News for hackers. Stuff that matters.
Re:The Most Expensive Lesson of My Life: Details of SIM Port... by bigiain on Tuesday May 21, 2019 @07:31PM (#19976220)
> I'll put your request in now but it will wait for 5 business days before it happens

This to me seems to be a complete misunderstanding of the telcos business and motivations. They sell mobile telephony - voice, sms, and data - and their _prime objective_ is to make it as easy as possible for their customer to spend as much money doing that as possible. Making you wait five days to get reconnected to "your number" when you have, for whatever reason, lost control of it is just not going to happen. They'll move mountains to get you back onto your data/voice plan before you've walked out of the store.

Nobody ever advertised their phone/sms plans as "banking grade secure". Telcos have been telling us for years that they are explicitly _not_ secure for that:

https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...

Communications Alliance chief executive John Stanton, representing the interests of mobile providers Telstra, Optus and Vodafone, took the extraordinary step of of declaring the technology insecure in the wake of numerous reports of Australians being defrauded via a phone porting scam first uncovered in Secure Computing magazine.

"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication," Stanton told iTnews this week.

Telcos are not interested in securing that, they get _way_ more complaints from people who lost/broke their phone who want their replacement one to work RIGHT NOW, than they do from people who got defrauded with a sim porting attack. And the first group of people are spending _way_ more money collectively than the second, so of course telcos will continue to make it quick and easy to sim port.

Everybody else needs to deal with that. While sms 2FA is marginally better than not having any 2FA at all, it's not the telco's problem if you choose to use it to "secure" your $100k worth of crypto. In my mind, a large part of the blame here goes to COinbase for even offering it. I'm also looking at your PayPal...

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by RachelF on Tuesday May 21, 2019 @08:35PM (#19976609)
Yes, Paypal is bad, they took away their support for the Symantec 2FA codes and forced users in many countries to use SMS instead.

This is pretty easy for the telco to prevent, though. Your existing telco should simply phone you and ask if you wish to leave them before letting the number get ported out.

Note that all telcos will prevent the number being ported out if you owe them any money on the account.

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by mehrdadn on Tuesday May 21, 2019 @10:20PM (#19977162)
> Note that all telcos will prevent the number being ported out if you owe them any money on the account.

Wait really? Is there a way to force yourself to perpetually owe them a small amount of money then? Could be really worth the money.

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by Spare_account on Wednesday May 22, 2019 @02:41AM (#19978427)
This wouldn't prevent a SIM port attack (which is what occurred in the article). You don't leave your provider so account status isn't a factor.

The comment you replied to appears to be discussing porting a number to a different provider which is very different and doesn't happen same-day.

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by cortesoft on Tuesday May 21, 2019 @11:59PM (#19977643)
An attacker could just pay the balance.
Re:The Most Expensive Lesson of My Life: Details of SIM Port... by mehrdadn on Wednesday May 22, 2019 @12:06AM (#19977677)
Seems like a decent hurdle to make an attacker jump through? Given they'd want the payment to be untraceable etc.
Re:The Most Expensive Lesson of My Life: Details of SIM Port... by Spare_account on Wednesday May 22, 2019 @02:28AM (#19978353)
You appear to be discussing porting a number from one provider to another but the attack in the article (and being discussed in the thread up to this point) is based on moving the number to another SIM within the same provider).
Re:The Most Expensive Lesson of My Life: Details of SIM Port... by mehrdadn on Tuesday May 21, 2019 @10:19PM (#19977156)
> While sms 2FA is marginally better than not having any 2FA at all

I used to believe this too. Until this morning. Then I realized something and now I'm not so sure: if I don't have SMS 2FA at all, then my phone line is less to become an attack target. Meaning I'm less likely to have to deal with the collateral damage of lost accounts, files, etc. So is it really better to have that SMS 2FA? Especially if you weren't ever having problems securing your stuff before it came along?

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by antoinevg on Wednesday May 22, 2019 @03:08AM (#19978597)
Thank you. I've been waiting years now for someone else to notice this as well.
Re:The Most Expensive Lesson of My Life: Details of SIM Port... by mehrdadn on Wednesday May 22, 2019 @06:41AM (#19979732)
Good to know! I feel like it stems from the notion that protecting whatever particular account they want you to protect must be the most important priority in your life. Even security folks don't always seem inclined to think in terms of trade-offs... too often they seem to see things as black and white. If something protects your account or computer better then it must be better and you have to do it. They don't care if you might lose your job or if it might burn down your home as a side effect; that's just not part of their threat models...