7 ms·
Former telecom manager admits to doing SIM swaps for $1k
- sydbarrett74 3y ago[flagged]
- reaperman 3y agoAdvocating extrajudicial violence isn't appropriate on HN.
- ValtteriL 3y agoYou spend fortune on security but there's a guy working at a telco who will sell your head $1k a pop to anyone.
- babyshake 3y agoWith opsec and infosec, you are only as strong as the weakest link.
- skellera 3y agoWhy aren’t they naming the “telecommunications store”? Does knowing the employee did it make the company liable for damages?
- cowsandmilk 3y agoThe court documents don’t name the store, so the reporters may not know the store. The company may have turned in the employee with the understanding they would just be “Company 1” in all court documents.
- the-chitmonger 3y agoMan... on top of the obvious moral issue with enabling this hack, I'm astounded that someone would do this for $1k per person. Putting my freedom on the line would be so much more expensive than that. On a more technical note, is there any safeguard against SIM swaps? Something like a fingerprint scan that's tied to your SIM. I'm not familiar with phone hardware at all but I'd love to hear if someone's working on this type of thing
- salawat 3y agoSo you want to give your biometric info to a telecom? Are you nuts? We already have enough problems getting people to understand "IP's/SIM's/MAC's identify devices, not users". We don't need to make shit worse.
- the-chitmonger 3y agoI'm not saying it's ideal, it was just an example of something that I thought could address the issue. I agree that we should limit PII being given to companies, but I'm conflicted on how the average Joe can maintain some semblance of security as hackers get better at finding holes. If the software can identify you based on something that only you have, then that's a tall barrier to cross for hackers that also doesn't require a steep learning curve for most. Just to reiterate, I am personally a fan of maintaining anonymity, particularly online. I'm just concerned that our increasingly aging population won't be able to keep up with security best practices and we may need some braindead solutions to keep them safe.
- toast0 3y agoThe telco is in charge of what SIM is mapped to a given number. There's not anything technical the customer can do there; access control is up to the telco. The telco also needs a process to reclaim the number when you stop paying for it. Often SIM swaps are done via porting the number to a different telco, and telcos are compelled to do ports in many jurisdictions. If you're really worried about it, I guess you could look into what it takes to get a number block assigned to you as a competitive telco. That would likely be hard to get transfered out from under you, but the effort may not be worth it. Also, if the price to get a sim swap is $1k (plus a % of ill gotten gains!), that's high enough to keep out untargetted attacks, IMHO, which isn't a terrible place to be.
- pyuser583 3y agoThis is why we have DNS {shudder in disgust}.
- the-chitmonger 3y ago
- zafka 3y agoThis is a timely post. I was going to do an "ask HN" on the best way to prevent a sim swap. I had heard about locking the SIM but then I heard this does not give much protection. What are your thought on best protection methods??
- the-chitmonger 3y agoJust asked the same question, haha - it looks like some carriers allow you to lock your SIM from being ported to another number until you authorize it (either in person or through your accounts online). That being said, I guess if someone working at, say, Verizon was handling your switch, they might be able to switch it to a bad actor's phone before switching it to your legitimate one? Not entirely sure though -would love to hear a more informed answer.
- edent 3y agoI've worked for two UK telcos. There is no technical measure which you can apply. Locking your SIM prevents someone from physically stealing the card and putting it in a different device - unless they know the PIN which protects it. But that isn't the attack here. The phone number does not belong to you - the network operator defines which SIM it points to. So a suitably authorised person at the telco can point the number to a new SIM card. That's helpful if you've lost your SIM but bad if an attacker wants to divert your number. The best thing you can do is set a strong password on the account you have with the operator. You can also try ringing them and pretending to be you - see if they'll initiate a swap without proper authentication. If they do - move your number to a more reputable provider. But there's nothing you as an individual can do to prevent a corrupt employee making the change without authorisation.
- the-chitmonger 3y agoI never thought about pentesting my service providers - sounds fun and useful! I'll try this the next time I have a moment.
- mindslight 3y agoThe best way to prevent a SIM swap is to not let your phone number be used as a trusted piece of authentication. Sure, what this guy did was criminal. But not nearly as criminal as it should be for companies to unilaterally force customers into using snake oil authentication methods, just so they can check some new compliance boxes and pretend to be adding security.
- ssklash 3y agoThis is a good example of why SMS 2-factor is far less secure than TOTP or other methods. You do what everyone tells you, add 2-factor to your account, and then some rando at the local T-Mobile store enables SIM swapping for peanuts, and your whole digital life goes up in smoke.
