Hacker News Reader

Make sure your big $$$ are not available easily. Find a bank/brokerage that will actually do their job verifying you before they dispense your money.

You are not able to defend yourself from targeted attacks. Period.

It is one thing to try to defend from attacks of opportunity (ie. viruses, ransomware, etc.) and another from people who actually know their job and for some reason find yourself attractive target.

Thus, the best way to respond is to not make yourself attractive target in the first place and if you need to have attractive things somewhere -- separate them from everything else.

Putnam investments are really hard to get money out of. For example, I tried to cash in an annuity, and it required a medallion certificate by another bank. A medallion certificate is like a notary but is only done by another bank.

Depends how motivated the attackers are. They can try to find another bank with weaker rules, perhaps open an account there first.

I needed one of those things, and shopped around for a bit. And while all the big names would refuse, had waiting periods, fees, other requirements, a local credit union gave me one after signing up for a savings account immediately with a minimal or no fee.

>Depends how motivated the attackers are. They can try to find another bank with weaker rules, perhaps open an account there first.

That isn't really incentivized in this case. Assuming by medallion certificate they meant "medallion signature guarantee" [0] as established by SEC Rule 17 Ad-15 [1], a core part of the system there is that the financial institution granting it accepts liability for any forgery, up to a specified prefix amount (and the transaction will be rejected if the stamp isn't enough to cover the transaction amount). So if they "find another bank with weaker rules" who gets them to issue a stamp for a few hundred grand they are on the hook for that loss.

As a result, it's actually taken pretty seriously at least for significant amounts of money. This specific area isn't one where the guarantor gets to shrug their shoulders about it. Since they're going to be on the hook for hundreds of thousands to millions if they get it wrong, you need to be a known, established customer to even try, go in person, and someone higher level is absolutely going to looking at it personally. And even if an attacker did get past all that, the whole point is the one being attacked still hasn't lost anything.

>a local credit union gave me one after signing up for a savings account immediately with a minimal or no fee.

What prefix though? How did you check out in terms of signup (long history as resident? local connections?)? Lots of stuff goes on behind the scenes. An F alpha prefix ($100k surety, credit union) isn't the same thing as a Z ($14 million surety).

----

0: https://www.mybanktracker.com/blog/investing/medallion-signa...

1: https://www.law.cornell.edu/cfr/text/17/240.17Ad-15

Yes, exactly I meant medallion signature guarantee thank you sorry I didn't use exact terminology.

> That isn't really incentivized in this case.

Some smaller credit unions or local banks are less rigorous it seems and that incentivizes whoever wants to steal the money to go there with a fake ID, bills, etc.

> What prefix though?

F. Still a nice chunk of money for someone to steal. I guess, what I was surprised about was how different the rules were. Some quite strict, at large institutions, some pretty lax.

> How did you check out in terms of signup (long history as resident? local connections?)?

Called around and visited a few banks in the area. Not sure if / how they checked the history as a resident? There was no prior relationship with that particular credit union. As you say, perhaps behind the scene they did a rather thorough background check, but it just didn't feel that way at all based on the context.

Give written instructions to your bank requiring them know to engage in transactions over a certain amount without a certain set of verification procedures (for example a call back with a prearranged password for any wire was one that I had with my old bank), and have them acknowledge receipt in writing as well. In the unlikely/unfortunate event that your money is stolen - recouping from the financial institution will be more straightforward if they didn’t follow procedures and you can prove it.

What typical retail bank allows you to set such kinds of custom procedures?

I'm curious about that too, but don't forget you can talk to your banker directly without going through a random commenter on the internet. :)

I'm pretty sure my bank won't do that though, since I'm currently mainly using an online-only bank.

Arguing from first principles, the first step in detecting a problem is to know your device's baseline operation. This means knowing the bevvy of processes that are running, the resources they use, and the messages they send and to which hosts. With this baseline, you can now see if something is going wrong - a process you don't recognize, connecting to hosts you don't recognize, and so on.

