7 ms·

As the other comment said, they should go after all their customers too. I can't believe they are thefts out there paying other thefts for theft-services... Un

by 101008 2y ago

As the other comment said, they should go after all their customers too. I can't believe they are thefts out there paying other thefts for theft-services... Unrelated, but at the start of the year, a lot of Payoneer customers from Argentina lost their savings in the platform* due to someone having access to the OTP codes. Payoneer said it wasn't on their side the error, and evidence suggested that it was an error in Movistar, because all the victims were customers of that particular telco. As far as I know, Payoneer didn't return the money and Movistar was never charged or anything (rumours say it was a Movistar employee who sold SMS with the OTP). And if you ask why a lot of Argentina people use Payoneer and keep their savings there, it's a bit long to explain but basically is their way to get paid in USD outside the country without paying taxes (fair and unfair ones) and without getting their payments converted automatically to ARS pesos using a bad rate.

ensignavenger 2y ago
If Payoneer was using sms based auth codes, then it was clearly Payoneers error for doing something so incredibly stupid.
- arresin 2y ago
  I think it's security by popularity: You can't be blamed if it's "industry standard". Meanwhile it's 10x less hassle than trying to get people to use an authenticator. Passkeys aren't perfect privacy wise (and everything google touches is suspect), but they are easy.
  - chrisweekly 2y ago
    > "You can't be blamed if it's "industry standard". Thankfully, that's not true. Class action lawsuits can and do successfully target widespread industry malpractice. My first job out of college was as a paralegal, helping over 90 million American plaintiffs sue nearly every major life insurance company in the country for the previously common "standard behavior" of insurance agents convincing policyholders to periodically "roll over" their accounts, to the sole benefit of the agents and their employers. The settlement payout for each participant was typically meager -- but the malpractice was stopped.
    - jollyllama 2y ago
      >Thankfully, that's not true. We'll see how much Crowdstrike pays out.
      - pixl97 2y ago
        Directly or indirectly?
  - miki123211 2y ago
    Not only that, but mandatory authenticators would also create a support (and security) nightmare the moment you stepped out of the upper-middle-class, privileged tech worker world. They work great if you assume that everybody has a smartphone (as opposed to a feature phone), that they don't have their phones stolen every other month, that they know how to set up an authenticator app, that they'll remember to reconfigure everything properly when migrating to a new phone and won't immediately throw the old one away and so on. This problem is made even worse by the notoriously bad UX of most authenticator apps, notably the lack of automatic iCloud / Google Drive backup functionality and their inability to automatically show the code on screen whenever it's needed. The nice thing about SMS is that you can outsource most of the support burden to carriers, which have to handle it anyway. Carriers have the advantage that they usually speak the user's language, have an office relatively nearby, and can verify your government ID in person if need be.
    - ensignavenger 2y ago
      Did the carriers agree to take on this role of securing SMS messages for authentication? If I were a carrier, I would be actively fighting this nonsense.
      - AStonesThrow 2y ago
        How secure do they need to be? It's a single ephemeral factor. Every cell tower a numbers station. Sometimes I relay my OTP code to my friends in FB chat if I think the number has cool properties. I don't tell them anything else about the sign-in, so my self-breach has a rather limited risk factor. Didn't that LifeLock guy advertise his SSN everywhere? I'd say reliability counts for more in these cases, and SMS was designed for unreliability, like UDP. So I'd be more concerned about the relationships and gateways from MFA services to send out their codes, and ensure that they can be received in a timely fashion. This message will self-destruct in ten minutes.
      - miki123211 2y ago
        The carriers basically have to do this anyway, one way or another, because people want to get their phone number back when something bad happens to their phone. This would be true even without SMS authentication. A part of it is mandated by regulation, most countries require carriers to let their customers port their phone numbers out. When handling those port out requests, they don't necessarily have enough data to decide whether the request is legitimate or not, yet refusing such requests too often would draw the ire of regulators, which is something no carrier wants.
- AStonesThrow 2y ago
