28 ms·

T-Mobile employees across the country receive cash offers to illegally swap SIMs

• abeppu 3y ago
  > First and foremost, if you use any services online that have two-factor authentication, be sure it is not SMS-based. Use an app like Google Authenticator or Authy for this purpose instead. It really disappointing that in 2024, this is the "right" guidance to give, but we still know there's a whole lot of really important stuff that still uses SMS for 2-factor authentication.
  • filoleg 3y ago
    Half the time, even if a service supports autheticator app 2FA and not just sms, all it takes is just clicking “use another method” on the 2FA page, and it defaults to sms-based 2FA anyway. And it would still require a phone number when registering, so there is no way to avoid that fallback anyway. Borderline useless.
    • jandrese 3y ago
      The services require a phone number not because it adds security, but because it is a monetary challenge for scammers. If a service allows for multiple 2FA types it usually demands SMS for the initial setup, but once that is done you can remove your phone number to force it to switch to TOTP or a token. It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service.
      • filoleg 3y ago
        That’s totally fine, i am not against services requiring phone numbers during registration. I am just against those services allowing sms to be used as an easy 2FA fallback when an app-based 2FA is enabled. Because doing so makes app-based 2FA kinda useless. I agree with your points, it just feels insanely rate to see a service utilizing phone number requirement for registration the proper way (i.e., the way you describe).
        • bsder 3y ago
          > That’s totally fine, i am not against services requiring phone numbers during registration. I am completely opposed to services having any PII (Personal Identifiable Information) beyond an email address because the dumbass services keep my PII and then lose it when they get hacked. If I can go collect a million dollars from a company that loses my PII, I'd let them collect it. SInce I can't, my best option is to refuse. If you want to verify, take a credit card number. At least I can cancel and change that when some dumbass get hacked and loses it.
      • Wowfunhappy 3y ago
        > It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service. Are you relatively confident that these sites actually delete removed phone numbers?
        • jandrese 3y ago
          All I'm confident about is that they certainly won't delete them if you leave it as a 2FA option.
  • liveoneggs 3y ago
    Why should someone outsource one more important identity thing to Google?
    • solardev 3y ago
      It doesn't have to be Google Auth, it can be any 2FA app (1password, Bitwarden, Authy, Microsoft Auth), whatever. It's just a safer way to do 2FA than SMS. Google Auth is just one of the earlier popular apps, so it's a common example. It kinda sucks though, cuz if you lose your phone you have to reset all your 2FAs.
    • astrange 3y ago
      Google Authenticator is client side. It's not the best 2FA app though; it makes it unreasonably hard to transfer codes.
      • lxgr 3y ago
        It's the opposite these days – they sync your HMAC secrets to your Google account now unless you opt out: https://security.googleblog.com/2023/04/google-authenticator-now-supports.html https://security.googleblog.com/2023/04/google-authenticator...
  • hot_gril 3y ago
    Google Authenticator makes it very unclear to average users how you back up or transfer stuff to other devices. Sites that support Google Auth are gonna have to deal with lots of locked-out users trying to recover access, which can negatively impact security. If anything hopes to replace SMS, it needs to be as user-friendly as SMS.
    • fishpen0 3y ago
      Google auth is not the only authenticator that supports TOTP. Any time a site tells you to use google authenticator you should be using a better service like 1password, bitwarden, lastpass, etc... to scan the QR code and store the TOTP code. I'm flabbergasted every time I switch jobs and some jamook in IT or Security says we have to sue google authenticator and that other authenticators aren't allowed. Then there are constant lockout events generating tickets for those teams when people delete the app or get new phones.
      • hot_gril 3y ago
        Yeah, it needs to be clear to users that they can use other things, especially some built-in option. Currently it's not.
    • usea 3y ago
      Many services will happily remove the authenticator from your account if you email them and say you lost it. The whole thing is a joke.
      • hot_gril 3y ago
        Indeed I was once ordered to implement oauth but keep the email password reset because too many people would get locked out otherwise. And I almost locked myself out while testing.
    • lxgr 3y ago
      It syncs everything to the cloud by default these days: https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/ https://arstechnica.com/security/2023/09/how-google-authenti...
  • dumbfounder 3y ago
    Every freaking time I get a new phone I forget the step of porting my authenticator keys. Wow, is it ever a drag trying to set them up again. Often, you need to do zoom calls to verify your identity. Takes days. This is the type of thing that will push almost everyone towards SMS. Also, it's easy for users and developers, and no one needs to learn anything. Solves these issues and we are good to go.
    • BenjiWiebe 3y ago
      You didn't write down your rescue keys like almost every website tells you to do when setting up totp?
      • dumbfounder 3y ago
        Boooooring.
    • nerdawson 3y ago
      AI is probably going to end Zoom auth calls. They'll almost become so trivial to fake as to be useless.
• ramesh31 3y ago
  There's a very simple solution which is to centralize the process. Banks learned this decades ago. It's why your teller can't do anything that an ATM machine can't do anymore.
  • solardev 3y ago
    What do you mean? Sometimes when I forget my ATM card, I go to the teller, who can help me after checking my photo ID and maybe some security questions.
