3 ms·

This is a timely post. I was going to do an "ask HN" on the best way to prevent a sim swap. I had heard about locking the SIM but then I heard this does not giv

by zafka 3y ago

This is a timely post. I was going to do an "ask HN" on the best way to prevent a sim swap. I had heard about locking the SIM but then I heard this does not give much protection. What are your thought on best protection methods??

the-chitmonger 3y ago
Just asked the same question, haha - it looks like some carriers allow you to lock your SIM from being ported to another number until you authorize it (either in person or through your accounts online). That being said, I guess if someone working at, say, Verizon was handling your switch, they might be able to switch it to a bad actor's phone before switching it to your legitimate one? Not entirely sure though -would love to hear a more informed answer.
edent 3y ago
I've worked for two UK telcos. There is no technical measure which you can apply. Locking your SIM prevents someone from physically stealing the card and putting it in a different device - unless they know the PIN which protects it. But that isn't the attack here. The phone number does not belong to you - the network operator defines which SIM it points to. So a suitably authorised person at the telco can point the number to a new SIM card. That's helpful if you've lost your SIM but bad if an attacker wants to divert your number. The best thing you can do is set a strong password on the account you have with the operator. You can also try ringing them and pretending to be you - see if they'll initiate a swap without proper authentication. If they do - move your number to a more reputable provider. But there's nothing you as an individual can do to prevent a corrupt employee making the change without authorisation.
- the-chitmonger 3y ago
  I never thought about pentesting my service providers - sounds fun and useful! I'll try this the next time I have a moment.
mindslight 3y ago
The best way to prevent a SIM swap is to not let your phone number be used as a trusted piece of authentication. Sure, what this guy did was criminal. But not nearly as criminal as it should be for companies to unilaterally force customers into using snake oil authentication methods, just so they can check some new compliance boxes and pretend to be adding security.

by zafka 3y ago

the-chitmonger 3y ago

Just asked the same question, haha - it looks like some carriers allow you to lock your SIM from being ported to another number until you authorize it (either in person or through your accounts online). That being said, I guess if someone working at, say, Verizon was handling your switch, they might be able to switch it to a bad actor's phone before switching it to your legitimate one? Not entirely sure though -would love to hear a more informed answer.

edent 3y ago

I've worked for two UK telcos. There is no technical measure which you can apply. Locking your SIM prevents someone from physically stealing the card and putting it in a different device - unless they know the PIN which protects it. But that isn't the attack here. The phone number does not belong to you - the network operator defines which SIM it points to. So a suitably authorised person at the telco can point the number to a new SIM card. That's helpful if you've lost your SIM but bad if an attacker wants to divert your number. The best thing you can do is set a strong password on the account you have with the operator. You can also try ringing them and pretending to be you - see if they'll initiate a swap without proper authentication. If they do - move your number to a more reputable provider. But there's nothing you as an individual can do to prevent a corrupt employee making the change without authorisation.

the-chitmonger 3y ago
I never thought about pentesting my service providers - sounds fun and useful! I'll try this the next time I have a moment.

mindslight 3y ago

The best way to prevent a SIM swap is to not let your phone number be used as a trusted piece of authentication. Sure, what this guy did was criminal. But not nearly as criminal as it should be for companies to unilaterally force customers into using snake oil authentication methods, just so they can check some new compliance boxes and pretend to be adding security.