30 ms·
Vitalik Buterin reveals X account hack was caused by SIM-swap attack
- deleted 3y ago[deleted]
- kalleboo 3y agoDoesn't Xitter require you to have a paid account to use SMS authentication? So one way to secure your account is to refuse to pay for Blue.
- flotzam 3y ago"A phone number is sufficient to password reset a Twitter account even if not used as 2FA" This sucks because Twitter will sometimes force you to link a phone number to the account if it doesn't like your VPN or whatever
- ttyyzz 3y agoCool, a wild vector appeared.
- woadwarrior01 3y agoI just tried it on my now account. It asks for the account's username, phone number, email and then sends an email to the email address. Perhaps he didn't add an email address to his Twitter account?
- simiones 3y agoI also experimented a bit. I was able to reset my own password only with phone access when 2FA was not enabled: in the reset password flow, I started with my phone number, was then asked for my username and email, and then I was presented with an option to send the reset code either to my email or to my phone number. But, I then enabled 2FA (with an authentication app), and now when I try the flow again, I get to the screen for sending the reset code and I only have the email option left (but the screen still shows up as an extra step). So, it's possible that when you have 2FA enabled you can no longer do it. Or, it's possible I've triggered some internal rules by resetting my password twice in a short span of time (and enabling 2FA as well) and they've bumped me to some kind of "extra verification" flow that disabled phone-based password reset.
- thaumasiotes 3y ago> "A phone number is sufficient to password reset a Twitter account even if not used as 2FA" In other words, they don't have a 2FA system. They have a 1FA system, and the only factor is your phone number. This is a weird choice, since people are much more likely to know your phone number than they are to know your password.
- simiones 3y agoIf you have 2FA enabled, they can deny you access to your account, but they can't actually access it either (unless they also compromise your 2FA of course). That is, they can reset and change your password with only a phone number, but will still require a 2FA token to actually access the account.
- notyourwork 3y ago> Xitter This is now what they call themselves?
- macNchz 3y agoWhen I read that once they got into the account all the attacker did was post a link to a crypto giveaway scam, I briefly wondered why someone who managed to get into an account like this wouldn’t try to pivot it into something more sophisticated. Then in the next sentence we learn they made $700k off of the scam! I’ve seen these giveaway scams on hacked popular Twitter accounts for years, I’m surprised they’re still so effective. No need for an attacker to risk making $0 on a more involved attack when they can get easy cash like that, I guess.
- quickthrower2 3y agoThey were probably time limited. No long games. Smash and grab.
- frantathefranta 3y agoUsing the account of probably one of the few trustworthy people in crypto probably helps.
- baybal2 3y agoIronically, every SIM card is a cryptographic secure element, and it would've been ideal to do public key login. If you plug SIM card into desktop, you can actually do signing with it, and TLS authentication. I recall, only Nokia S60 series, and A200 had a SIM card API exposed to apps. Ios does not give you access to SIM, Android does only for system apps.
- londons_explore 3y agoGiving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.
- skdk 3y agoThe API could return different identifiers per app
- woadwarrior01 3y agoTwitter has had support for proper TOTP based 2FA ever since Jack Dorsey got SIM Swapped in 2019[1]. This was also the time when they added support for hardware tokens like Yubikeys. Of course, one needs to enable it. [1]: https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-dorsey-hack.html https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-...
- rgrmrts 3y agoJust having a phone number added to Twitter means your account is at risk of being taken over with a sim-swap. This was not 2FA related AFAICT. Twitter also requires you to add a phone number, even on old accounts you can get locked out unless you add one.
- sschueller 3y agoDoesn't Twitter force you to add a phone number now?
- lxgr 3y agoAs far as I remember they only use it for spam protection (i.e. the phone number serves as a moderate-level "proof of humanity"), but not for 2FA purposes (unless you pay for their premium service).
- throwaway290 3y agoYes and they plan to require ID verification next, losing privacy-conscious users is clearly not a big issue for Musk.
- yomlica8 3y ago[dead]
- ssl232 3y agoI've got an account from 2009 and have never had to enter my phone number (if I ever get asked, that'll be the time when I stop using it).
- deleted 3y ago[deleted]
- kotaKat 3y agoI thought T-Mobile significantly cracked down on SIM-swapping internally so this couldn't happen again? I know there's still no patch for human stupidity, but I really am concerned that T-Mobile still apparently seems to be the carrier of choice for easy SIM-swap attacks.
- cl3misch 3y agoSIM swapping is one thing, but the actual service (X in this case) allowing access to the account via access to the phone number, even without SMS 2FA enabled, is the real problem.
- AbrahamParangi 3y agoIdk I mean there’s a real trade off to making the app more secure. The causes of insecurity are largely user behavior, and the insecure things are things users want to do for practical reasons. For example, I have a foolproof way of preventing sim swap attacks: require 256bits of entropy and never allow a password reset, like in crypto. Lose your password? Account is gone forever. This is more secure but less user friendly. Except for large accounts, I don’t know that anyone even particularly cares if their Twitter gets hacked. You could pretty easily make the argument that preventing sim swap attacks is an optimization for high profile users at the expense of everyone else.