- baerrie 3y agoIf you have access to someone’s email account can’t you dl the totp authenticator and bypass this? Effectively that makes email the authenticator which isn’t better than a phone number and device
- kevincox 3y agoWhat do you mean by "dl the totp authenticator"? But the answer is no. Without the TOTP secret no one else can generate valid codes. If you sync your secrets to some cloud service then yes, you are trusting that cloud service. And if you let your TOTP cloud service reset your account with an email then it probably isn't the most secure option. But the important thing here is that the user is in control. They can memorize their secret if they want to an no one can take it from them. Or they can publish it online if they don't like security. With SMS 2FA you need to trust your telecom provider, I very much don't.
- baerrie 3y agoI meant “download the totp generator”. Correct me if I’m wrong but the totp generator has to linked with some account, the security of which is not managed by you, and is just as vulnerable as that account
- peeters 3y agoTOTP is a completely offline protocol. Basically you scan a QR code which is a signing key that is saved to your phone. Then all your phone needs is an accurate time source, and periodically signs the current time with that key to produce a 6-digit code. As such, no, it's not associated with anything from the source account. It is not challenge/response, and you can scan the QR code with 10 different phones and they will all produce the same codes at the same time.
- catlikesshrimp 3y agoAnd this is where paranoids have the upper hand. Have a secondary secret phone number from another carrier exclusively for sms confirmations, using a dumb phone, which must be turned off when not expecting an automated code. Preferably a prepaid sim bought anonymously. Extra points if bought in another country and has coverage in your area.
- Johnny555 3y agoDoes that help against an attacker determined enough to hack you that he'll pay $1000 for a SIM swap? Surely he has channels to figure out your "secret" phone number since you registered it with the service he's trying to hack into.
- catlikesshrimp 3y agoIt is more difficult to sim swap a foreign number from another company. Not impossible, of course. There is also that some services don't accept foreign numbers for authentication. Nor virtual phone numbers. But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier.
- Johnny555 3y agoBut it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier. Is that really an additional layer of protection, or the same layer, slightly obscured? But probably not obscured from the attacker that managed to get your password and just needs the SMS verification code to get into your account.
- bonton89 3y agoYou can probably figure out most people's default phone number by googling their name and going to one of those crappy white pages sites. Then try to login/do a password reset to their services and compare the masked phone number to the ones on the site. No advanced hacking or special channels required. The trouble with compartmentalizing with a separate phone is that the company with your money probably also sold your secret phone number (that they only required for security) so it will probably also show up on that whitepages site.
- neilv 3y ago> while he was a manager for a telecom firm. [...] abused his managerial position and highly privileged account at a mobile telecommunications store Does not naming the company suggest that it's not considered liable? > indicate five victims Over what time period? Did the company detect and halt this quickly, and was conscientious about referring it to law enforcement? I'm willing to agree a store/carrier/brand should be given a pass in a particular instance, but the bar for protecting against SIM-swapping has to be pretty high, considering what an attractive vulnerability that is. With poor technology and poor regulation around some big-ticket authentication problems right now, one mechanism we do have is brand reputation. For example, if people seem to keep hearing about SIM swaps involving carrier X or store Y, then some people are going to start thinking that brand is sketchy, and more likely to get your bank account emptied or computer accounts hacked. So then all the brands would have more incentive to be very diligent about internal controls, very cautious about partners and outsourcing, etc. But if it's always just an unnamed phone store SIM-swapping for an unnamed carrier, or an unnamed carrier's support call center, then that brand reputation mechanism is defeated.
- runjake 3y agoTelecom in New Jersey is code for Verizon Wireless[1]. If I were the Verizon Wireless CEO, I'd own it and pledge to resolve as best I can. And maybe they have, I haven't looked yet. Edit: I had it backwards. Not AT&T, but rather Verizon. Changed. "Telecom in Georgia" would allude to AT&T. "Telecom in Kansas (or maybe Bellevue, WA now)" to T-Mobile, etc. 1. https://en.wikipedia.org/wiki/Verizon_(mobile_network) https://en.wikipedia.org/wiki/Verizon_(mobile_network)
- zachmu 3y agoAmazed this doesn't happen more often given what's at stake and how cheap to buy off employees apparently are.
- josh2600 3y agoI worked in telecom for many years. Retail employees would perform sim swaps at locations I worked at for about $250-300. This was circa 2006 so I’m not surprised that people do it for $1000 with inflation. The reality is that cell phone employees are paid just above minimum wage, so asking them to protect a system that has the capacity for multiple millions of fraud by simply changing a sim is hard. The good news is that they made it much much harder for retail employees to access your account without your consent. You almost universally need a pin or last 4 of a social to access a customer account now without a manager override. This is a huge improvement from the time I worked entry-level retail at AT&T when I could see any customer’s full social or tax ID by typing their phone number into the point of sale! Imagine being 18, poor as fuck, and able to see anyone’s financial information. I was moral, but I knew tons of people who just took out loans as if they were the customer committing massive fraud. It was very hard for AT&T to catch this kind of identity theft. I’m glad systems are becoming safer over time.
