News for hackers. Stuff that matters.

A comment on Look Up Unknown Phone Numbers Using Facebook Reset Password. Parent comment

Re:Look Up Unknown Phone Numbers Using Facebook Reset Password by anonymousiam on Monday January 04, 2021 @06:44AM (#25630118)
It subverts 2FA and SMS because of SIM hijacking. If a bad actor has your mobile number and you use that for 2FA, they can socially engineer (or bribe) a rep from your mobile company to assign your number to a new SIM/phone.

This is a common attack these days.

https://www.theverge.com/2019/5/11/18564381/community-hackin...

[ Parent | on HN ]
Re:Look Up Unknown Phone Numbers Using Facebook Reset Password by fckthisguy on Monday January 04, 2021 @10:52AM (#25632868)
To elaborate how easy this is:

I did this recently in my own number after loosing the sim card. I just called up the phone company and convinced the customer service agent to assign the number to a new sim card I had just bought from the petrol station near my house.

I provided no authentication for this and they had no way to prove I was the owner of the account.

Took all of 5 minutes to pull off.

[ Parent | on HN ]