Of course, this is also the step where almost everyone, including devs, fail. How many devs know their phone to this degree? Even for our laptops, we tend to give way too much leeway to 3rd party binaries, and allow the environment to get so noisy that any kind of signal is impossible to detect. It's a depressing trade-off we (almost) all make for convenience, using the (almost) good enough assumption that we're safe in the herd. It's actually a very, very dumb assumption and I feel like it's something of a hacker golden age because of it, and as long as they don't get too greedy and spook the herd, the gravy train is here to stay.

On argument against doing even this is that a hacker can take steps to hide their process. This has happened on PCs, with rootkits that hide certain processes. This may happen for phone malware, if only to make it harder to automate detection and removal, if not to guard against watchful users (of which there are precious few).

In terms of capability, I speculate that the best an attacker can achieve is a sticky, privileged process that accepts arbitrary commands at runtime, which can be used to read the disk, analyze other running processes, install and exfil sensor data, etc. From the attacker's POV for high value targets, it probably feels like ssh'ing into a mystery box, and "see what you can do" - and they probably have a (growing) library of scripts to check for easy, juicy things. (I would guess that they would hate to see bespoke applications that have to be understood and reversed to get value out of.)

>In terms of capability, I speculate that the best an attacker can achieve is a sticky, privileged process that accepts arbitrary commands at runtime, which can be used to read the disk, analyze other running processes, install and exfil sensor data, etc.

The worst-case scenario would be if the attacker somehow manages to rewrite your motherboard and/or SSD's firmware with a malicious firmware. And even if you reinstall your OS - he still manages to re-install the rootkit afterwards. I've only read about such type of malware but never have I seen or heard of anything like that in the wild.

And this is why I hate this whole mobile app thing. Sure show me the data, but for any actual transfer action I much prefer having to use the old fashioned one-time password list. At least then they need multiple things and it is not remote.

I have a separate phone specifically used for banking (since banks require me to install their 2fa app on my phone) and have a unique sim card that I only use for banks.

It's not 100% foolproof I guess but at least it reduces my risk.

Ah, i see SMS and account insecurity has increased the telecom’s revenue.

The security lapses will only get worse.

That's entirely true, but then again, that second sim card costs me 20 usd a year, so it's a cheap insurance.

What provide if in America may I ask? Cheapest non voip I've been able to find is 120/yr

Check US Mobile. I haven't used them, but I've noticed when shopping for cheap plans that they let you build a plan that's really cheap if you don't need much.

thx

If you care about this, consider using a security-oriented OS on desktop based on hardware virtualization: https://qubes-os.org. In this case, if you use your phone only to confirm the transactions (as the second factor), you should be safe enough.

How can you prove that this is more secure against state level actors than iOS which have billions (?) of users? In modern phones there are multiple levels of sandboxing already. If some state really wants to target you, I would say that this is more insecure solution.

The most common OS are very heavily tested because of the user amount. These "secure" operating systems have niche amount of users which further reduces the amount of testing. And this is the only helping factor you - it is more beneficial to target operating systems which have a larger adaption. You need to be on high priority that they start developing exploits only for you who is using some random OS.

> How can you prove that this is more secure against state level actors than iOS which have billions (?) of users?

By comparing the number of exploits? Qubes relies on Xen, which is used by very big targets, so should be under constant attacks. Qubes uses hardware (VT-d) virtualization, which AFAIK was last time broken by the Qubes founder in 2003: https://en.wikipedia.org/wiki/Blue_Pill_(software).

> By comparing the number of exploits? Qubes relies on Xen, which is used by very big targets, so should be under constant attacks

This is often giving quite misleading conclusions based on what I just said - iOS for example is much more popular and heavily tested - of course the amount of exploits is much larger, because it is also much more interesting target as many are using it.

How many people are using phones/laptops which are based on Xen? Xen is commonly used on server side - not by those guys who are holding the interesting stuff on their personal devices.

> Xen is commonly used on server side - not by those guys who are holding the interesting stuff on their personal devices.

AFAIK server side is often even more interesting for hackers as it's connected to big money.