    • ramesh31 3y ago
      Right, but they still can't do anything you wouldn't be able to achieve over the phone with the centralized support line. Maybe verifying your identity for a cash withdrawal, but that still requires knowing the same secrets you'd need to just replace the card. The branch employee has no more access to your account than you do.
      • solardev 3y ago
        But isn't that kinda the crux of it? If I can withdraw cash by presenting a photo ID instead of using my 2FA online, it is both more convenient for me as an end-user and also less secure (opens the account up to social engineering, fake IDs, etc.). Similarly, some 2FA implementations allow human support agents to manually reset the 2FA, sometimes making that the weakest link. The ruthless alternative is "If you lose your 2FA, you lose your entire account and there's nothing we can do about it". I've rarely seen that implemented in normal apps.
  • hn_throwaway_99 3y ago
    Yeah, I was thinking at the very least changing SIM assignment, given the huge target this is for bad guys, should require confirmation by at least 2 unrelated employees.
• Animats 3y ago
  The article is vague. Is this "sim-swapping" physically replacing the SIM card in the customer's phone? Or entering the wrong IMSI into some T-Mobile database to change the association between IMSI and customer?
  • flutas 3y ago
    Sim swapping is typically "put their phone number on this sim card I control" the point being to bypass any SMS based 2 factor auth / alerts.
  • daveoc64 3y ago
    In a typical SIM swapping attack, the attacker will contact the Cellular Carrier (either in-person at a retail store, or by phone/online support), impersonating the victim and claim that they've lost their phone (including SIM) and that they need a new SIM for their account. Carriers should have procedures in place to ensure that the identity of someone who presents themselves with this situation is verified, but it can often be bypassed. In the case of the article, corrupt employees of the carrier are being bribed to bypass the ID and security checks that should take place in the above situation. In other attacks, there are social engineering ways of bypassing the ID checks - such as claiming to be the victim of a robbery where both the phone and wallet were taken - so they don't have any ID, credit cards, or phone to prove who they are and that getting a new SIM would really help them out.
  • deleted 3y ago
    [deleted]
• hypeatei 3y ago
  Yet, most banks in the US force the use of SMS 2FA without offering TOTP as an option. Truly incompetent institutions we've created.
  • dheera 3y ago
    Yet other institutions do single TOTP with SMS backup instead of TOTP with a 2nd TOTP backup. The former is as bad as SMS.
  • klabb3 3y ago
    I think the popularity of phone numbers is not because it’s a good auth factor but because it is a little more work to Sybil flood with generated identities, compared to say email. So it’s not for our security exactly, but more for the company’s anti-abuse systems, and maybe the marketing department that loves hoarding phone numbers. That it works as a second factor is just a “happy” coincidence. Which in turn annoys me to no end given that phone numbers are regional. Having no access to banks when moving, let alone traveling, to an area with no cell service or a different country, is infuriating. It’s like “what’s your mother’s maiden name” all over again.
  • fuster 3y ago
    My bank took away the ability to do 2FA via email and is phone-only now. At least with the typical Gmail/equivalent account you have the option of making that less vulnerable to social engineering and outright bribes.
  • dvzk 3y ago
    SMS 2FA is one thing. Bad, but ineffective. SMS-based account recovery is far worse. Every time a major website asks me for a phone number "in case you lose access to your email account" I freak out internally before ensuring I never enter it.
    • causal 3y ago
      Right. The SMS 2FA risk is overstated IMO - at worst it makes it as insecure as password-only, and at best it creates a roadblock for attackers that can be significant for locked SIMs. But SMS account recovery is definitely opening the door to attack.
• hn_throwaway_99 3y ago
  > Where did this private information come from? > Still, the biggest issue here is how this person (or multiple people) obtained the employee phone numbers. We’re not sure yet which employees are impacted, but based on comments online it seems at least a few third-party employees are affected, and we’ve independently confirmed current corporate employees have also received the message. Sadly, the idea that phone numbers of people are private should be considered laughable at this point. There is LinkedIn, and even if you're not directly connected to someone it would be easy to correlate publicly available LinkedIn data to phone number data. Also, note that TMobile explicitly provides a "SIM Protection" feature, https://www.t-mobile.com/support/plans-features/sim-protection https://www.t-mobile.com/support/plans-features/sim-protecti.... Why this isn't enabled for everyone by default I don't know.
  • 0cf8612b2e1e 3y ago
    The website does not make it clear - what does SIM protection do? Does it put a waiting period on changes? Requires a website login first? What happens if I legitimately need a new SIM?
    • xyst 3y ago
      I had to deal with this recently. Basically, they put a hold on the account. The request is forwarded to another internal department for verification. Once verification is complete and the team determines the request is not fraudulent (asking for "verification pin" or "account password"). Then the request is forwarded to the appropriate tech team for further processing. SMS and calling was blocked during that entire time (~24-36 hrs) since the backend teams are likely operating in offshore timezones.
      • kgc 3y ago
        Doesn’t that mean the PIN and password are communicated in clear text?
