3 ms·
This is an interesting development. We've always known that sim swap attacks weren't hard. But I've largely understood them to be not scalable. You can sim swa
by UncleMeat 4y ago
This is an interesting development.
We've always known that sim swap attacks weren't hard. But I've largely understood them to be not scalable. You can sim swap almost anybody by calling Verizon on the phone. But you needed to call them. This, in my mind, largely meant that the risk of sim swap for most people was pretty low - certainly far lower than the risk of phishing.
With this method, it scales. Pwn one person who has relevant system access and then you can sim swap as many people as you want. Now there really is a meaningful difference in security posture between sms and otp.
- vlovich123 4y agoHave you missed how much spam a regular phone was getting regularly? Doesn’t seem difficult to regather such an operation to do SIM swap attacks. With AI the mechanisms are even easier.
- UncleMeat 4y agoI have no idea what you are talking about here. SIM swap and spam texts/calls are entirely different issues.
- vlovich123 4y agoIf it's scalable to mass call a good chunk of the US population, I'm sure it's scalable to mass call providers to socially engineer a SIM swap.
- alex_sf 4y agoThat's.. not how social engineering works.
- UncleMeat 4y agoTo perform a SIM swap I need an employee at Verizon or whatever to take some steps on their computer (or have their computer infected with a RAT). To call 100,000 people on the phone I just need a computer that can make phone calls.