I would argue that iOS is more dangerous because we can be fairly certain that it's not only vulnerable to exploits like Pegasus, but also phones home to FIVE EYES on a regular basis. Qubes is vulnerable to neither of these attacks, and it's architecture is explicitly designed to isolate all components of the system with hardened hypervisor technology used by the most high-security servers in the world. For the most part, you don't even have to trust the device you're running Qubes on; the isolation technology is that robust.

If you are super paranoid, ask your bank to disable all remote access to your account and go into the branch in person when you want to do something.

This might be too high level of paranoia for me (and I run Qubes as a daily driver).

What kinds of bank accounts are not subject to allowing outbound ACH transfers? It is my understanding that if you have a bank account (checking) or even brokerage accounts, they can be withdrawn with ACH.

The capabilities depend on the specific exploit but if you're dealing with something like Pegasus, the answer is yes to almost all those questions.

> I wonder if there is some resource where people can read about how to detect and avoid such exploits and protect against them?

Protecting against the cutting edge of current nation-state attacks [1] is... well, it's not impossible but it's up there. Just don't be important/interesting enough to catch their wrath is the TL;DR.

That said, see: https://docs.mvt.re/en/latest/introduction/

[1]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Open two more accounts at your bank. Code the first accounts as "deposit only", automatically reject any withdrawal requests against that account. Code this account for sweep to the second account every night. Activate positive pay[0] on the second account. Do not ever give anyone access to the second account. Code the 3rd account for positive pay. That's the only account you are going to withdraw the money from.

Stop using debit cards. Only use credit cards. Pay them via positive pay from the 3rd account.

Stop using pull. Only use push. Only target the 3rd account with positive pay as the source of funds.

You should look at family office setups anyway. It used to be something that was done at 100M level but these days the services became cheap enough that it makes sense at 10M level.

[0] Switch to a bank that supports positive pay for all electronic transactions.

When I received a huge amount of cash some years ago, my outlook changed completely. The first thing to do was to split the money in order not to keep everything in one basket. I choose banks with unvieldy, problematic protection schemes that are awkward to use. And I set up a dedicated old laptop for banking (which still works).

My biggest paranoia wasn't about remote access though. I was really afraid someone could counterfeit my ID and just cash out as much as they could get away with. Fortunately, it hasn't happened to me.

Someone who has access to Pegasus is not going after finances. I had modest amount of ethereum on my PC, was hacked, but I still had control over my wallet.

If you have $1M+ it should not be tied to your sim card, GMail account etc... If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups!

> If you use the same device to access your bank accounts, and to browse internet or receive messages, you are like an idiot who does not do backups!

Using ones phone for banking, internet, and sms is completely normal. Saying that 99.9999999999999999% of the world population that owns smartphones is an idiot isn't helpful.

The idiots are the governments of the world that haven't sanctioned Israel for allowing the continued trade of these cyberweapons by their citizens.

"99.9999999999999999%" of the world are not high-value targets with > $1M USD in assets.

> The idiots are the governments of the world that haven't sanctioned Israel

Sanctions against Israel are not going to make vulnerabilities and risks go away. It will just make life harder for a single provider.

In that case, the majority of the people in the world with more than $1MM are idiots.

The advantage of centralized services tied to your clear identity is that they do some diligence to ensure the person accessing your account is actually you. You (often) even have a reasonable recourse to undo things that have been done fraudulently.

So you mean for example, you keep your Authenticator app on a device completely separate from your phone / disconnected from the internet?

2FA is a good option for securing your centralized accounts. But unfortunately, if you're logged in on your phone and your phone is hacked, well, it's still game over.

For crypto currencies it may help to store them on a hardware wallet, since accessing your money will require explicit interaction. But, as far as I understand (please correct me, not up to date with the security mechanisms of hardware wallets), if your computer is compromised while doing it, you can still lose it.

> if your computer is compromised while doing it, you can still lose it.

The hardware wallet itself has a screen, and requires you to confirm your transactions, so generally not true

Just for people who don’t know, it’s shows relevant data regarding the transaction: Sum, currency, target address.

Now, if you verify that data, you are safe… if the original address was correct. But as we are talking about a sophisticated targeted attack, where did you get the original address from? Because if it was your phone or your computer, we are back to step one, as that might already be manipulated.

