Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by ImuMotive on Friday August 20, 2021 @04:04PM (#28250771)

It happened to me. Cellular carriers, in my case T-Mobile, didn't require any confirmation to port a number to a new phone/sim.

Eventually some required the last 4 of your social security number to port a number, which we all know at this point are pretty much public anyway.

T-Mobile now lets you set an arbitrary pin, which my parents promptly set to their DOB :facepalm:

I haven't looked more into it, but as far as I know, sim swap/port attacks were hilariously simple to execute which is why I only use SMS verification when it's the only option.

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by Wowfunhappy on Friday August 20, 2021 @04:53PM (#28251292)

You might want to edit out what your parents set their pin to! (You can email [email protected] if you're past the edit window.)

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by ImuMotive on Friday August 20, 2021 @08:04PM (#28252773)

Lol, I had made them change it as soon as they told me.

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by joshuaissac on Saturday August 21, 2021 @07:55AM (#28256240)

Maybe what is needed is regulation that makes the service provider liable (with no option to disclaim it) for all damages suffered by the victim if the provider gives away their phone number to an attacker.

[ Parent | on HN ]