  > If Payoneer was using sms based auth codes, then it was clearly Payoneers error for doing something so incredibly stupid. It's sort of ironic that the Krebs article indicates that these dudes were specifically targeting the "most secure" OTP methods we know: authentication apps, rather than SMS or email codes. They were simply using social engineering and human trust to bypass the industry's best technical practices. SMS and email are side-channel communications, so the attacker would need to intercept them, and hopefully suppress the legitimate receipt as well. I'd get kind of worried if my bank sent me an unsolicited code. But a consumer may be more credulous when their "bank" calls in to request one from them...
- deepsun 2y ago
  Bank Of America accepts _only_ SMS codes, nothing else.
  - jalk 2y ago
    That is not correct. You can use a "USB security key" - e.g. YubiKey See https://www.bankofamerica.com/security-center/online-mobile-banking-privacy/usb-security-key/ https://www.bankofamerica.com/security-center/online-mobile-...
    - deepsun 2y ago
      Good to know, thanks.
    - lxgr 2y ago
      Woah, they actually do! Thank you! I was certain that no US bank supported WebAuthN yet. They also do seem to check that it's actually a hardware key, i.e. software authenticators like Google's or Apple's default solutions don't work.
  - deleted 2y ago
    [deleted]
- hiatus 2y ago
  Chase, one of the biggest banks, still does not support anything beyond SMS/phone for 2fa.
dgoldstein0 2y ago
there's a whole underground economy. I recall hearing a story of how one guy was busted who used to build an exploit kit and sell it to people for a cut of their earnings. And then there's crazier shit like https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/ https://krebsonsecurity.com/2024/03/blackcat-ransomware-grou...
- janalsncm 2y ago
  The craziest one I’ve heard of was the app Anom which was supposed to be for criminals to communicate securely and secretly. Except it wasn’t, it was actually controlled by the FBI. I’m part way through a book about it now and it’s pretty incredible how the FBI took it over and essentially became world police.
  - earth-adventure 2y ago
    What's the books name?
    - alias_neo 2y ago
      Digital Fortress (/jk)
    - janalsncm 2y ago
      Dark Wire
  - oo0shiny 2y ago
    Just listened to the Search Engine podcast episode [1] where the author talked about this story. It's wild. The author (Joseph Cox) is also a founder of 404 Media[2], which is a great tech blog. [1] https://www.searchengine.show/listen/search-engine-1/what-s-the-best-phone-to-do-crimes-on https://www.searchengine.show/listen/search-engine-1/what-s-... [2] https://www.404media.co/ https://www.404media.co/
- stavros 2y ago
  Wow, if you can't trust extortionists, who can you trust?
mananaysiempre 2y ago
> I can't believe they are thefts out there paying other thefts for theft-services... Why wouldn’t there be? It’s not like an economy needs anything more than a medium of exchange and a kind-of-functional guarantee of nonviolence to arise. If you have that, you don’t need to arrange for a market, it will just happen, more or less. (Healthy or not is another question.) Anyway, yes, there’s phishing for hire, bring-your-own-payload exploitation for hire, ransomware for hire, and of course DDoS for hire. Captcha solving for hire is legitimate enough to occasionally get posted on HN (and I don’t think it shouldn’t be). People’s residential or mobile internet connections for hire, hijacked via free VPN browser extensions and mobile ad SDKs, are legitimate enough to be sold via advertising conglomerates (but I think they shouldn’t be). A market isn’t something you build, it’s something you have to actively prevent.
- miki123211 2y ago
  another example of this phenomenon are "free" markets in prisons, where the currency is usually cigarettes. Other places where freedom is limited have similar characteristics, I remember that we had a sort of food market when I was a child at a boarding school.
  - 0x3444ac53 2y ago
    Fun fact, I had a family member in prison and apparently they used postal stamps as currency
    - mananaysiempre 2y ago
      As a side note, France has a thing called “fiscal stamps” (timbres fiscales) which I had to use to pay a ~60€ government fee of some sort. One time I did it I paid online and got an A4 thing I needed to print out, which, OK, sure. The other time I couldn’t do that for reasons I don’t remember and paid cash at a store to get one. What I got was a tiny thing that looks exatly like a small postage stamp of the standard almost-square shape (which is itself funny because all the actual French postage stamps I used were twice as large) except it cost the aforementioned ~60€. Needless to say, I was terrified I’d lose it the whole hour or so before I handed it over to a clerk. Wikipedia tells me this was a common approach once[1]. [1] https://en.wikipedia.org/wiki/Revenue_stamp https://en.wikipedia.org/wiki/Revenue_stamp
wileydragonfly 2y ago
I tried to set up a bank account in Argentina, and I will admit it was to buy cheap digital PC and Xbox game licenses. Incredibly hard to do so as a foreigner.
- dheera 2y ago
