News for hackers. Stuff that matters.
Re:SIM Vulnerability leads to information disclosure via mal... by Smoozy23 on Thursday September 12, 2019 @10:29AM (#20951841)
I don’t understand why to steal someone else’s phones? the main thing for what?
Re:SIM Vulnerability leads to information disclosure via mal... by heavymark on Thursday September 12, 2019 @12:51PM (#20953636)
Because then in most cases you bypass 2 factor authentication through sms for people's accounts. And then steal their social media handles or anything. Sites like Twitter only allow SMS 2 factor authentication, so currently no way to avoid the issue, which is why even the CEO was just hacked. One has to assume they are working on real 2 factor authentication. That will help people in the know stay protected, but the average person or simply enables sms 2 factor authentication will still be vulnerable until a company like Apple or something automatically offers 2 factor app for all sites that support 2fa.
Re:SIM Vulnerability leads to information disclosure via mal... by zucked on Thursday September 12, 2019 @01:02PM (#20953779)
I've been mitigating this vector best I can by associating any of my accounts that only offer 2FA via SMS to a Google Voice number / Google account that can only be accessed via Token/Backup codes.
Re:SIM Vulnerability leads to information disclosure via mal... by mises on Thursday September 12, 2019 @12:20PM (#20953292)
Sim-swap attacks, forging communications from some one (snag CEO phone; send message "wire ten million dollars now to china; we're acquiring a company!").
Re:SIM Vulnerability leads to information disclosure via mal... by mercora on Thursday September 12, 2019 @12:31PM (#20953420)
This is not about stealing someones subscriber identity but about having unrestricted access to some ancient looking software running on the sim card. TBH it looks like this is not really an exploit but working by design if access is actually unrestricted. SMS is used as an alternative transport for the software (S@T Browser) and apparently access should be limited to entities providing a 3DES key ... But i just skimmed over some documents so don't take my word for it ;)
Re:SIM Vulnerability leads to information disclosure via mal... by magashna on Thursday September 12, 2019 @02:29PM (#20954711)
Re:SIM Vulnerability leads to information disclosure via mal... by tmysl on Thursday September 12, 2019 @12:47PM (#20953591)
Leaked emails/passwords from exploited sites + the ability to do 2fa or trigger a password reset via phone verification. People's bank accounts, bitcoin exchange wallets, etc have been hacked like this.