Comment by seibelj | Hacker News Reader

Comment by seibelj | Hacker News Reader

Parent Full thread

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that.

Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key if you can.

The craziest one was two people at another firm were sending each other a lot of money, and sent the address over Telegram. The hacker manipulated the address in the message - they checked after the (failed) transaction and the address sent was different than the address in the message received! I think the most likely cause was that the receiver's computer was rooted and the application itself was manipulated on the device, rather than the message contents changed en-route. This is why I recommend both visual and audio confirmation when sending large amounts.

I know of a number of oil companies who had tens, if not hundreds of millions of dollars stolen in 2016. Their accountants were spear phished and their outboxes were closely monitored. When an outbound invoice was sent the email was caught and then altered to show the fraudsters bank and routing numbers. Oil companies are notoriously slow to pay (and frequently take lots of nudging to get a payment out) so the payment never showing up didn't seem out of the ordinary.

It was all kept hush hush to prevent copycat attacks. It took intervention from the FBI and a big netsec firm to even figure out how it had happened.

OK, time to write an article and submit here. That sounds way too interesting for just a comment!

Why are the phone companies not responsible for swapping the number over?

In a similar vein, I've known people who had unsigned checks stolen and their signature forged very poorly. The banks are supposed to check the signature, so why aren't the banks liable?

> The banks are supposed to check the signature,

Actually no, not anymore after the "Check 21" act. They're not responsible for verifying any aspect of the check. Kind of a crock.

The phone company is giving you a phone number, it doesn't want to be responsible for providing security for your financial and private life.

Yes, it's really quite amazing to watch all companies including the US government pretty much task the mobile networks with providing plausible deniability that they verified your identity. They get to point to the mobile networks (or you) if there's a problem, and the mobile networks get to say, legally, it's not their problem...because it isn't.

(Googler, opinions on my own)

This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.

Unfortunately Google Fi has its own set of issues that make it unpalatable as a primary mobile phone service: https://onemileatatime.com/google-fi-review/

I believe this is around when Google Fi expanded to support iOS? I think there were some admitted growing pains around that time, and they've worked to improve it since then. Hard to say.

> This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps.

Are you sure that this is the case? According to https://support.google.com/fi/thread/761170 there was at least one case where support agents moved a Fi number from a locked account to a newly reopened account, without the user being able to access the locked account:

> I call Google Support and the amazing Google Support rep I spoke to (The only good one I’ve talked to so far during this whole process) stayed with me for over an hour and worked with tier 2 support in getting my Project Fi number transferred to Account 2.

A SIM swap with Fi might be harder to accomplish than with a regular provider, but it looks like there's still the risk that someone manages to convince a support agent to move the number to a different account.

What happens when Google spontaneously bans your account for no reason?

What do you think happens?

Having unempowered customer support agents may mean customer support agents can't take over your account, and can't be social engineered into taking over your account. But it also means people who only have a phone and lose it with the sim and also don't remember their password (perhaps because it's never prompted for) are going to have a hell of a time getting their account back.

Is there a guarantee that Google won't add this feature in the future? What if people lost their phones etc.?

I think the risk is too big. Use U2F, or something similar.

If you lose your phone you simply contact customer support to mail you a new SIM card (Not sure how it works with eSIM, but I assume something similar)

I'm guessing this likely also applies to a Google Voice account phone number.

What happens if the SIM is damaged, lost, or stolen?

I was also the victim of a T-Mobile SIM swap back in February.

My assumption is that the attackers target individuals that have a high likelihood of owning bitcoin or other digital currency. This can be easily determined by looking at data breaches, and targeting emails that are found both on a cryptocurrency breach and a personal information breach with phone number, name, address, and anything else that would help impersonate the victim.

They accessed my insecure email with SMS authentication, but everything else was locked down more securely. Also, since that day I have been getting 20 times more spam calls and texts, I'm guessing they added my number to some other targeted list.

I SIM swapped myself twice on Sprint without authorization at an Apple store. Sales reps can generate a one time code for Sprint Support that allows them to bypass some of the IVRs and prove the call is coming from an Apple Store. Sprint support won't ask for a PIN or SSN. Just the line's number. Bam!

How many people can do this? See those mom and pop "authorized resellers" at the mall? Yeah.

When someone stole my identity and opened up 8 lines they did it all at “authorized reseller” phone booths. I believe it was at a Costco.

AT&T still let them order 4 new lines on a new account even though I already had an account with 2 lines.

> This can be easily determined by looking at data breaches, and targeting emails that are found both on a cryptocurrency breach and a personal information breach with phone number, name, address

... and this is why you should never use your identity for these things.

KYC is a security liability.

Happened to one of my friends who was also on T-mobile and had some bitcoins at some point. They got into his email and coinbase account, but he was holding any bitcoin so they tried to buy some which was declined by the credit card.

Reply on news.ycombinator.com