  • livueta 3y ago
    I'm curious how that feature works on the backend. If the premise is employees abusing internal access to fiddle account data, and the feature can be toggled on an account page, can't the insider abuse a password reset flow, toggle the setting off, then proceed as normal? I'm assuming that there's some "customer walks into store and needs to reset their password" functionality employees can access. Maybe a mandatory waiting period?
• fishpen0 3y ago
  Its funny how you can't work for a secure government agency if you can't get clearance, and that a primary litmus test for clearance is how much debt you are in. (AKA how easy you are to bribe). But then for huge swaths of our infrastructure we have privatized it and left it in the hands of minimum wage employees who probably have auto and student debt and can be bribed for pittances.
  • toomuchtodo 3y ago
    Login.gov is a thing (and over 300 federal agencies use it as their idp as of this comment). USPS provided identity proofing in person for it. All federal gov agencies are moving towards it. The "right" way would be a national smart card ID system like Estonia has (built on cryptographic primitives), but you have a cohort of crazies who think it's the "mark of the beast" and other wild tales. So, we walk when we could run. This problem is at the people/policy OSI layer. The Defense Dept already does this: CAC/common access cards [1]. Create a civilian root and do it already. A PIV/CAC can also be used as an auth factor with Login.gov [2]. [1] https://www.cac.mil/common-access-card/ https://www.cac.mil/common-access-card/ [2] https://www.login.gov/help/get-started/authentication-methods/ https://www.login.gov/help/get-started/authentication-method... (Physical PIV (personal identity verification) cards or CACs (common access cards) are secure options for federal government employees and military personnel. These cards, with encrypted chip technology, are resistant to phishing and difficult to hack if stolen.)
    • throw7 3y ago
      Papers Please.
      • toomuchtodo 3y ago
        This is a tired argument. If you want better governance, it's a political problem, not a tech problem. "Papers Please" exists today due to a lack of law enforcement oversight and current statute [1]. A properly functioning national ID system and infrastructure doesn't change that. The databases already exist [2] [3] [4] [5]; because you do not have the physical card does not mean you don't live this reality today. On the contrary, you already don't have the privacy you think you have, without any of the quality of life improvements a national ID card would provide. > CBP has successfully implemented facial biometrics into the entry processes at all international airports, known as Simplified Arrival, and into the exit processes at 49 airport locations. CBP also expanded facial biometrics at 39 seaports and all pedestrian lanes at both Southwest Border and the Northern Border ports of entry. > To date, CBP has processed more than 490 million travelers using biometric facial comparison technology and prevented more than 1,900 impostors from entry to the U.S. [1] https://en.wikipedia.org/wiki/Stop_and_identify_statutes https://en.wikipedia.org/wiki/Stop_and_identify_statutes [2] https://www.dhs.gov/biometrics https://www.dhs.gov/biometrics [3] https://www.tsa.gov/biometrics-technology/evaluating-facial-identification-technology https://www.tsa.gov/biometrics-technology/evaluating-facial-... [4] https://www.cbp.gov/travel/biometrics/airports https://www.cbp.gov/travel/biometrics/airports [5] https://www.dhs.gov/real-id/real-id-faqs https://www.dhs.gov/real-id/real-id-faqs
• lukeschlather 3y ago
  We really need better standards for MFA. Probably we should have a legal definition of MFA and SMS should be described as 2SA (Two-step authentication) on par with email or whatever. While MFA should be restricted to actual Yubikeys and other hardware certificate based things. I'd also say people shouldn't be able to advertise MFA if they only support a single token per method.
  • toomuchtodo 3y ago
    https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf https://www.cisa.gov/sites/default/files/publications/fact-s... ("CISA.gov: Implementing Phishing-Resistant MFA") https://passkeys.dev/ https://passkeys.dev/ https://passkeys.directory/ https://passkeys.directory/
  • hot_gril 3y ago
    It's not reasonable to expect people to have Yubikeys. iPhone Keychain is about as good as it'll get realistically, and that somewhat relies on hardware security.
    • xyst 3y ago
      "iPhone Keychain" - no thanks, I'll stick with a non-vendor specific provider. I am trying to escape that awful ecosystem, not dig myself further in.
      • hot_gril 3y ago
        The option of Yubikeys is fine as long as the basic 1P thing is painlessly usable too.
      • overstay8930 3y ago
        you know its trival to export, right? There's nothing more secure than Keychain if you're in the Apple ecosystem. Nothing gets more scrutiny from the entire industry, at least.
• blackhaj7 3y ago
  I lost my phone a few weeks back and was astonished that I was able to go into T Mobile and get my number switched to my new phone without showing any ID
  • noxon 3y ago
    That’s horrifying!
    • lrvick 3y ago
      I had the ability to swap numbers for 3 carriers as a minimum wage paid Radio Shack employee. It was just a web form with a few boxes to fill out based on customer provided info followed by enter. Even when ID is checked, a decent fake ID is like $50 these days, and grants access to wealthy bank accounts. At the time we were heavily incentivized to speed run anything that did not generate a commission so checking ID carefully if at all was not high on our list of priorities.
  • tempaccount420 3y ago
    Americans like to believe they live in a high trust society. That must be why things like this are even possible. It brings convenience (and I guess profit, as time is money) but the trust required is very high.