- jmuguy 3y agoTinfoil hat in me says that T-Mobile has a real bad problem with their internal tooling allowing low level employees access that facilitates these sort of attacks. They claim social engineering because that allows them to blame a specific employee being "tricked" rather than a more widespread issue. This type of stuff is why I canceled my account with them. It just keeps happening.
- kotaKat 3y ago> T-Mobile has a real bad problem with their internal tooling Oh, yes. 100%. I remember about 10 or so years ago about people selling guides on how to get access to WATSON (one of the dealer systems that let you provision accounts etc) by basically abusing a common username/password convention and making guesses based on the Store Lookup tool. IIRC it only let you set up new accounts (eg, take a stack of blank SIMs and just make infinite lines) but was still just an absolute WTF that it was... somehow a thing.
- 2devnull 3y agoI guess reputation can be valuable but I’d rather have my Twitter account compromised than my email or banking.
- quickthrower2 3y agoPhone numbers. 99% Almost like ID.
- sammy2255 3y agoIronically SMS 2fa is less safer than just using a password
- hospitalJail 3y agoI'm ready for this future. Heck, I don't even like that email can be used to recover basically every account. Someone gets your computer unlocked? They have access to email and everything.
- MichaelZuo 3y agoThat's what really bothers me, especially when very complex passwords are already enforced, it's like cargo cult security.
- achandlerwhite 3y agoI think the real issue is phone based account recovery rather than 2FA. It effectively turns 2FA into 1FA.
- mr_mitm 3y agoThat's not true. SMS 2FA may be the weakest form of 2FA, but it cannot be weaker than just using a password, because you always also need the password. As someone else pointed out, SMS based account recovery is the culprit.
- lxgr 3y agoGoing strictly by the definition that's correct, but if you take a look at the number of services that allow you to reset your password using only an SMS-OTP you'll quickly realize that reality doesn't live up to that ideal. I mean, at least SMS-OTPs are one-time use, i.e. they don't facilitate a compromise if done correctly, but the "done correctly" part here is once again very load-bearing.
- trompetenaccoun 3y agoHe did not use phone/SMS as his 2FA it seems, because he knew it's insecure, per his tweet. But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. There is nothing the user can do. Since these incompetent telecom employees get social engineered again and again, it's simply bad practice to have anything phone number related for security. Twitter and other companies need to change this, it's not safe.
- otterpro 3y agoI've been using Google Voice free phone number if I need to give out phone number for verification, and I hope it mitigates the possibility of SIM-swapping. Also I have another burner phone number using Hushed on my phone. Does anyone know if there's vulnerability using these burner numbers?
- lxgr 3y agoI'd say that depends entirely on the security of whatever "burner phone" (these are just a different marketing term for texting-capable VoIP- lines, right?) service you use. Depending on how careful they are about account login and recovery as well as port-out procedures, it can be much more or less secure than a "real" mobile line.
- dorfsmay 3y agoThis makes me feel really good that the Canada Revenue Agency and most banks in Canada use SMS for second factor auth!
- lxgr 3y agoThe EBA (the European banking regulator in charge of specifying the technical details of the PSD2 regulation, which covers secure cardholder authentication, among other things) also stated a while ago that only SMS-OTP is a "true" factor; Email-OTP isn't. Ironically, my email account is so much better protected than my mobile phone number. I'm trying very hard to believe that the SMS lobby (i.e. mobile phone operators, which earn multiple cents per inbound SMS in Europe, as well as our friendly SMS verification providers adding their markup on that) didn't exert some pressure on the regulators here...
- FabHK 3y agoInsofar as one of the factors should be something the user knows, and one factor something the user has, that makes perfect sense. You know your password (or the master password to your password manager), and you have your phone with the SIM card. With email (or Authy), the second factor is also something you know, thus it's not 2F anymore. Note that NIST also recommends against email as a factor in 2FA (A-B11 here: https://pages.nist.gov/800-63-FAQ/ https://pages.nist.gov/800-63-FAQ/ ), and says that SMS OTP must be directed to a phone, not an IP address (such as with VoIP, see A-B01 in the same document). "Methods that do not prove possession of a specific device, such as voice-over-IP (VOIP) or email, SHALL NOT be used for out-of-band authentication." (5.1.3.1 of NIST SP 800-63B)
- aftbit 3y agoWhat do you mean? I "have" access to my SMSes via my phone, and I "have" access to my email or my Authy also via my phone. If you get my phone, you can: 1. start password reset via email 2. confirm via SMS 2FA So that makes this into 1FA not 2FA. At least for TOTP secrets, I can store them securely, and attackers cannot convince a human support agent somewhere to hand them over. If you want true 2FA, you need something like WebAuthn with hardware tokens where the private key is on the token, but then you need a recovery process, and that takes you right back to the lowest common denominator of SMS verification.
