon.
In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order.
Both passwords to both accounts were kept the same.
After I caught on to the above once I received my credit card statement, in November:
- They attempted to purchase something with my credit card. Security mechanisms triggered, and a verification code was sent to my phone at 4am in the morning. They successfully validated and placed the order. My credit card company assures me they input the right verification code.
- They applied for an Amazon credit card using my identity. It was auto approved, and they used the credit card to purchase ~5k worth of items.
I moved everything off of that T-Mobile number, and switched over to GoogleFi (only to learn GoogleFi uses T-Mobile also... still better than T-Mobile directly I'm hoping).
Edit:
I also wiped my phone, eventually thought that wasn't far enough, and switched to a new device entirely. I'm still unsure how the above occurred, because some of it feels beyond the scope of a SIM-swap.
- bitcoinmoney 4y agoThis is why you don’t use sms as 2FA. And use iOS. We’re you using android?
- seanw444 4y agoOr GrapheneOS. Or just stop visiting sketchy sites and running sketchy applications. That will eliminate 98% of your problems.
- dvngnt_ 4y agoI use Google voice for everything... except my bank because they said using T-Mobile is so much more safer than Google so I had to switch back
- throwaway2203 4y agoI used to as well, but lots of places have stopped accepting VoIP numbers now. A bunch of them actually just silently fail to send messages, so you can be clicking SMS password reset and get nothing in your texts.
- mikece 4y agoThe prohibition against using a VoIP number for banking purposes is stupid. They already have the full battery of KYC info on me: if I want to use a VoIP number for 2FA (because they are so behind the times they don't support FIDO or even TOTP) then unless law says they cannot they need to allow it. And while on the topic of banks, most will suspend access to your online portal if you log in with a VPN. Give me a bank that allows VoIP phone numbers, VPN access, and TOTP and/or FIDO support for 2FA and I'll ditch Schwab right now.
- atkailash 4y agoI have Ally and Chime and I’m extremely disappointed neither accepts a Yubikey or something. Older banks like Schwab or US Bank I could see being behind the times, but I’d expect fintech or something more modern to be more sensible.
- 6ak74rfy 4y agoBoth Fidelity and Schwab allow non-SMS 2FA. They both use Symantec VIP but it’s fairly easy (for developers at least) to export those tokens and import them into something like Authy, Google Authenticator etc. https://ketanvijayvargiya.com/257-symantec-vip-authy/ https://ketanvijayvargiya.com/257-symantec-vip-authy/
- livueta 4y agoDo you happen to know if they allow you to also totally disable SMS 2FA? I know that Vanguard, for instance, supports non-SMS 2FA but doesn't let you disable SMS as a fallback (and I'd rather not just totally remove all phone numbers, but maybe I have to...).
- stef25 4y agoNo 2FA on your GMail? Any idea how G and A were compromised, password reuse?
- Alex3917 4y agoProbably SMS as a 2FA option on Gmail, which is the real problem. Once you add your Yubikey and set up TOTP as a backup, you need to go back and delete SMS as a 2FA option. Had gmail been configured correctly, the SIM swap would have far less serious.
- newsclues 4y agoSMS 2FA is a security risk! I used to work tech support for cell phone providers, and while we were trained about fraud, the nature of the industry low wages, high turnover, makes this a security flaw that financial institutions should not risk.
- neaumusic 4y agoHow is SMS a security risk? As far as I know, SMS is closely tied to a person's identity, especially 'know your customer' regulations. I'm curious how it's a security risk; as far as I know they have to be unique, which is good
- crazygringo 4y agoSimjacking. https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
- TeMPOraL 4y agoWait. Isn't it painfully obvious when you've been simjacked? If your phone suddenly loses signal and refuses to register with the network, you know something is up. You may think it was a malfunction of your phone or your network, but it's pretty much a definition of a modern-day "drop everything you're doing and deal with it" emergency. You can't not be aware of it, or be unsure if it happened to you.
- samstave 4y ago[flagged]
- ctvo 4y ago> BTW - give me some of that big-swinging-credit-balls you seem to gotts... 15 * 500 = 7,500 USD. Having a steady job should put that within reach.
- samstave 4y ago[flagged]
- mega_dingus 4y agoPutting the "15" in italics isn't doing yourself any favors when asking aita
- jdminhbg 4y agoHe noticed the first time he got a bill at the end of the month, it doesn't seem that difficult to understand.
- ctvo 4y ago> Why is that controversial? I don't know if it's controversial, but I think for most people, keeping up with your current card statement isn't something you do daily. Sometimes companies have a way to notify you of new charges immediately, sometimes not. Being surprised at the end of the month is more common than you'd think.
- HPsquared 4y agoI for one don't really look at any banking stuff these days. I just live well within my means. If you have a generally healthy financial situation there is no need to constantly check.
- jjeaff 4y agoHow would you know unless you check your credit card statement every day?