  Many other countries make it super easy for foreigners to get bank accounts. It's actually kind of a stupid economic policy to make it hard. If someone wants to store money in your country that's good for you.
  - lazide 2y ago
    The US does tend to crack down on US citizens doing it though, if they try to hide it from the IRS.
  - csomar 2y ago
    > Many other countries make it super easy for foreigners to get bank accounts. This is false and I challenge you to name these countries. Also, not certain about your definition of "super easy". I interpret it as say "hi" to the teller, give my ID and get my bank account.
    - dheera 2y ago
      It's about that easy in China. (In addition to your ID you also need an +86 mobile number, which you can get in about 5 minutes by showing your ID at a China Mobile store.)
      - csomar 2y ago
        Are we talking about a bank account or a digital wallet. Your experience is atypical: https://wise.com/en-cn/blog/how-to-open-a-bank-account-in-china-as-a-foreigner#what-requirements-do-i-need-to-open-a-bank-account-in-china https://wise.com/en-cn/blog/how-to-open-a-bank-account-in-ch... That being said, I read about them making it easier for foreigners to open digital wallets (though that still says nothing about real bank accounts). If you do know a bank/branch that supports opening for tourist foreigners with just an ID+Phone, my email is in my account page and I'd appreciate if you pass that info.
jerf 2y ago
"I can't believe they are thefts out there paying other thefts for theft-services..." Completely seriously, you and everyone else reading this need to not just "know" this, but believe it and feel it. Too often I feel like programmers are like fat 50-year-olds talking smack on the locker room about how doomed the other team is because they know the importance of MD5-hashing passwords in the database, and they have no idea they're going out on to the field against an NFL team. Of course, where this metaphor breaks down is that these metaphorical lardasses will not be able to fail to notice them getting their asses handed to them, whereas in the security space, their real-world analogs may not even notice they were hacked. It's brutal out there. Even the open source tooling is far more sophisticated that most people reading this realize, and that constitutes the baseline, not the top end. There's an underground economy, and it is sponsored by many entities with deep pockets, including large-scale criminal enterprises, some of which can rival "real" companies in scale, and government-backed operations of all sorts. You're not up against a stray hacker bumbling into your system. If you've got assets worth anything, you're up against professional organizations. If you are responsible for anything that matters, take the threats seriously.
- kurthr 2y ago
  Absolutely, if there's a moderately anonymous way to get significant sums of money out of something, sophisticated attackers will spend significant effort and even % of funds to extract it. That includes bribery, phishing, spamming, as well as the usual hacking and cracking exploits. As you mention, the other issue is that this is often invisible (or even hidden by) to those who created the system that allowed the extraction.
- 14 2y ago
  “If you got assists worth anything…” well finally I am in a positive position for being monetarily poor. The other great thing about being poor is I had to learn to be a backyard mechanic to fix my own broke down cars.
- deleted 2y ago
  [deleted]
- fsckboy 2y ago
Terr_ 2y ago
> I can't believe they are thefts out there paying other thefts for theft-services... You might enjoy "Lying for Money: How Legendary Frauds Reveal the Workings of the World", which talks a bit about frauds as existing as a parasitic economy with its own parasites, etc.
- pixl97 2y ago
  I was in a call today showing scams around the world and it's insane how out in the open some of these scams are. One was showing products advertised on FB at an extremely cheap price. You think you're buying a widget but instead deep in the language you're buying a weekly service that shoots up to $100 a week. If you call to complain against the company you bought from, they tell you they won't cancel as you signed a contract. In this particular case the security researcher reached out FB (privately, reporting it did not work) and showed the vast web of accounts buying ads and promoting it, which were soon banned.
  - xp84 2y ago
    It’s frustrating to me how broken the (automated?) moderation system is on Facebook (though for all I know every other social media is as bad, Facebook just gives more transparency as to what happens after a report). You see tons of messages of just random new accounts, posting to strangers commenting on like a meme post, saying “I love your posts, I’d like to get to know you better, dm me on telegram…” or “I have earned $123,456 in 4 days thanks to the crypto genius Steve Bob [link to other fake profile]” - reporting them usually results in a “we didn’t take down the content” result. Any human knows this is pure fraud.
lynx23 2y ago
https://en.wikipedia.org/wiki/Thieves%27_guild https://en.wikipedia.org/wiki/Thieves%27_guild :-)

