News for hackers. Stuff that matters.

A comment on Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol. Parent comment

Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by voltagex_ on Thursday May 04, 2017 @08:57PM (#14270336)
A lot of providers will block VoIP and SMS gateways being used as verification (see PayPal for an example).
[ Parent | on HN ]
Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by Nexxxeh on Friday May 05, 2017 @04:57PM (#14276788)
There's a guy that does an SMS to web gateway with real telephony hardware. You pay by bitcoin and its accessible over TOR. You pay, he pops in a topped up PAYG SIM. You have a real mobile telephone number.

You can run your own private one at home with a Raspberry Pi/ttl serial adapter and a cheap SIM module. Or use a dongle.

[ Parent | on HN ]
Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by derefr on Thursday May 04, 2017 @09:33PM (#14270478)
AFAIK you can get a number from a different carrier and then transfer it to the VoIP carrier. When queried, it will still show up as "owned" by the original carrier.
[ Parent | on HN ]
Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ... by toast0 on Friday May 05, 2017 @10:03AM (#14273482)
It depends on how they classify; numbers are issued in blocks of 1000, and the allocations are public knowledge, but you can also do a real time carrier lookup, which changes after porting completes.
[ Parent | on HN ]