  • ec109685 3y ago
    Did you have a pin on your account? One would hope it’s not possible to swap unless that is entered, no matter how corrupt the employee.
  • deleted 3y ago
    [deleted]
• moose44 3y ago
  Humans remain the biggest vulnerability in cyber security.
  • lupire 3y ago
    "cyber security" is a misnomer. "HCI security" is more accurate.
• eBombzor 3y ago
  It's actually unbelievable how often SMS OTP is used, when it's public knowledge that it just replaces one attack vector with a worse attack vector... Cracking a password or breaking into an encrypted database is 10x harder than getting a sim swap.
  • loloquwowndueo 3y ago
    Cracking a good password - which a large percentage of people don’t have or will readily input in any phishing web form without a second thought. Time-constrained 2FA codes can be broken with sim swaps or targeted phishing which are less widespread than a wide-net spam-based phishing campaign. Now don’t get me wrong I hate SMS 2FA with a passion but still :)
  • zamalek 3y ago
    My bank recently added the feature of removing SMS as an 2FA option - requiring TOTP. Now if they'd only add webauthn, but TOTP is pretty secure against phishing with a browser-integrated password manager (no autofill results in suspicion).
    • s1dev 3y ago
      What bank is this and are they available nationwide?
      • zamalek 3y ago
        First Tech CU. Their physical locations are PNW only, but that hasn't stopped me from continuing to use them electronically on the east coast. They are also part of the CU alliance, so access to alliance branches and ATMs is possible (I've never had the need to test this).
      • Hnrobert42 3y ago
        Yes. Why are banks with TOTP so rare?!
        • 3y ago
• avidiax 3y ago
  Couldn't T-Mobile send their own SMS's to their employees pretending to increase the payout to $600, then fire any employee that replies? Or maybe change the terms of use for the employee line discount to allow monitoring SMS content or metadata for security threats to the companies users?
  • FeistySkink 3y ago
    Or pay people enough so they don't get tempted to begin with.
    • ApolloFortyNine 3y ago
      Billionaires have literally committed financial crimes for more money. Pay has very little to do with it.
      • Red_Leaves_Flyy 3y ago
        Billionairism. Addiction to the accrual of wealth and the power wealth affords. They should be in asylums not boardrooms.
        • ssl-3 3y ago
          There's plenty of room for them in the Fletcher Memorial Home.
          • infotainment 3y ago
            Such a weird song, yet surprisingly memorable. “And give them a home / a little place of their own…”
    • renewiltord 3y ago
      Lol Martha Stewart has $400m and she got done for $230k worth of insider trading. And Matt Levine every now and then talks about a guy making a few million a year insider insider trading a few thousand and settling.
• noodlesUK 3y ago
  What's the solution here? Can we practically expect employees at retail stores to not be permitted to change a person's phone over? What if the person who needs the swap has said their phone is lost/stolen? I think ideally there would be some kind of verification that the customer was indeed present and that their ID had been verified, but I don't see how you can do that in the US as there aren't ID cards or similar forms of universally available ID. I also think you should be able to get a phone number without ID at all, which would preclude verification in those cases. The issue is that people's phones are essentially the roots of trust for our digital lives. Passkeys being built into the OS are good because they push that problem away from carriers, but the fundamental issue still remains. Bootstrapping trust is hard.
  • jupp0r 3y ago
    > What's the solution here? webauthn
    • mantra2 3y ago
      Sure wish more places would allow you to turn off SMS if you’re using something like a Yubi.
    • lxgr 3y ago
      WebAuthN is an excellent alternative to passwords, but a relatively poor access recovery mechanism, given that it just kicks the can down the road to another provider at best (usually Apple or Google), and to a single physical object that's easy to lose at worst. I use it myself, but I do also understand companies and people that don't want to make it their only way back into their account as it is.
  • jasonjayr 3y ago
    ... away from carriers and into the hands of Google/Apple/Microsoft, who can kill your account for any and no reason at all. Except for that one giant issue, passkeys are gonna be great.
    • 3y ago
• snowwrestler 3y ago
  “Inside job” SIM swap attacks are not necessarily new; a close friend’s T-Mobile phone got hit this way in March 2020. The news here is the intersection of a data breach with SIM swapping: criminals are using the employee phone numbers from a recent T-Mobile breach data dump to text tons of employees at once, offering $300 per swap. Previously, criminals would develop the inside agent either through personal connections or by applying and getting hired themselves. With the breached data, they can automate and scale.
  • paulpauper 3y ago
    this has been going on regarding crypto since early 2018 afik.
  • Terr_ 3y ago
    As others have suggested, the trick is put out fake honeypot offers, to strike at the weak point of the scheme, which is that lack of trust and anonymity run both ways. In other words, the "old way" isn't just about cultivating an insider agent, but also about establishing that the insider can trust the requestor.
  • stefandesu 3y ago
    I wonder why people risk their jobs for $300.
    • m463 3y ago
      exit strategy?
    • Our_Benefactors 3y ago
      1. Cell phone retail is a McJob not a career 2. They don’t think they’ll be caught so it’s more like free money. Getting caught doesn’t factor in to the decision.
