> It would be good to know more details of the hack itself.

Not much but there's this article from the ABC (Australian Public Service broadcaster) https://www.abc.net.au/news/2022-09-23/optus-rejects-claim-h...

QUOTE STARTS

"[They] wanted to make integrating systems easier, to satisfy two-factor authentication regulations from the industry watchdog, the Australian Communications and Media Authority (ACMA)."

The process allegedly involved opening up the Optus customer identity database to other systems via what's known as an Application Programming Interface, with the assumption that the API would only be used by authorised company systems.

QUOTE ENDS

Also this one https://www.theregister.com/2022/09/23/cyberattack_optus/ although it's six days old.

This is a summary of the statements made by Optus https://whirlpool.net.au/wiki/optus_sept_2022_breach .

There's been some chatter on Twitter that at some point an Optus flack characterised the attack as "sophisticated" because the attackers "used Postman" so that's obviously caused a few laughs https://twitter.com/search?q=optus+postman+until%3A2022-10-0... .

Why does a phone company store a customer’s passport number?

And this is why they should be made to pay for it.

Companies should only collect data that they really need. One way to encourage this behavior is to punish them when a breach happens based on the amount of data they collect.

A data breach on a service that only has an email address on it matters a lot less to me than one that has my name, phone, address or picture of my id.

> Companies should only collect data that they really need.

Collecting and keeping this data is a regulatory requirement for Optus.

The problems with this breach have their roots in how identity is proven and verified in Australia. Far too much relies on possession of a physical document.

in America i usually prove identity for postpaid services with something like a utility bill which is at least not a government id document. i understand a telco wants some identity before extending credit for any postpaid plan but can y'all not do the same?

You can see Optus' ID requirements here: https://www.optus.com.au/for-you/support/answer?id=9438

Here are the ID requirements for their major competitor, Telstra: https://www.telstra.com.au/support/account-payment/id-check-...

These are legislated: https://www.legislation.gov.au/Details/F2022L00548

To have an account with Optus, you need to provide a Primary ID such as an Australian Drivers Licence or current passport. (See: https://www.optus.com.au/for-you/support/answer?id=9438) They probably kept it on file, instead of verifying and discarding, potentially due to regulatory requirement.

My understanding is that it's a regulatory requirement, the Govt wants to know who specifically owns what SIM. If I remember right, this was introduced post 9/11. I may be spectacularly wrong on both fronts, though!

You are correct, but I’m pretty sure for prepaid services under a low threshold (4 SIMs?) a bank card is sufficient.

That doesn’t stop these companies just going for the big ID though, and for postpaid they are offering credit and will definitely require 100 points of ID.

That's news to me. I've purchased two prepaid sims in Australia within the past ten years and each time a passport or driver's licence was required.

Actual law is here: https://www.legislation.gov.au/Details/F2017L00399/Html/Text... and you can see what Amaysim requires here: https://www.amaysim.com.au/help/mobile/getting-started/accep...

The ACMA determination is pretty hard to parse unfortunately.

Yes, they claimed they needed it to stop terrorism.

Then they detained an innocent person for the longest time without charge in recent history, including solitary for 23 hours per day, and not letting him access legal advice or contact his family, because terrorism.

https://en.wikipedia.org/wiki/Muhamed_Haneef

From memory, you could get a prepaid SIM without an ID well after 9/11. I think it was introduced to get rid of burner phone SIMs back when SMS was still a thing.

wait y'all can't get burner phones in aus? how do y'all make private phone calls or send private text messages if you can't dispose of the number after?

Most countries in the world require some form of ID to activate a new SIM card. The justification is usually that "burner phones are for terrorists and criminals". In US, for example, Faisal Shahzad is often cited as an example.

https://www.comparitech.com/blog/vpn-privacy/sim-card-regist...

US Senate tried to pass a similar law back in 2010. Bill sponsors were Chuck Schumer and John Cornyn, in case you ever see those names on your ballot.

damn, i'm really sorry for y'all, that's authoritarian ash ngl. i hope y'all's laws get fixed and thanks for calling out schumer and cornyn.

Imagine if people could talk to each other without the government knowing. Complete anarchy!

And why is it stored in clear text. And why was it exposed to a regular API. And why was real data being used on a dev API. And why wasn't that API secured at all?

These are all really good questions.

The answer for pretty much all of these are "woeful incompetence".

Knew a guy who used to work for Optus, he said their business SIP service was constantly getting hacked and their strategy for dealing with it was just to eat the losses and give out account credit like water, because their infrastructure was so outdated and poorly designed that it was functionally impossible to secure.

Honestly, Ausgov should rip Optus to shreds for this... not only for the data breach specifically, but also as a critical infrastructure operator they should be held to a far far higher standard than an ordinary business.

Why was unscrubbed customer data being used in a dev system that was connected to the internet at all.

Perhaps they wanted test data similar to their Prod data.

So obfuscate the data before exporting it.

... or don't connect it directly to the internet.

Well, both sides of politics are talking about updating the privacy act with a significant punitive component, and it can always be made retroactive if Optus is not feeling sorry enough.

I would like to know why the alleged hacker backed down, stating that they have withdrawn the ransom request and deleted the stolen data.

It sounds like a convenient caveat to an agreement to pay ransom to the hackers, and I wouldn't put it past a big company here in Australia to pull that kind of PR trick.

We live in the Lucky Country after all, I doubt we'll ever know the truth.

Probably someone at ASD called the kid responsible at home and had a polite and friendly chat. Might have told him to make his bed, clean up his room and throw out his cumsock while they were at it.

ASD and ASIO have despised Singtel since they bought out C&W in the late 90's and want them out of the country. This whole media fiasco is a blessing for everyone. Might be able to finally cancel their carrier licence.