by 101008 2y ago

ensignavenger 2y ago

If Payoneer was using sms based auth codes, then it was clearly Payoneers error for doing something so incredibly stupid.

arresin 2y ago
I think it's security by popularity: You can't be blamed if it's "industry standard". Meanwhile it's 10x less hassle than trying to get people to use an authenticator. Passkeys aren't perfect privacy wise (and everything google touches is suspect), but they are easy.
- chrisweekly 2y ago
  > "You can't be blamed if it's "industry standard". Thankfully, that's not true. Class action lawsuits can and do successfully target widespread industry malpractice. My first job out of college was as a paralegal, helping over 90 million American plaintiffs sue nearly every major life insurance company in the country for the previously common "standard behavior" of insurance agents convincing policyholders to periodically "roll over" their accounts, to the sole benefit of the agents and their employers. The settlement payout for each participant was typically meager -- but the malpractice was stopped.
  - jollyllama 2y ago
    >Thankfully, that's not true. We'll see how much Crowdstrike pays out.
    - pixl97 2y ago
      Directly or indirectly?
- miki123211 2y ago
  Not only that, but mandatory authenticators would also create a support (and security) nightmare the moment you stepped out of the upper-middle-class, privileged tech worker world. They work great if you assume that everybody has a smartphone (as opposed to a feature phone), that they don't have their phones stolen every other month, that they know how to set up an authenticator app, that they'll remember to reconfigure everything properly when migrating to a new phone and won't immediately throw the old one away and so on. This problem is made even worse by the notoriously bad UX of most authenticator apps, notably the lack of automatic iCloud / Google Drive backup functionality and their inability to automatically show the code on screen whenever it's needed. The nice thing about SMS is that you can outsource most of the support burden to carriers, which have to handle it anyway. Carriers have the advantage that they usually speak the user's language, have an office relatively nearby, and can verify your government ID in person if need be.
  - ensignavenger 2y ago
    Did the carriers agree to take on this role of securing SMS messages for authentication? If I were a carrier, I would be actively fighting this nonsense.
    - AStonesThrow 2y ago
      How secure do they need to be? It's a single ephemeral factor. Every cell tower a numbers station. Sometimes I relay my OTP code to my friends in FB chat if I think the number has cool properties. I don't tell them anything else about the sign-in, so my self-breach has a rather limited risk factor. Didn't that LifeLock guy advertise his SSN everywhere? I'd say reliability counts for more in these cases, and SMS was designed for unreliability, like UDP. So I'd be more concerned about the relationships and gateways from MFA services to send out their codes, and ensure that they can be received in a timely fashion. This message will self-destruct in ten minutes.
    - miki123211 2y ago
      The carriers basically have to do this anyway, one way or another, because people want to get their phone number back when something bad happens to their phone. This would be true even without SMS authentication. A part of it is mandated by regulation, most countries require carriers to let their customers port their phone numbers out. When handling those port out requests, they don't necessarily have enough data to decide whether the request is legitimate or not, yet refusing such requests too often would draw the ire of regulators, which is something no carrier wants.
AStonesThrow 2y ago
> If Payoneer was using sms based auth codes, then it was clearly Payoneers error for doing something so incredibly stupid. It's sort of ironic that the Krebs article indicates that these dudes were specifically targeting the "most secure" OTP methods we know: authentication apps, rather than SMS or email codes. They were simply using social engineering and human trust to bypass the industry's best technical practices. SMS and email are side-channel communications, so the attacker would need to intercept them, and hopefully suppress the legitimate receipt as well. I'd get kind of worried if my bank sent me an unsolicited code. But a consumer may be more credulous when their "bank" calls in to request one from them...
deepsun 2y ago
Bank Of America accepts _only_ SMS codes, nothing else.
- jalk 2y ago
  That is not correct. You can use a "USB security key" - e.g. YubiKey See https://www.bankofamerica.com/security-center/online-mobile-banking-privacy/usb-security-key/ https://www.bankofamerica.com/security-center/online-mobile-...
  - deepsun 2y ago
    Good to know, thanks.
  - lxgr 2y ago
    Woah, they actually do! Thank you! I was certain that no US bank supported WebAuthN yet. They also do seem to check that it's actually a hardware key, i.e. software authenticators like Google's or Apple's default solutions don't work.
- deleted 2y ago
  [deleted]
hiatus 2y ago
Chase, one of the biggest banks, still does not support anything beyond SMS/phone for 2fa.