Haha.

It’s regular government employees who get access to Pegasus. I’d be shocked if it had never been used in an unauthorized manner for straight up financial crimes.

It's actually easier for an attacker on desktops/laptops. Phones have excellent sandboxing and defenses by comparison.

The ideal attacker would find a way to silently steal a credential (e.g. session cookie) from your phone, then use it on a different device. That's not going to be something that makes a lot of noise on your device itself.

Once an attacker has gained root access to the device they can:

1. Access any data on the device regardless of application security (including applications that may request a separate password be entered as this password entry can be captured). This access includes logging into web services (e-mail included) pretending to be your phone and downloading or manipulating information stored or transmitted by the service.

2. Enable the microphone and cameras at any time.

3. Track location at any time via enabling GPS or monitoring for nearby WiFi, Bluetooth of cell tower device IDs.

4. Modify the user interface to report incorrect status, for example, incorrect battery level, GPS disabled when it's really enabled, incorrect data transfer amounts, etc.

5. Connect to other devices via WiFi or Bluetooth and interrogate them to find other devices or people nearby, and potentially attack those devices too.

An attacker can achieve similar outcomes with root access into other electronic devices--laptops, tablets, desktop computers, watches, TVs, WiFi-enabled LED light bulbs, home appliances, cars, etc. Obviously what can do with a device depends on the sensors contained within (must have a camera sensor to secretly take images or video).

Unless the attacker is reckless with turning on the video camera, microphone, GPS, WiFi, Bluetooth, etc all at once and draining battery much faster than expected, or transferring large amounts of data, you generally wouldn't notice anything different about your device. You would also probably have a hard time actively detecting the attack as the implant would be constantly watching for signs of debugging/investigation and disable/delete itself in such situations.

Generally the implant would be non-persistent only residing in volatile memory of the device that would be forgotten soon after the device is powered down. Regardless of persistence, capturing the implant from the device would be very difficult and expensive to perform for an individual, but within reach of a state actor or security researchers with a lot of time on their hands to accomplish should they have the patience.

It an implant were to be persistent and survive a device reboot, you could rapidly turn off the device (physically cut power from the battery), desolder the non-volatile memory chips and recover data similar to the process shown in [1]. There would be more steps involved if the device is encrypted (for example key is held in a TPM) but as you know the password to unlock the device, you could just ask the TPM nicely to give up the key. Failing that, there is FIB editing or other attacks against TPMs to recover keys. See [2] and [3] for some examples.

To detect a non-persistent implant, you'd follow a similar process but would have to quickly cool the volatile memory chip (see [3]) and then cut lines to the chip and insert new probes instead of desoldering it (the heat from desoldering would result in the volatile memory being cleared too quickly). Apple's Secure Enclave processor, as an example of a growing trend, encrypts and decrypts blocks of data stored in and retrieved from volatile memory so you'd additionally need to attack the Secure Enclave processor to retrieve the required keys to decrypt the volatile memory with.

The irony is that same security features which are designed to keep your device secure also inadvertently makes it prohibitively time consuming and expensive to inspect your device to detect a hidden implant in use. If you're concerned you could be a target (investigative journalists for example), the best approach is probably to assume the device is always compromised and use non-technological approaches to avoid or frustrate an attacker. Or perhaps you could find security researchers who'd love nothing more than finding and unraveling the secrets of a sophisticated implant (see [5]).

[1] https://www.youtube.com/watch?v=nXDUhhyY2rE&t=133s (recover data Samsung Galaxy directly from phone memory | HDD Recovery Services)

[2] https://www.youtube.com/watch?v=-vnik_iUuUs (Exposing The Deep-Secure Elements Of Smartcards | Christopher Tarnovsky | hardwear.io USA 2019)

[3] https://www.youtube.com/watch?v=M46Ol4gltbI (Focused Ion Beam TEM Lamella Prep Tutorial | Nicholas Rudawski)

[4] https://www.youtube.com/watch?v=Ej-Nr79bVjg (Cold Boot Attacks on Encryption Keys | J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten | 17th USENIX Security Symposium 2008)

[5] https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...