5 ms·
As an InfoSec professional, what you describe sounds more like a device-level compromise of your iphone, perhaps through a malicious app, or link you clicked.
by mrb 4y ago
As an InfoSec professional, what you describe sounds more like a device-level compromise of your iphone, perhaps through a malicious app, or link you clicked.
What your experienced can't be done with just a sim swap attack, as you would have lost access to your phone number. And it can't be done with the described T-Mobile hack, as it would have given the hackers silent access to your texts, so they could have reset your Gmail password, but then you would have noticed a password change (and you claim it didn't change.)
- welder 4y agoThat assumes their password wasn't already compromised. If they re-used their Gmail password somewhere else, the attacker could have already had their Gmail password and only needed the SIM-swap to verify the login.
- px43 4y agoRead up on credential stuffing, this is increasingly common. With all the recent breaches, there are groups that use old passwords to quickly identify MFA locked accounts behind re-used passwords. These lists are then sold to people who will, one at a time, pay about 10k for a SIM swap on individually targeted users. There are lists floating around with 10s of thousands, or hundreds of thousands of users with known passwords in Google, Amazon, Paypal, Coinbase, etc. Episode 112 of Darknet Diaries (March last year) has a really good breakdown of these markets: https://darknetdiaries.com/episode/112/ https://darknetdiaries.com/episode/112/
- ghostpepper 4y agoThe parent comment has a point though - after SIM swap attack, all SMS messages would stop arriving at the victim device - unless the attackers swap it back again after every 2FA code. If they had access to a dashboard at t-mobile this might be possible but it sounds like a lot of effort to steal a few thousand dollars.
- mrb 4y agoThe victim (ctvo) claims in another comment down the thread that he had a unique Gmail password not re-used on any other service. So I wrote my comment assuming this is true. But, indeed, if his Gmail password was weak and guessable, then the T-Mobile hack would have allowed the hackers to validate MFA and log in.
- KyeRussell 4y agoHonestly I’m a bit concerned an infosec professional has reached for “iOS device compromise” over a…more common and lower-effort explanation.
- zamnos 4y agoIf you believe Apple's marketing that iPhones are unhackable, I have a bridge to sell you.
- wil421 4y agoWhy would someone burn a device level exploit for $5k when you could sell the exploit for 10x or even 100x more? Sounds like an easy way to burn your exploit after using it a few times to get electronics off Amazon.
- mrb 4y agoWhat makes you think this was used for only $5k? In these cases, hackers usually target many victims, not just one.
- conjuredbytes 4y agoNo need to be aggro about it. No one’s suggesting iPhones are unhackable, just that realistically utilizing an iOS or Android exploit like that is a bit much for something simple like credit card fraud. Those exploits are valuable.
- pohl 4y agoWould you cite the marketing to which you referred? I’ve never seen it.
- mrb 4y agoThe victim (ctvo) claims in another comment down the thread that he had a unique Gmail password not re-used on any other service. I commented assuming this premise is true.
- loa_in_ 4y ago