News for hackers. Stuff that matters.

A comment on Look Up Unknown Phone Numbers Using Facebook Reset Password. Parent comment

Re:Look Up Unknown Phone Numbers Using Facebook Reset Password by usr1106 on Monday January 04, 2021 @03:26AM (#25628875)
Here in Finland many if not most mobile phone numbers are in the phone book. Well, no physical book has been printed for years, but you can call directory enquiries or look them up online. Even reverse look-ups are possible. (Only an ever shrinking minority of households still owns a landline.)

How exactly would that subvert 2FA via SMS? Except for calling and ask please read the SMS you just received for me. While that will work with some people, I am not worried in my case.

[ Parent | on HN ]
Re:Look Up Unknown Phone Numbers Using Facebook Reset Password by anonymousiam on Monday January 04, 2021 @06:44AM (#25630118)
It subverts 2FA and SMS because of SIM hijacking. If a bad actor has your mobile number and you use that for 2FA, they can socially engineer (or bribe) a rep from your mobile company to assign your number to a new SIM/phone.

This is a common attack these days.

https://www.theverge.com/2019/5/11/18564381/community-hackin...

[ Parent | on HN ]
Re:Look Up Unknown Phone Numbers Using Facebook Reset Password by fckthisguy on Monday January 04, 2021 @10:52AM (#25632868)
To elaborate how easy this is:

I did this recently in my own number after loosing the sim card. I just called up the phone company and convinced the customer service agent to assign the number to a new sim card I had just bought from the petrol station near my house.

I provided no authentication for this and they had no way to prove I was the owner of the account.

Took all of 5 minutes to pull off.

[ Parent | on HN ]