- jfernandez 4y agoScary, this just convinced me to turn off text-based 2FA and only have Google Auth App (+ backup keys). Thank you.
- lock-the-spock 4y agoAnother different failure point. I once broke my android phone and bought and set up a new one - only to find I can no longer access my Gmail account that I used before with my Google authenticator, so I am locked out forever from that account. I had a backup but was not able to find it. Despite knowing hundreds of contact emails (all backed up in thunderbird), account history, password history, etc - for years I have not been able to get back in.
- doodlesdev 4y ago> I had a backup but was not able to find it. So you didn't have one lol. I understand that's an extremely frustrating situation though. Part of making backups is testing them once in a while (at least making sure they exist). Something else you could've done previously was to use Authy or Aegis which helps you backup the seeds themselves encrypted under a passphrase so you can recover the accounts even if you lose everything else. Although of course, all of this depends on your threat model, if you don't care about SIM swaps or if losing the account is still much more worrying then I guess it's just a unnecessary hassle/risk.
- projektfu 4y agoWith Authy I can enter a backup password and download everything to a new phone. I suppose that's a different failure point but still possibly worth the trade-off? Yubikey is the next level up.
- burna_aws_acct 4y agoInteresting... I had something similar happen to me, with minimal outward, acute damage (e.g., running up bills on random credit cards). It is reasonable to assume my entire identity is compromised. Sorry this happened. How do you know T-Mobile was the entry point, and not say, Google (e.g., Google Chrome, Google Ads)? What type of phone did you have (e.g., Android or iPhone)? What is your browser and Search Engine on your smartphone? Thanks!
- ctvo 4y agoI assumed it was T-Mobile after I wiped the phone and had the follow-up incident where a verification code via SMS was successfully verified. I used an iPhone, Safari mobile, Google search engine.
- burna_aws_acct 4y agoSMS in unencrypted, and Google SE has been compromised for much if not all of 2022. From what I can tell the issue persists. I officially reported it in December, and again in January, and again in February. Pretty wild, TBH. Think about the number of services that have Google SE and Ads integration. Makes me nauseous. Did you happen to report to Apple and Google (for documentation)?
- ipython 4y agoIn what way is the google search engine compromised?
- burna_aws_acct 4y agoWays which I shared with Google, because it's a very serious privacy and security vulnerability. We need more robust security integration to catch things before they are pushed to results. I understand latency will increase, and some ads revenue will decrease. But like, isn't it also cool to have a customer base that is better protected against egregious attacks, attacks that could be prevented? IMO, yes. It's called "stewardship."
- koolba 4y agoThey were able to reset your Google password using only the simjacked phone? Or was the password the same as the T-mobile one as well? It’s hardly a second factor if it can be used to entirely replace the primary one.
- delfinom 4y agoGoogle still allows you to setup recovery phone numbers unforunately. https://support.google.com/accounts/answer/183723?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/accounts/answer/183723?hl=en&co=G... I think years ago I found my number there with no-recollection of every agreeing to it and quickly yeeted it. (You can remove the number but keep recovery email)
- gleenn 4y agoIt's subtle with the UI but you can choose not to allow SMS by removing your phone number from Google after setting up alternative 2FA. If they don't have a number they can't sim-jack
- mike_d 4y agoThis is one of the most important pieces of security advice that is often overlooked: remove your phone number from EVERYTHING. You can also enable Advanced Protection[1] for your Google account, but other repeat offenders like Github will continue to allow SMS fallback to bypass 2FA if you have a phone number listed anywhere. 1. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
- lima 4y agoBig benefit of Advanced Protection: you can go tell less technical users to set it up and it will enforce all these best practices (no SMS, two keys, no giving random apps access to GMail...).
- ravenstine 4y ago> In Gmail, they added a filter to hide any shipping or customer service messages from Amazon. I gotta admit, that's pretty clever. Crude, but effective.
- themitigating 4y agoI was about to comment the same thing. It's very simple but I don't think I would have thought of it
- bombcar 4y agoIt's quite common, in fact my "go-to" hacked account rule in Office 365 is "alert me, system admin, anytime anyone creates an outlook/exchange rule". Our group is small enough that I get very few alerts at all, and I've caught two compromises that way.
- shmoogy 4y agoThanks for the tip that's a pretty good one I wouldn't have thought of
- andrecarini 4y agoDo you know if those alerts can also be set up on Google Admin?
- Aeolun 4y agoTo be honest, there is already zero way to distinguish between shipping and customer service messages from Amazon. If you order any appreciable amount of items you would have no idea they sent you any message. Of course I only found this out after being burned by it. Turns out they’d sent me a message telling me the item I returned was not in the same condition it was sent in (it was), but the message was utterly lost in the flood of ‘order received/sent/delivered’ mails they send (with the same subject).
- 0cVlTeIATBs 4y agoAnother common technique is a filter to forward all mail. Hard to notice. I ought to go check right now...