dgoldstein0 2y ago

there's a whole underground economy. I recall hearing a story of how one guy was busted who used to build an exploit kit and sell it to people for a cut of their earnings. And then there's crazier shit like https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/ https://krebsonsecurity.com/2024/03/blackcat-ransomware-grou...

janalsncm 2y ago
The craziest one I’ve heard of was the app Anom which was supposed to be for criminals to communicate securely and secretly. Except it wasn’t, it was actually controlled by the FBI. I’m part way through a book about it now and it’s pretty incredible how the FBI took it over and essentially became world police.
- earth-adventure 2y ago
  What's the books name?
  - alias_neo 2y ago
    Digital Fortress (/jk)
  - janalsncm 2y ago
    Dark Wire
- oo0shiny 2y ago
  Just listened to the Search Engine podcast episode [1] where the author talked about this story. It's wild. The author (Joseph Cox) is also a founder of 404 Media[2], which is a great tech blog. [1] https://www.searchengine.show/listen/search-engine-1/what-s-the-best-phone-to-do-crimes-on https://www.searchengine.show/listen/search-engine-1/what-s-... [2] https://www.404media.co/ https://www.404media.co/
stavros 2y ago
Wow, if you can't trust extortionists, who can you trust?

mananaysiempre 2y ago

> I can't believe they are thefts out there paying other thefts for theft-services... Why wouldn’t there be? It’s not like an economy needs anything more than a medium of exchange and a kind-of-functional guarantee of nonviolence to arise. If you have that, you don’t need to arrange for a market, it will just happen, more or less. (Healthy or not is another question.) Anyway, yes, there’s phishing for hire, bring-your-own-payload exploitation for hire, ransomware for hire, and of course DDoS for hire. Captcha solving for hire is legitimate enough to occasionally get posted on HN (and I don’t think it shouldn’t be). People’s residential or mobile internet connections for hire, hijacked via free VPN browser extensions and mobile ad SDKs, are legitimate enough to be sold via advertising conglomerates (but I think they shouldn’t be). A market isn’t something you build, it’s something you have to actively prevent.

miki123211 2y ago
another example of this phenomenon are "free" markets in prisons, where the currency is usually cigarettes. Other places where freedom is limited have similar characteristics, I remember that we had a sort of food market when I was a child at a boarding school.
- 0x3444ac53 2y ago
  Fun fact, I had a family member in prison and apparently they used postal stamps as currency
  - mananaysiempre 2y ago
    As a side note, France has a thing called “fiscal stamps” (timbres fiscales) which I had to use to pay a ~60€ government fee of some sort. One time I did it I paid online and got an A4 thing I needed to print out, which, OK, sure. The other time I couldn’t do that for reasons I don’t remember and paid cash at a store to get one. What I got was a tiny thing that looks exatly like a small postage stamp of the standard almost-square shape (which is itself funny because all the actual French postage stamps I used were twice as large) except it cost the aforementioned ~60€. Needless to say, I was terrified I’d lose it the whole hour or so before I handed it over to a clerk. Wikipedia tells me this was a common approach once[1]. [1] https://en.wikipedia.org/wiki/Revenue_stamp https://en.wikipedia.org/wiki/Revenue_stamp

wileydragonfly 2y ago

I tried to set up a bank account in Argentina, and I will admit it was to buy cheap digital PC and Xbox game licenses. Incredibly hard to do so as a foreigner.