  • tekknik 3y ago
    > a close friend’s T-Mobile phone got hit this way in March 2020 I was hit back in the late 2000’s, maybe 2008 iirc.
• b8 3y ago
  Yeah this has been a thing since 2012ish and became more popular around 2016/17. Brian Krebs has documented this for the past 8 years. No new news here.
• squokko 3y ago
  When you have $15/hr employees who can enable a $100,000 scam this is bound to happen.
  • deleted 3y ago
    [deleted]
• patmcc 3y ago
  I feel the need to defend the use of SMS for 2FA (in limited cases). SMS is actually a perfectly good channel for 2FA for most customers in most cases. Because most customers, most of the time, are not under a targeted or even semi-targeted attack. SMS 2FA protects quite well against large-scale brute force or credential stuffing attacks. If someone is checking 10k accounts against the 3 top passwords (yes, this is a very common attack type), those customers will be very well served by having SMS 2FA. SMS is a terrible channel if anyone is trying to target you directly though, that's absolutely true. edit: also, in case this wasn't clear - I'm not talking about any services that allow password reset through SMS alone - that's beyond idiotic, obviously.
  • pyrophane 3y ago
    But isn't it the case that most sites will tell you if you pass a password check before hitting you with a SMS verification? In that case I could see someone attempting a sim swap attack for accounts where they pass a password check for higher value stuff like primary email or anything that is probably linked to a spending account
    • patmcc 3y ago
      That assumes the attacker even has the phone number - best practice is to not display the full number, just the last 4 (xxx-xxx-1234) - so again, for the typical case, the attacker isn't going to know what number to sim swap. SMS is bad at protecting one account, it's good at protecting 10000.
      • ImAnAmateur 3y ago
        The minnow security model is bad at protecting one fish, it's good at protecting 10000. What would you say is an advantage unique to SMS that would be lost if text messages were switched to another model? I'm asking sincerely. There aren't many people arguing in favor of SMS here, so you seem like the right person to ask.
        • 3y ago
• wepple 3y ago
  This isn’t just an sim/T-Mobile issue Most customer service representatives are on very low incomes (especially in other countries) and it’s not hard to find one who will take actions for a (western) small amount of money. CSRs often have powerful capabilities and access to sensitive information. With poor access controls. Solve the SMS/MFA issue and they’ll attack the next thing in line
  • deleted 3y ago
    [deleted]
  • nijave 3y ago
    Yeah, but ideally the next thing in line is much more secure than a financially vulnerable, low wage worker. Afaik SMS 2FA is the easiest to compromise of all the methods. At least with, say, email, you need a password and potentially a different 2FA first.
  • TMWNN 3y ago
    >Most customer service representatives are on very low incomes (especially in other countries) and it’s not hard to find one who will take actions for a (western) small amount of money. CSRs often have powerful capabilities and access to sensitive information. With poor access controls. Another reason to implement my proposal of a law requiring all customer service serving US customers to be located in the US, UK, Ireland, Canada, Australia, or New Zealand.
• jupp0r 3y ago
  Who would be stupid enough to commit a federal crime for $300? Doing this will leave a clear paper trail to the respective employee (I hope, if not that'd be disastrous) and the crime itself has a high likelihood of being reported. Am I missing something?
  • insaneirish 3y ago
    > Who would be stupid enough to commit a federal crime for $300? Probably hundreds, if not thousands, of low level employees that work for carriers in retail positions.
  • imzadi 3y ago
    I think a lot of people are forgetting that most of this customer service is being outsourced to other countries.
• zkms 3y ago
  There has got to be some sort of two-man rule (https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule) integrated into the system that can't be bypassed by the people with authority to make changes to accounts. Otherwise any insider / careless spear-phishing victim will make the changes they want.
• causal 3y ago
  I was initially pleased when I discovered T-Mobile itself supported using TOTP apps like Google Auth and then flabbergasted when I found you could not disable SMS 2FA even after enabling alternatives.
• xyst 3y ago
  SIM swap attacks are the reason I do not use SMS 2FA. Everything has been switched to use software or hardware based MFA. Opting for "magic link" sign in where necessary. E-mail protected by one or more non-SMS MFA. The only services that I use with SMS 2FA are honeypot accounts.
  • pasttense01 3y ago
    So you didn't have any trouble finding financial institutions which allow software or hardware based MFA?
• dimmke 3y ago
  Don't new iPhones not even have physical SIM trays? And T-Mobile also lets you lock your number so it can't be ported out.
  • pxeboot 3y ago
    That doesn't mean an employee can't activate your line on a pSIM and hand it over to a threat actor.
• lxgr 3y ago
  Oh no! Who could have known that designating utility companies as the guardians of authentication and identification/KYC would have any downsides?
  • cyanydeez 3y ago
    While simultaneously degrading the value of employment to any of these conglomerates. This is the same reason you want well paid politicians and FBI staff.
    • lxgr 3y ago
      Sure, but please let the takeaway here not be "the employees of Con Edison, PG&E, National Grid etc. need to be paid and vetted like bank tellers, then it'll all be good". The intrinsic overlap of incentives and strengths between utility providers and identity verification organizations (whether private or public) is minimal, and I suspect extrinsically forcing them into that role can't end well either.