- deleted 4y ago[deleted]
- mrb 4y agoAs an InfoSec professional, what you describe sounds more like a device-level compromise of your iphone, perhaps through a malicious app, or link you clicked. What your experienced can't be done with just a sim swap attack, as you would have lost access to your phone number. And it can't be done with the described T-Mobile hack, as it would have given the hackers silent access to your texts, so they could have reset your Gmail password, but then you would have noticed a password change (and you claim it didn't change.)
- welder 4y agoThat assumes their password wasn't already compromised. If they re-used their Gmail password somewhere else, the attacker could have already had their Gmail password and only needed the SIM-swap to verify the login.
- px43 4y agoRead up on credential stuffing, this is increasingly common. With all the recent breaches, there are groups that use old passwords to quickly identify MFA locked accounts behind re-used passwords. These lists are then sold to people who will, one at a time, pay about 10k for a SIM swap on individually targeted users. There are lists floating around with 10s of thousands, or hundreds of thousands of users with known passwords in Google, Amazon, Paypal, Coinbase, etc. Episode 112 of Darknet Diaries (March last year) has a really good breakdown of these markets: https://darknetdiaries.com/episode/112/ https://darknetdiaries.com/episode/112/
- ghostpepper 4y agoThe parent comment has a point though - after SIM swap attack, all SMS messages would stop arriving at the victim device - unless the attackers swap it back again after every 2FA code. If they had access to a dashboard at t-mobile this might be possible but it sounds like a lot of effort to steal a few thousand dollars.
- mrb 4y agoThe victim (ctvo) claims in another comment down the thread that he had a unique Gmail password not re-used on any other service. So I wrote my comment assuming this is true. But, indeed, if his Gmail password was weak and guessable, then the T-Mobile hack would have allowed the hackers to validate MFA and log in.
- kkielhofner 4y agoThere must be something especially lucrative about GoPros as stolen devices. I’ve heard multiple independent stories from a few friends in Law Enforcement about cases involving trafficking of large quantities of stolen GoPros (obtained via methods not unlike what happened to you). Interesting you mention NYC - at least one of these cases involved a very high volume fencing syndicate operating as a legitimate storefront in NYC - with merchandise fraudulently obtained from Amazon[0]. A friend of mine worked this case. Small, fairly high value, high demand, and no remote shutdown/disable/reporting - somewhat of a perfect storm I suppose. [0] - https://www.cnbc.com/amp/2018/06/07/how-the-finans-stole-1-point-2-million-in-consumer-electronics-from-amazon.html https://www.cnbc.com/amp/2018/06/07/how-the-finans-stole-1-p...
- at-fates-hands 4y agoIf you go on ebay, you can find tons of shady gopro listings. They'll have all the original packaging and put it up as a "pre-owned" unit, but then you open the listing and they have 20 of them for sale. We also had a local hotel/waterpark that was running a burglary/fencing operation in the mid aughts. The room cleaners would look for gopros, iphones and other electronics. If they found anything, they'd take it and hand it over to the two managers, who then fenced it out to local guys who'd either pawn them or sell it on Craigslist and they'd split the money. Customers routinely complained to the managers who were the fences so they'd tell the customer they'd fill out a complaint form and send in a police report to the local PD. Obviously, that never happened. This went on for about two years until people on social media and review sites like Yelp started discovering what was happening was not an accident. They finally busted the ring and within a few weeks, the waterpark and hotel were shut down for various other repeated OSHA and other infractions that went unfixed. The local paper reported even though they busted the ring, the money and the goods were long gone, leaving the victims with little recourse.
- Cthulhu_ 4y agoIt sounds like an example where review sites help warn others where management and the local police do nothing. If you're the victim of a crime, you should do the police report yourself - also for things like insurance claims.
- hello_io 4y agoGooglefi just uses their towers, your telecom data isn’t communicated with T-Mobile just the data of whatever you’re using (calls Netflix browsing porn)
- abawany 4y agoRecently Googlefi also reported that as a result of a likely T-Mobile related breach, they also lost data including sim numbers: https://www.reddit.com/r/GoogleFi/comments/10pjtie/google_fi_data_breach/ https://www.reddit.com/r/GoogleFi/comments/10pjtie/google_fi... .
- xyst 4y agoI no longer have SMS enabled as a MFA for this exact reason on services. Only physical or digital authenticator where necessary.
- zippergz 4y agoSomething doesn't add up here because last I checked Amazon made you put the credit card number in again if you want to ship to a new address. Just breaking in to your amazon account wouldn't be sufficient to ship stuff to random addresses using your credit card.
- lavezzi 4y ago> Something doesn't add up here because last I checked Amazon made you put the credit card number in again if you want to ship to a new address. Not always.
- dncornholio 4y agoSo if you didn't have a credit card, nothing would have happened? Why do people still use credit cards if they are so fucking leaky and easy to exploit?