- hjerne 3y agoscammers are not allowed to stay here. @Josh Goldbard
- koolba 3y ago> You almost universally need a pin or last 4 of a social to access a customer account now without a manager override. Last four of a social is a terrible additional form of security. Even four random digit pins isn’t particularly secure if they don’t have proactive monitoring of attempts.
- slt2021 3y agolast 4 digits of SSN are regularly found in data leaks. what is worst is you CANNOT change it if your data is leaked from 3rd party site. conclusion: NEVER use phone number as 2FA, Always assume your cell number will be swapped, always use other more secure factor, especially if it has anything to do with money $$$
- pknomad 3y agoDo you mean never use your phone number as 2FA if other 2FA options are not available? Most major retail banks (BofA, Chase, Citi, etc) all offer mobile as the only, if not primary, 2FA option.
- switch007 3y agoSMS is a bad “something you have”. Your phone number is just something temporarily routed to your device, with varying degrees of temporary
- cynicalsecurity 3y agoThe two factor authorization using a phone number isn't such a strong protection after all, is it. I wonder who thought it was a good idea in the first place. Maybe their real intent was to collect people's phone numbers instead of protecting their accounts.
- switch007 3y agoWasn’t it heavily pushed by tech giants for data harvesting purposes, then cargo cult copied by everyone else?
- mr_mitm 3y agoIf that is so, the same tech giants are now pushing for passkeys, which is actually close to the ideal solution.
- kevincox 3y agoMany people reuse passwords. Forcing SMS 2FA is something that they can feasibly do, because almost everyone can receive SMS and greatly raises the difficulty of credential stuffing (from just stuffing to needing to do a SIM swap). This solves a lot of problems for service providers. Another benefit is that they can block duplicate accounts with the same phone number, this effectively adds a cost to account creation which can help to reduce spam. And yes, some will then use it to spam or sell. I don't think anyone ever thought that SMS 2FA was strong protection. It mostly benefits the service operators by reducing spam and stolen accounts.
- emgeee 3y agoIt was a useful tool to better verify identity vs relying solely on email addresses, which were substantially easier to create at the time. Kinda like SSNs though, I think it's way past the point when a better designed system should have been developed. Sadly, that costs a lot of money.
- chankstein38 3y agoRight? And now my message history is the occasional conversation littered with hundreds of "Your six digit code is _____"
- techsupporter 3y agoAnother reason in an increasingly long list of reasons that being a T-Mobile postpaid customer is frustrating: Customers haven't been able to manage our own physical or electronic SIMs for almost two years. T-Mobile shut down the online self-service process with the claim of making it "more secure". Meanwhile, SIM swaps continue by malicious actors with seemingly nothing that can be done to stop them. So I can't swap my own SIM without waiting on hold for an hour or two, either by chat or on the phone, but the scammers can do it with apparent impunity. (I have tried messaging T-Mobile's help group on Twitter but they seem to be the only competent support available and thus are also incredibly backlogged.) I get that providers have to cater to the lowest common denominator but I wish there was a MVNO or similar who would allow use of authenticator keys and maximum level self service, with the understanding that if I break or lose my authentication methods, I am out of luck. Right now, my current carrier seems the worst of both choices.
- Scoundreller 3y agoSimple solution (with some obvious tradeoffs): You can’t receive shortcode or other SMSs for X hours after porting/doing a SIM replacement. Maybe just block everything with numbers in it, or “code” or “security” for this time. Now if your phone goes dark, you get some notice to take action before your world falls apart.
- codedokode 3y agoSome banks in Russia detect when the SIM identifier has changed and refuse to send 2FA codes to new SIM cards as a measure against SIM swaps.
- tky 3y agoUntil carriers are hit with substantial penalties, this will continue. T-Mobile allowed a SIM swap at a retail store on my line, which I noticed in real-time. Corporate couldn’t have cared less, even though I had all the names and location and detail from the store after I investigated myself. Worst part? They send a text saying, in effect, “we’re chabeing your SIM in 15 minutes unless you call us” This is AFTER their supposed security improvements, but then again so are the two other hacks where customer data was leaked. Don’t use SMS 2FA and set the most obnoxious ringtone for your carrier’s short codes. Take the most defensive approach to being a cell customer because the carriers won’t save you.
- akamaka 3y agoHas anyone created an ultra-secure VOIP service which would give people a secret phone number only to be used for 2FA?
- nickburns 3y agowrong question imho. TOTP is current MFA industry-standard (again imo)—and their creation, storage, and management is trivial. pick your reputable tool. the receipt of TOTP via SMS, regardless of telephony platform, however, is generally frowned upon by security heads.
- merll 3y ago[dead]