- mihaic 3y agoHow exactly does a scam like this work? Access to someone's Twitter account only means that you can just post a link. People seem to have connected their wallet, but they still would need to sign a transaction after that. Did the users just auto-pilot click yes? Tangential, I can't believe the name X is actually being used by journalists, it's even worse that I expected from a sentence readability standpoint.
- jeroenhd 3y ago𝕏 is just a front for a phishing scam in these cases. No money or cryptocurrency is transfered directly. Scammers get access to a popular account with many followers, and tweet something like this: https://static.news.bitcoin.com/wp-content/uploads/2023/09/vitalik-tweet.jpg https://static.news.bitcoin.com/wp-content/uploads/2023/09/v... You don't need to get everyone in the cryptocurrency space to believe you, just a few people transferring funds from their wallet will make you rich.
- umeshunni 3y agoLooking at that tweet, I can't tell if it's a scam or just your regular cryptard NFT pump post.
- jeroenhd 3y agoI think that's why it's such an effective scam, these types of posts are everywhere around cryptocurrency fanbases, but this time it came from a reputable person within the community.
- mihaic 3y agoAnd the "this is free for 24h" is just a red herring, to make it legitimate for people to speculate? Still crazy that such a semi-anonymous scam got 700k, sounds like there's still a lot of money in crypto ready to gamble.
- jeroenhd 3y ago
- lxgr 3y agoEvery time I hear about yet another SIM swapping attack, I feel confirmed in my decision to use Google Voice for SMS-2FA as much as possible (only for services that don't support an actually secure method, of course). Except for one certain bank that won't even accept my "real [cell] phone number" for identity verification purposes, because "it's not verifiable" (probably because it's not with the big three cell providers). The state of "two-factor authentication" (a.k.a. something you're phished for and something you're social-engineered out of) and "identity verification" (a.k.a. "have a $80/month phone plan with these three companies or get lost”) in this country makes me really sad.
- slashdev 3y agoI try to avoid giving my cell number, precisely because it’s not secure, but also because it changes or I travel, and then I’m locked out of my own account.
- lxgr 3y agoIt's not a real vacation if you don't get locked out of at least one bank account or credit card for the crime of accessing your balance from a foreign IP, with no way to recover :)
- Scoundreller 3y agoWorks great for my buy-and-hold portfolio.
- lxgr 3y agoSame, but it works decidedly less than great for buying train or flight tickets while already abroad and on a travel SIM.
- Melting_Harps 3y ago> It's not a real vacation if you don't get locked out of at least one bank account or credit card for the crime of accessing your balance from a foreign IP, with no way to recover :) Laughs in Bitcoin Also, Charles Schwab Investment checking account for the uninitiated saves me from this issue; NFC enabled now ensures my card will never get eaten in a random ATM now.
- b0sk 3y agoTrust us with all your money!!!
- DerekBickerton 3y ago> Tim Beiko strongly recommended removing phone numbers from X I haven't checked, but it is possible to unlink a phone number from X? I always thought it was some anti-spam measure to have a number tied to an account.
- ajonit 3y agoTelecos are still careless inspite of the widespread nature of this attack. What can be the solution for a SIM swap? Fingerprint (or iris scan) plus email OTP mandatory to get a SIM replaced?
- cypherpunks01 3y agoDoes anyone here use Efani? They are a security-focused provider, and the only one that claims to have had zero SIM-swap attacks successfully executed against them. They are an MVNO.
- ahaseeb 3y agoEfani CEO here. There are 100s of reviews online. Yes we've been able to defend against 100% of the SIM Swap attacks so far
- xyst 3y agoI’m curious about the conversation that happened between the attackers/scammers and T-Mobile. Was it just a single call to social engineer support? Or did they call multiple times until they found an agent susceptible to their deception? Personally, have gotten rid of using SMS as a 2FA method for most services. However my most critical services (banking) still use SMS as the only option.
- tamimio 3y agoI probably said it 100 of times, any thing relies on GSM protocol for authentication is not secure, the protocol is fundamentally broken from security perspective, but it’s still there because someone wants to keep these phone numbers as the weakest possible way to link your real identity with the digital ones.
- michael_j_x 3y agoI don't understand this sim-swapping concept. Where I am from (EU country), if you need to get a new sim for your number, you have to physically go to your service provider's stores with an official proof of identity (passport or identity card) and do the change. Upon changing, your previous sim immediately loses service
- callalex 3y agoUnited States services are fundamentally broken in this way because there is literally no unified identification system for the United States. There are identity systems for most US states, but there are 50 of those and the requirements and features vary widely which makes it a nightmare to build on top of them.
- theragra 3y agoIn some more corrupt countries in EU, clerks can be bribed, unfortunately
- bettyfrank470 3y ago[dead]
- grahammaxine 3y ago[flagged]
- redhackar8920 3y ago[dead]