dheera 2y ago
Many other countries make it super easy for foreigners to get bank accounts. It's actually kind of a stupid economic policy to make it hard. If someone wants to store money in your country that's good for you.
- lazide 2y ago
  The US does tend to crack down on US citizens doing it though, if they try to hide it from the IRS.
- csomar 2y ago
  > Many other countries make it super easy for foreigners to get bank accounts. This is false and I challenge you to name these countries. Also, not certain about your definition of "super easy". I interpret it as say "hi" to the teller, give my ID and get my bank account.
  - dheera 2y ago
    It's about that easy in China. (In addition to your ID you also need an +86 mobile number, which you can get in about 5 minutes by showing your ID at a China Mobile store.)
    - csomar 2y ago
      Are we talking about a bank account or a digital wallet. Your experience is atypical: https://wise.com/en-cn/blog/how-to-open-a-bank-account-in-china-as-a-foreigner#what-requirements-do-i-need-to-open-a-bank-account-in-china https://wise.com/en-cn/blog/how-to-open-a-bank-account-in-ch... That being said, I read about them making it easier for foreigners to open digital wallets (though that still says nothing about real bank accounts). If you do know a bank/branch that supports opening for tourist foreigners with just an ID+Phone, my email is in my account page and I'd appreciate if you pass that info.

jerf 2y ago

"I can't believe they are thefts out there paying other thefts for theft-services..." Completely seriously, you and everyone else reading this need to not just "know" this, but believe it and feel it. Too often I feel like programmers are like fat 50-year-olds talking smack on the locker room about how doomed the other team is because they know the importance of MD5-hashing passwords in the database, and they have no idea they're going out on to the field against an NFL team. Of course, where this metaphor breaks down is that these metaphorical lardasses will not be able to fail to notice them getting their asses handed to them, whereas in the security space, their real-world analogs may not even notice they were hacked. It's brutal out there. Even the open source tooling is far more sophisticated that most people reading this realize, and that constitutes the baseline, not the top end. There's an underground economy, and it is sponsored by many entities with deep pockets, including large-scale criminal enterprises, some of which can rival "real" companies in scale, and government-backed operations of all sorts. You're not up against a stray hacker bumbling into your system. If you've got assets worth anything, you're up against professional organizations. If you are responsible for anything that matters, take the threats seriously.

kurthr 2y ago
Absolutely, if there's a moderately anonymous way to get significant sums of money out of something, sophisticated attackers will spend significant effort and even % of funds to extract it. That includes bribery, phishing, spamming, as well as the usual hacking and cracking exploits. As you mention, the other issue is that this is often invisible (or even hidden by) to those who created the system that allowed the extraction.
14 2y ago
“If you got assists worth anything…” well finally I am in a positive position for being monetarily poor. The other great thing about being poor is I had to learn to be a backyard mechanic to fix my own broke down cars.
deleted 2y ago
[deleted]
fsckboy 2y ago

Terr_ 2y ago

> I can't believe they are thefts out there paying other thefts for theft-services... You might enjoy "Lying for Money: How Legendary Frauds Reveal the Workings of the World", which talks a bit about frauds as existing as a parasitic economy with its own parasites, etc.

pixl97 2y ago
I was in a call today showing scams around the world and it's insane how out in the open some of these scams are. One was showing products advertised on FB at an extremely cheap price. You think you're buying a widget but instead deep in the language you're buying a weekly service that shoots up to $100 a week. If you call to complain against the company you bought from, they tell you they won't cancel as you signed a contract. In this particular case the security researcher reached out FB (privately, reporting it did not work) and showed the vast web of accounts buying ads and promoting it, which were soon banned.
- xp84 2y ago
  It’s frustrating to me how broken the (automated?) moderation system is on Facebook (though for all I know every other social media is as bad, Facebook just gives more transparency as to what happens after a report). You see tons of messages of just random new accounts, posting to strangers commenting on like a meme post, saying “I love your posts, I’d like to get to know you better, dm me on telegram…” or “I have earned $123,456 in 4 days thanks to the crypto genius Steve Bob [link to other fake profile]” - reporting them usually results in a “we didn’t take down the content” result. Any human knows this is pure fraud.

lynx23 2y ago

https://en.wikipedia.org/wiki/Thieves%27_guild https://en.wikipedia.org/wiki/Thieves%27_guild :-)