    • hx833001 3y ago
      Good thing there are no corrupt politicians and FBI agents.
    • airstrike 3y ago
      Well paid politicians do everything to get reelected rather than doing everything to increase general welfare. Also as others have commented, even well paid people do shady things. TFA isn't an endorsement of higher wages, it's a denouncement of our terrible collective security and authentication protocols.
      • throw10920 3y ago
        > Well paid politicians do everything to get reelected rather than doing everything to increase general welfare. Yes. Parent comment is literally completely backwards - we've seen from Wall Street that paying people extremely well leads to corruption. High pay has the opposite effect. Things that work include oversight, transparency, audit logs, removal of human processes, active anti-corruption investigation, and the like.
• Terretta 3y ago
  If you are a SaaS provider or bank, and you let password resets happen by SMS, you are a threat to your customers. Stop doing this. First, and a no brainer: offer "continue with ____" sign ins (OpenID Connect / OIDC) for users of Google, O365, Apple, to get out of the account creds business for most users.* (See also: passkeys.) Second, prefer TOTP as the MFA, not SMS. Third, if you absolutely have to do SMS for some dark pattern "harvest my customers' phones" reason, use it exclusively as a second step, never as an only factor. * For most customer firms using M365 or Google accounts, if you couple accepting OIDC with a domain validation to the customer's email address, you don't have to do SSO/SAML, since OpenID connect + domain accomplishes roughly similar goals on both sides without the per client company configuration overhead or "SSO tax": https://sso.tax/ https://sso.tax/
  • dudus 3y ago
    Aren't passkeys ready for prime time yet?
    • shepherdjerred 3y ago
      Yup! There's a directory of sites with support here: https://passkeys.directory/ https://passkeys.directory/ I use it for ~50 sites. It's such a pleasure to use.
    • 0cf8612b2e1e 3y ago
      Not until I can backup a passkey without Apple or Google acting as the steward. I need a system where I know that if my phone is lost, I can restart my digital identity without a tech giant.
      • rootusrootus 3y ago
        1Password does passkeys, and they exist on multiple platforms. I assume they are not the only non-Apple/Google password app which can do this.
      • renewiltord 3y ago
        I have mine in Bitwarden but I didn't think carefully through this, I just used what I had. It looks like Vaultwarden hasn't yet added support so you can't rehost without Bitwarden but you don't need Apple or Google.
• giobox 3y ago
  Surely we are close to the point a fully self-service cell account is possible via secure portal? Choose to eliminate human customer service, expose portal to user with appropriate MFA access controls etc. I guess what I'm asking for is a cellphone plan with no human customer service, similar to how there is basically no one I can call if I have a problem with a gmail account. Remove the source and the temptation of this attack in one go. I appreciate not every customer would like or want this, but could be offered to more security conscious users as an option. It's not unheard of to get a discount for pre-paying or enabling auto-payments on cell plans around the world, perhaps you could even get a few bucks off a month for choosing to not have option to call a contact center too.
  • TimJRobinson 3y ago
    There's a service called 3Num where you can get a number controlled by a private key. No one else has access to your number/account. Only supports SMS messages currently though, it's not a full phone service.
• getcrunk 3y ago
  The easiest solution would be a two employee requirement with a 3rd remote in corporate office. In smaller stores at least one remote. Using a camera for live video that was installed and inspected by corporate.
  • cyanydeez 3y ago
    ...and uh, make sure they're paid far above minimum wage.
    • dpe82 3y ago
      Reasonably well paid people are susceptible to bribes, too.
      • mschuster91 3y ago
        Yeah but if you're not resorting to just hiring anyone off the street who can talk sales, you get less morons applying in the first place. Less morons, less people who might be willing to treat that "stand in a mall and upsell people" job like they'd do flipping burgers and snotting into the mayonaise, or who need some "side hustle" cash just to make rent. Pay peanuts and everyone and their dog will apply, pay appropriately and you'll get higher quality applications that you can afford to actually vet.
      • cyanydeez 3y ago
        Look at it like a probabilistic scenario. Minimum wage, as demonstrated by the pandemic, is nowhere the level of pay. Of course everyone can be corrupted, but the probability diminishs greatly with just basic care.
• httpz 3y ago
  So looks like FCC is implementing some new rules to protect against SIM swapping and that's taking effect on July 8, 2024. Though from the press release, I'm not quite sure if that'll protect the customer from a carrier employee being the bad actor. https://www.fcc.gov/consumer-governmental-affairs/fcc-announces-effective-compliance-date-sim-swapping-item https://www.fcc.gov/consumer-governmental-affairs/fcc-announ... https://docs.fcc.gov/public/attachments/DOC-398483A1.pdf https://docs.fcc.gov/public/attachments/DOC-398483A1.pdf
• alufers 3y ago
  I know everybody says how bad SMS 2FA is, and how we should replace it with the next cool thing $BIGCORP invented (thus requiring you to have an account with them, which only defers the problem). But couldn't we pressure the telecoms to improve it? I have an idea that would make SIM swaps way harder to execute. Namely a website that wants to authenticate you should be able query the telecom for some kind of SIM card ID. This would happen before sending a 2FA code. With such a feature it would be easy to store the SIM card ID in a database when enrolling the phone number. Later when the user tries to authenticate and the ID does not match what saved before, the account is locked out. For enterprise accounts you would need to explain yourself to IT and for personal accounts a fallback 2FA would have to be used. Alternatively the authentication would be delayed for a few days to give the legitimate owner of the SIM card time to react. Another thing that could be added on top of this is to send a SMS to the old "inactive" SIM, alerting the original owner of the attack. EDIT: To add to this, here are some advantages of SMS 2FA over time based OTP or passkeys: 1. My grandma can use it with her dumb phone and poor digital skills. 2. Your SIM card will most likely survive if your phone is destroyed due to water or physical damage. (Sadly not true for eSIM) 3. You can dictate an SMS/OTP code over the phone, or forward it to somebody you trust. 4. Banks can append a short description of what you are currently authorizing. It can tip you off in case your computer is infected with malware, or you are victim to one of those TeamViewer scams.
