Hackers Have Stolen Millions of Dollars in Bitcoin Using Only Phone Numbers

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by gregschlom on Tuesday February 07, 2017 @06:42PM (#13594166)

Another thing to keep in mind is that most phones will display the content of SMS messages on the lock screen, even if the phone is locked. That means that if your phone is stolen, hackers can easily take control of accounts such as PayPal that use SMS verification as the only way of establishing one's identity.

This exact scenario happened last week to a friend of mine, I wrote a little article about it: http://gregschlom.com/misc/2017/01/29/hacking-paypal-account...

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by alexdumitru on Tuesday February 07, 2017 @07:58PM (#13594676)

That's one of the first things I setup on my Android phones. You can see that I have notifications, but not their content.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by atom-morgan on Tuesday February 07, 2017 @09:02PM (#13595037)

I would guess a surprisingly large percentage of smartphone users aren't aware this is an option.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by franciscop on Tuesday February 07, 2017 @08:21PM (#13594830)

Exactly the same here and I am sure any privacy-aware person will do the same.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by djsumdog on Tuesday February 07, 2017 @09:31PM (#13595180)

That really needs to be the default.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by ReverseCold on Wednesday February 08, 2017 @01:19AM (#13596225)

On Android, it asks you when you set your passcode for the first time.

Super fragmented, but Nexus 5X had it.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by emiliobumachar on Wednesday February 08, 2017 @04:40AM (#13597040)

My Sony Xperia also asked me at lock screen configuration. I could choose either way, but could not ignore the question.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by alexdumitru on Thursday February 09, 2017 @07:26PM (#13612310)

Galaxy S7 asks you too. I remember now that you said it.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by Philip_with1L on Thursday February 09, 2017 @10:34AM (#13607596)

Agreed. It's usually buried in the device settings and also in Messenger and Hangouts. Signal gives you a few different options as well. But it should be more visible to all users, not just those of us that dig through settings.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by captncraig on Tuesday February 07, 2017 @09:32PM (#13595182)

But if you have the phone can't you just put the sim in another phone and read texts?

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by et-al on Tuesday February 07, 2017 @11:15PM (#13595699)

In countries outside the US, SIM cards generally require an unlock code when inserted into a new device.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by rahimnathwani on Wednesday February 08, 2017 @12:45AM (#13596104)

I've had SIM cards in 10+ countries outside North America. None of them came set to require a PIN on startup. I had to enable it.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by SmellyGeekBoy on Wednesday February 08, 2017 @06:34AM (#13597495)

FWIW, I'm in the UK and this is the first I've heard of this.

[ Parent | on HN ]

Re:Hackers Have Stolen Millions of Dollars in Bitcoin Using ... by hunter2_ on Tuesday February 07, 2017 @11:59PM (#13595884)

True, but possession per se, even if unauthorized, is what a "something you have" factor is all about. Adding a knowledge or biometric factor on top (your phone's unlock mechanism) is a bonus.

Granted, the unauthorized porting issue makes it a faulty possession factor in the first place.

[ Parent | on HN ]