Hacker News Reader

Comment by cmurf | Hacker News Reader

"That other little thing the attacker did? He started a port of the phone number from Verizon to a VOIP provider, and that port had completed overnight."

One take away is how SMS as 2FA depends on a flawed assumption. The other I found cute is using random strings as answers to the stupid account recovery questions companies continue to ask.

Things not mentioned in the blog is exactly what personal information the attacker had, that authenticated him to Verizon. PIN? Some portion of his SSN? It must not have been account recovery questions because the target of the attack used random strings as answers.

View on HN

2FA is supposed to be 2-factor authentication: a password and a phone number. If you allow the phone number to reset the password, it becomes 1-factor authentication.

> One take away is how SMS as 2FA depends on a flawed assumption.

NIST (among many others) has recommended you stop using SMS for MFA: https://threatpost.com/nist-recommends-sms-two-factor-authen...

Some time ago I started doing the random strings too. I use 1Password for everything, so I just add the questions as free-form fields to 1Password, set up password fields for the answers, and have 1Password generate (pronounceable) passwords to use as the answers.

...then I called my bank, they asked me what was my grand mother's name and I answered "Oh it's a very long, random string". I don't remember how secure the other questions were, but she seemed satisfied with such an answer (and granted me access).

Is this a hypothetical or something that actually happened? Because if it's the latter then the rep that you talked to needs to be retrained, because that's equivalent to saying "oh it's some street in San Francisco" when asked what street you grew up on.

In any case, I have 1Password generate pronounceable passwords specifically to avoid the problem of the rep trying to compare random alphanumeric strings. 1Password can even generate random phrases of N words (e.g. xkcd passwords) which works well for this sort of thing because it's easy to say those over a phone.

> Because if it's the latter then the rep that you talked to needs to be retrained.

This is kinda the point though. We can cook up the most elaborate security scheme in the world, but ultimately the keys to our accounts lie with under trained, minimum-wage call center employees.

(EDIT: and hey, I've done some grinding minimum-wage bullshit jobs, I completely understand)

It did really happen, but as I said I don't remember whether the other questions were tougher. Perhaps they allow one question to be unknown. For example, when you recover a Google account, they ask you when you've created it and the subject of your last email. among other questions. I'm pretty sure I had these ones wrong but they were apparently satisfied with my other answers.

Ah, yeah if they ask multiple questions then it would be reasonable for them to allow one wrong answer.

In my case, I forgot I had a randomly generated answer, gave them the real answer, and the representative got very confused when he tried to compare that to what he had in the system.

Thats what banks here in Australia do; instead of needing everything right, they ask half a dozen questions which most need to be correct. Which is insecure, if you ask me, but the importantly weighted questions are things like "whats your account balance on <account> here?" and "what account types do you have?" which aren't public info, I guess?

Using diceware strings as the secret questions/answers is good because they are then readable and pronounceable over the phone if you ever actually have to use them.

Did this really happen? I mean, you know what they say about the weakest link...

Yep, same here, but to make them more "phone call friendly" rather than random pronounceable passwords I generate random two or three word phrases via sites like this: http://watchout4snakes.com/wo4snakes/Random/RandomPhrase

Will 1Password detect and autofill these or do you have to look it up?

I have to look it up. There's no way 1Password would be able to detect this. But I can look it up via the 1Password Mini window (the same thing you use to fill the password in the same place) so it's no trouble.

Verizon definitely does ask for account pin whenever I call in, usually entered via number keypad before you're routed to an actual person.

Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit.

[1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m...

[2] https://www.youtube.com/watch?v=caVEiitI2vg

[3] https://youtu.be/bjYhmX_OUQQ?t=98

Holy crap, watch video #3 it's worth it. She adds herself to the account by calling and asking.

Wow that really was crazy easy for her to do that. I guess it also taps into emotions with the crying baby as well.

I have many accounts that require a PIN. Many of them I set up years ago and have no idea what the PIN would be. I'm always able to talk my way out of it, though. (And this is not something I practice or know how to do well. I literally just say something like, "PIN? I have no idea. I don't even remember having the option to set one.")

Apparently, the PIN is opt-in.

>With Verizon on the phone, it was a fairly simple matter to re-reset the portal password, set an account PIN to prevent attacker re-entry and un-do the phone forward.

The problem is that the default PIN (which is what 99% of customers still have probably) is just the last four digits of the primary account holder's SSN.

Reply on news.ycombinator.com