  • mjmahone17 3y ago
    In your scheme, how do I transfer money from my bank after my phone is stolen and I need to get a new phone without access to the original sim? Or access my email? If that’s just impossible, how do I fix the issue? A “fallback 2FA” what is that exactly?
    • alufers 3y ago
      Probably one time use recovery codes you are supposed to print and keep in a safe place. In case of a bank this could also mean a trip to the nearest branch for ID verification. The same issue you mentioned applies to other 2FA methods. Your TOTP codes and passkeys also live on your phone, Yubikeys can be stolen too.
• aryan14 3y ago
  This has been going on for 5+ years, and there is an entire community behind this. Typically, teenagers ranging from 14 - 19 will select targets, or “targs” to conduct a “Sim Swap” on. Desired targets are often individuals with “rare” or “OG” handles on social media platforms, as they’re worth a lot of money. Or, individuals with large crypto wallets (Think: Coinbase, Binance, Etc)
  • halfcat 3y ago
    Darknet Diaries has a couple episodes about this. Two I remember are: * The Pizza Problem * Tennessee
• xivusr 3y ago
  Any reports of Verizon employees getting approached like this?
  • kotaKat 3y ago
    I've heard of them off and on in the past, typically a Verizon employee requires a significantly higher payoff ($2000-3000) to get a SIM swap across, so they're generally a lot more expensive all around. https://old.reddit.com/r/verizon/comments/1bnnsbc/kick_out_these_scammers/ https://old.reddit.com/r/verizon/comments/1bnnsbc/kick_out_t... Common to see people get approached on communities like carrier subreddits if they post that they work at a store and be dangled offers like that.
• SpaceManNabs 3y ago
  2FA is broken. If I want to get a new cell phone number, I am absolutely fucked on everything. This isn't sustainable.
• mlfreeman 3y ago
  I'll throw out an idea that seems simple to me... An *opt-in* option to require that lines on your account can not be moved to a new SIM unless the current SIM is offline as far as the cell grid is concerned. This could even be made into something that customer service could be blocked from overriding. If someone steals your phone, they try to get it into airplane mode as fast as possible to avoid activation locks. If you drop your phone in the ocean or off the side of a cliff, it's probably not going to remain working for long. If you're concerned about losing it somewhere where it'd remain active but you'd never find it, then don't opt in to this.
  • imzadi 3y ago
    There is an opt-in SIM protection available. You can lock the SIM card and can't move the line until it is unlocked.
    • mlfreeman 3y ago
      Taking the device offline requires you to either have control of or destroy the current phone, while that SIM protection sounded like something a customer service rep could be tricked into working around.
  • chgs 3y ago
    Send a message to the SIM card saying “do you want to move” If you don’t respond then it takes 48 hours to move. If you say “yes” then it moves If you say “no” then whoever asked for the move has some questions to answer
    • bsoft16385 3y ago
      T-Mobile already does exactly this for eSIM transfers, though the waiting period is 10 minutes, not 48 hours.
  • tass 3y ago
    Yes, or even require a challenge sent to the current line with a grace period, and you get to choose your own grace period up front. In this way, someone can't jack your line while they know you're on a flight. So, I lose my phone (maybe it's sitting on the side of the road somewhere) and need a new line. Since I can't reply to it my line will transfer after 8 (?) hours of no response to the challenge.
• zb3 3y ago
  To everyone pushing for a different 2FA method - what if I lose the 2FA device? Would it mean I won't be able to get into my bank account anymore? If not, then the method I could use to get my account back in that case could be the method that will be attacked.. If employees can be bribed, that's the problem.. there must be a human element somewhere, otherwise we'd have to be permanently locked out if we lose all 2FA devices
  • lxgr 3y ago
    What if you lose (access to) your phone number? If your bank doesn't have a plan for that, I'd strongly consider switching banks. If they do, you'd just use that.
    • ryandrake 3y ago
      I would wonder what the bank's plan for that is. If your bank can be "talked out of" requiring the second factor, then what good is 2FA? Hopefully they would at least require actual identification.
  • BenjiWiebe 3y ago
    It's why you write down the recovery keys when setting up 2FA.
