3 ms·

I thought T-Mobile significantly cracked down on SIM-swapping internally so this couldn't happen again? I know there's still no patch for human stupidity, but

I thought T-Mobile significantly cracked down on SIM-swapping internally so this couldn't happen again? I know there's still no patch for human stupidity, but I really am concerned that T-Mobile still apparently seems to be the carrier of choice for easy SIM-swap attacks.

cl3misch 3y ago
SIM swapping is one thing, but the actual service (X in this case) allowing access to the account via access to the phone number, even without SMS 2FA enabled, is the real problem.
- AbrahamParangi 3y ago
  Idk I mean there’s a real trade off to making the app more secure. The causes of insecurity are largely user behavior, and the insecure things are things users want to do for practical reasons. For example, I have a foolproof way of preventing sim swap attacks: require 256bits of entropy and never allow a password reset, like in crypto. Lose your password? Account is gone forever. This is more secure but less user friendly. Except for large accounts, I don’t know that anyone even particularly cares if their Twitter gets hacked. You could pretty easily make the argument that preventing sim swap attacks is an optimization for high profile users at the expense of everyone else.
jmuguy 3y ago
Tinfoil hat in me says that T-Mobile has a real bad problem with their internal tooling allowing low level employees access that facilitates these sort of attacks. They claim social engineering because that allows them to blame a specific employee being "tricked" rather than a more widespread issue. This type of stuff is why I canceled my account with them. It just keeps happening.
- kotaKat 3y ago
  > T-Mobile has a real bad problem with their internal tooling Oh, yes. 100%. I remember about 10 or so years ago about people selling guides on how to get access to WATSON (one of the dealer systems that let you provision accounts etc) by basically abusing a common username/password convention and making guesses based on the Store Lookup tool. IIRC it only let you set up new accounts (eg, take a stack of blank SIMs and just make infinite lines) but was still just an absolute WTF that it was... somehow a thing.
tyrfing 3y ago
A few years ago, my phone completely died. I walked into a store with it and my new phone, and got them to port the number to a new SIM without providing any information like the account PIN which I had set but didn't remember. It's good customer service, and even if they're supposed to check a bunch of info, that's still just a bit of social engineering to get around. The only solution is to not allow those lower level employees to do anything, which will cause complaints.
- delfinom 3y ago
  _Many_ complaints. People have to realize that people working in tech that can tolerate 2FA jumps are a small minority of people in the general population. Not to mention, the scenario of "person losing their 2fa device" will happen thousands of times more frequently across 300+ million people than the one person a month in a corporate environment.
techsupporter 3y ago
> I thought T-Mobile significantly cracked down on SIM-swapping internally They've cracked down so hard that the only way to do SIM swaps is to talk to a human who can be (and still routinely is) socially engineered. Self-service changes have been blocked for over a year "to enhance security".

cl3misch 3y ago

SIM swapping is one thing, but the actual service (X in this case) allowing access to the account via access to the phone number, even without SMS 2FA enabled, is the real problem.

AbrahamParangi 3y ago
Idk I mean there’s a real trade off to making the app more secure. The causes of insecurity are largely user behavior, and the insecure things are things users want to do for practical reasons. For example, I have a foolproof way of preventing sim swap attacks: require 256bits of entropy and never allow a password reset, like in crypto. Lose your password? Account is gone forever. This is more secure but less user friendly. Except for large accounts, I don’t know that anyone even particularly cares if their Twitter gets hacked. You could pretty easily make the argument that preventing sim swap attacks is an optimization for high profile users at the expense of everyone else.

jmuguy 3y ago

Tinfoil hat in me says that T-Mobile has a real bad problem with their internal tooling allowing low level employees access that facilitates these sort of attacks. They claim social engineering because that allows them to blame a specific employee being "tricked" rather than a more widespread issue. This type of stuff is why I canceled my account with them. It just keeps happening.

kotaKat 3y ago
> T-Mobile has a real bad problem with their internal tooling Oh, yes. 100%. I remember about 10 or so years ago about people selling guides on how to get access to WATSON (one of the dealer systems that let you provision accounts etc) by basically abusing a common username/password convention and making guesses based on the Store Lookup tool. IIRC it only let you set up new accounts (eg, take a stack of blank SIMs and just make infinite lines) but was still just an absolute WTF that it was... somehow a thing.

tyrfing 3y ago

A few years ago, my phone completely died. I walked into a store with it and my new phone, and got them to port the number to a new SIM without providing any information like the account PIN which I had set but didn't remember. It's good customer service, and even if they're supposed to check a bunch of info, that's still just a bit of social engineering to get around. The only solution is to not allow those lower level employees to do anything, which will cause complaints.

delfinom 3y ago
_Many_ complaints. People have to realize that people working in tech that can tolerate 2FA jumps are a small minority of people in the general population. Not to mention, the scenario of "person losing their 2fa device" will happen thousands of times more frequently across 300+ million people than the one person a month in a corporate environment.

techsupporter 3y ago

> I thought T-Mobile significantly cracked down on SIM-swapping internally They've cracked down so hard that the only way to do SIM swaps is to talk to a human who can be (and still routinely is) socially engineered. Self-service changes have been blocked for over a year "to enhance security".