Hacker News Reader

Comment by danielvf | Hacker News Reader

> To gain unauthorized access to T-Mobile’s protected internal computers, Khudaverdyan obtained T-Mobile employees’ credentials through various dishonest means, including sending phishing emails that appeared to be legitimate T-Mobile correspondence, and socially engineering the T-Mobile IT Help Desk. Khudaverdyan used the fraudulent emails to trick T-Mobile employees to log in with their employee credentials so he could harvest the employees’ information and fraudulently unlock the phones.

> In total, Khudaverdyan and others compromised and stole more than 50 different T-Mobile employees’ credentials from employees across the United States, and they unlocked and unblocked hundreds of thousands of cellphones during the years of the scheme.

> Khudaverdyan obtained more than $25 million for these criminal activities.

View on HN

> Khudaverdyan obtained more than $25 million for these criminal activities.

I wonder how much economic value he created for “hundreds of thousands” of consumers by removing T-Mobile’s artificial restraints on competition.

It's funny how little we think about it like that. Harming corporate profits in many cases means we've reduced friction and improved total economic efficiency.

But yeah, obviously hacking the telecom is a no-no.

"Harming corporate profits" seems like a weird spin, considering locked phones are typically on long-term contracts that subsidize the purchase price. If you buy a lease-to-own car, then stop making payments and go to a different auto dealership is that just "economic efficiency?"

your analogy doesn't work because cars aren't locked to dealerships. If the dealer controlled how you used your car and restricted what you did with your car via some sort of artificial software limitation within the vehicle, then removing that limitation would also be a good thing.

Not OP but imagine a more direct anlogy:

If cars dealerships also owned their own network of fuel stations. They sell you the car for cheap but require you to use their network of expensive fuel stations for x years. The cars have an encrypted chip that detects if its connected to the specific approved gas station when filling. Now if you try and sell it there is no real market because the buyer can only use it at the specific dealerships gas network and that dealership could also lock that buyer out if it chose.

Now someone has gained access to the car dealerships database and unlocked a bunch of cars for a fee. Is that good or bad I donno.

I think the important thing to remember is that whatever "artificial software limitation" is imposed on the phone was done so with the knowledge of the person signing the contract when the phone was leased. At least I have to assume it is called out in the contract.

Even in the GP post its not "your" car. You don't "own" the car when you lease-to-own you are renting it under a contract which gives you very specific right to "own" the car at the time of your last payment or when you are able to pay it in full. Ownership is determined by the name on the Title Certificate which would be in the dealership's name until you make the final payment or pay it off beforehand in full.

Here's a better analogy:

A group of fraudsters goes into dealerships with stolen identities and attempts to finance $0 down cars so they can export them to West Africa and make a fortune because they are not ever going to pay for the cars. Only some dealers have "kill switches" (look it up) that they use to remotely brick cars they stop receiving payment on. So someone like Khudaverdyan comes along and offers a kill switch disabling service so the cars will still work after the fraudsters have moved them out of the country. I think most people would agree that is wrong.

“We” do not think about it like that because it has been many, many years since the US regulatory agency has required US mobile networks to unlock phones after the contract ends:

https://www.fcc.gov/general/cell-phone-unlocking

Unlocked phones have long been available for purchase, and no one is forcing anyone to choose to accept a mobile network subsidy in exchange for the lock.

There is no restraint on competition. Unlocked phones have always been available.

Locked phones are a heavily subsidized option that let the carrier make back their money on monthly service.

Given how many devices were involved, it's fairly likely that a substantial number of them were stolen. You don't get to "hundreds of thousands" of devices unlocked by helping out individual customers.

This sort of detail isn't going to be the focus of the DoJ press release because it's tangential to the case, and harder to prove than the (fairly clear-cut) unauthorized computer access angle. But it's in there -- notice the mention that the store owner's actions "allowed the phones to be sold on the black market", for example, as well as the prosecutor's statement that he "further[ed] the trafficking of lost and stolen cell phones".

> You don't get to "hundreds of thousands" of devices unlocked by helping out individual customers.

I don't doubt that there were stolen devices involved, but it's actually really easy for me to imagine finding a few hundred thousand customers who would pay for an "official" unblock so they can switch carriers.

Some numbers:

1. >50% of customers are willing to change their carrier

2. T-Mobile has 100M customers

Conservatively, this gives a TAM of at least millions, maybe 10s of millions, of customers per year. And he had, let's say, 500K, probably less, total customers over the years. So he was getting, what, 1% of non-phone-thief customers per year? Less? Easy to imagine getting there without working with phone theft rings.

these devices could also be stolen, or on longer-term contracts that subsidized the purchase price. Neither of these are artificial restraints on competition, especially considering all carriers play the same game.

What are you talking about?

Phones are locked while people haven't paid off the purchase price, generally across 2 years of installments that are combined with the cell service plan.

Unlocking them is straight-up theft -- it lets you use the phone without having paid for it.

This isn't something akin to pirating movies or cell service. It's straight-up getting hardware -- phones -- without paying for them. It's physical theft pure and simple.

Do the contracts not stipulate that if you cancel your service for any reason, you're on the hook for the remaining price of the phone? Surely if I didn't care about cell service and just wanted a pretty nice wifi camera, they're not going to let me sign up for a plan and then cancel it immediately.

Assuming they're not that dumb, I don't understand the point of locking.

Because pursuing someone for a debt is not the same as getting paid for it.

The lock on the phone reduces the risk of nonpayment from the borrower, and effectively allows for cheaper financing.

> The lock on the phone reduces the risk of nonpayment from the borrower

This seems pretty non-obvious to me. Maybe it reduces the incidence of straight-up theft, but if someone runs into financial difficulties and can't continue paying for service, they can get more on the used market with an unlocked phone and use that money to pay off the debt/exit the contract.

Obviously that's not an outcome the carrier wants, but now we're back to locking as a mechanism to keep people stuck to the carrier.

You're generally on the hook for the rest of your contract, not just the phone.

But if you just don't pay, what are they supposed to do? They send it to collections, which has a small recovery rate. It's far more effective to use the phone lock.

And the culprit here hacked into T-Mobile's systems to get around their procedures. I also wouldn't be surprised if he was being paid precisely by a lot of people who signed up for contracts and expensive phones with a stolen credit card and stolen identity.

> And the culprit here hacked into T-Mobile's systems to get around their procedures. I also wouldn't be surprised if he was being paid precisely by a lot of people who signed up for contracts and expensive phones with a stolen credit card and stolen identity.

These people (or the people who buy phones off them) are almost exclusively the major customers of any unlocking service, at least with iPhones. Which for some reason is something the rest of the people in this thread fail to understand.

He created economic value for a bunch of fences in Hong Kong and Dubai who buy and receive hundreds of millions of dollars of stolen phones that they can now get more money for because they are unlocked and the ultimate end user in China or Nigeria doesn't have to use a RSIM/Gevey SIM (modded SIM that tricks locked iPhones to use any carrier) to use the phone. This guy is no hero.

Reply on news.ycombinator.com