• deleted 3y ago
  [deleted]
• k8svet 3y ago
  I just have a visceral reaction every time I see "SMS" anywhere. It's a garbage human verification method (hello boxes of SIM cards available in [certain markets] for spare change), it's a garbage 2fa mechanism (especially when its the only one). It's a garbage platform through and through. I don't care if I burn karma here, it's the worst technology that I'm forced to use on a regular basis. And I hate seeing it defended and used in new places. s/garbage/[stronger words]/g I mean, it's not quite as cheap, but even now I can provision fungible, resellable eSIMs, non-wholesale, for less than $5. Throw a little HS + acceptxmr, sit in front of Airalo/holaSIM/etc, or just figure out who their upstreams are. It's all a complete and utter farce.
• hotpotatoe 3y ago
  This isn’t limited to T-Mobile employees, I work for a T-Mobile MVNO and received the offer
• paradox242 3y ago
  Even in the black market of SIM swaps, that is a lowball offer.
• devy 3y ago
  SMS based OTP has been known to be unreliable way to authenticate someone because exactly this type of social engineering hacks. All software providers and the industry should ban SMS based OTPs as a standard practice. Either leapfrogging to a Passkey implementation or just time based OTPs.
  • akerl_ 3y ago
    What software provider or industry group is in a position to enact a ban on an MFA strategy?
    • mathgradthrow 3y ago
      the US government.
    • bhaney 3y ago
      Maybe organizations in charge of cybersecurity compliance frameworks? We'd see a lot of companies drop SMS 2FA pretty quickly if it became a requirement to maintain their SOC compliance. I don't think we need a complete sweeping ban to get it to largely fall out of use, just a critical mass to drop it so it's no longer defensible as an industry standard
  • deleted 3y ago
    [deleted]
  • dvngnt_ 3y ago
    after years with no issues, my bank stopped supporting my google voice number and said I have to use regular SMS as it's more secure
• TimJRobinson 3y ago
  I work in crypto and see Sim swaps happen all the time, mostly for Twitter account takeovers of famous people where they then post phishing links and steal their followers coins. T-Mobile is easily the biggest offender for this, most people reporting they use it, so this has been going on for a long time. The other big problem with Twitter security is you can have your account taken over even if you use non-sms 2FA! If you have your phone number on your account it can be used for recovery completely bypassing 2FA. They've had this security flaw for years and still haven't fixed it.
  • lxgr 3y ago
    Almost everybody supporting 2FA has this security flaw today. The number of sites that actually let me never provide a phone number, or at least not have it be a recovery method, is tiny. Even things like a simple time lock (e.g. SMS-OTP "2"FA recovery only being possible after 24 hours, combined with sending a blast of "careful, your account is about to be recovered by somebody that might not be you" and a way to stop that for the legitimate accountholder, would go a long way.
  • sgerenser 3y ago
    A lot of sites have this security flaw, turning SMS 2FA into 1FA: all you need is the phone number. Although allowing it even if you use non-sms 2FA is even worse, 100% defeating the purposes of using an alternate form of 2FA.
    • tekknik 3y ago
      Not even just SMS, some sites are doing the same with email.
• matheusmoreira 3y ago
  It's a good thing that this is finally becoming common. Hopefully it will put an end to SMS as 2nd factor and the registration by phone number epidemic.
• gosub100 3y ago
  Not even joking: there is probably a market for starting a mobile provider company that actually requires a DNA sample to change. The DNA could be collected from multiple sources simultaneously (blood, saliva, and randomly chosen fingernails) and run through a hash so that the provider never stores the DNA string itself. Some level of innovation may be required here, I know DNA itself isn't exactly a UUID, but I'm certain it could be done. VIPs would pay for this service and you could offer limited insurance for hackage. Edit to add: there was an episode of "Forensic Files" where a suspect injected someone else's blood sample (at great personal risk) to evade a DNA test for a sexual assault charge. So just acknowledging that DNA methods can be attacked too. Hence the necessity of multiple random samples.
  • DesiLurker 3y ago
    or a eyeball scan like that sam altman worldcoin thing.
• fortran77 3y ago
  Never say publicly who your bank or broker is! Anyone can pay off a tmobile employee and empty your bank account.
• brevitea 3y ago
  Amazon working on behalf of individual interests and/or the government to strategically target individuals? Sounds about right.
• thayne 3y ago
  > Sometimes, services may have SMS as the only option for two-factor. If this service is a bank or a crypto wallet, consider switching, because that isn’t great. Most banks I've interacted with fit in this category, except for online only banks. If you need a bank with a local presence, switching might not be an option.
• bsoft16385 3y ago
  T-Mobile has a SIM lock feature that you can enable to block at least most employees from being able to swap your SIM. You can enable it in the account management app or website. I was able to verify that it worked because an employee in a store literally could not transfer my SIM with it enabled. Their iPad app just gave an error of "customer has SIM lock enabled". Interestingly the T-Mobile employee had never even heard of this feature, which suggests that basically no one uses it.
  • itopaloglu83 3y ago
    > You can find the settings under My account > Profile > Privacy and Notification.
• qingcharles 3y ago
  I need to find someone who can do this so I can get back into my Google account. I have the email, password and recovery email, but not the phone number.