Any idea how G and A were compromised, password reuse?
I used to work tech support for cell phone providers, and while we were trained about fraud, the nature of the industry low wages, high turnover, makes this a security flaw that financial institutions should not risk.
But if the attacker already has your info, then couldn't they just add another line to your mobile plan, so your handset continues working, just with a new, unbeknownst to you phone number? That way it wouldn't be noticable on the handset.
The real question is how long do you think it would take you to break into your own Gmail account after the passwords been changed and the attached phone numbers also been changed?
Probably longer than it would take an attacker to drain bank accounts, I figure.
Or, you know, they can just bribe the store employees. Has happened before, still happens, will keep happening as long as a phone number is considered important for anything at all.
Moreover, you don't want it to be tied to your identity. The fact that anyone can pretend to be you and hijack your phone number is exactly what makes it insecure.
A stolen phone can of course be a problem as well, but at least it's somewhat under my control and I may notice pretty quickly when it's gone.
I initially thought only Amazon was compromised. I thought it was due to us throwing away a FireTV device (assumption: we didn't log out and de-register) that was then used to order items.
And then I found they added filters to my Gmail account to hide the Amazon orders, and went into full panic mode.
Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.
Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings
https://support.authy.com/hc/en-us/articles/360012427914-Is-...
I’ll agree though that Authy’s docs are really ambiguous about account recovery.
I wonder then what the point is of having 2FA at all if you can just click a few buttons to bypass them with an SMS.
Were you specifically targeted in any way that would make the attackers go find your phone number and perform the swap?
And while on the topic of banks, most will suspend access to your online portal if you log in with a VPN. Give me a bank that allows VoIP phone numbers, VPN access, and TOTP and/or FIDO support for 2FA and I'll ditch Schwab right now.
They both use Symantec VIP but it’s fairly easy (for developers at least) to export those tokens and import them into something like Authy, Google Authenticator etc.
I know that Vanguard, for instance, supports non-SMS 2FA but doesn't let you disable SMS as a fallback (and I'd rather not just totally remove all phone numbers, but maybe I have to...).
Maybe they've changed their policy since then. But when you call to get set up on a new device, how do they verify your identity now if you don't have SMS fallback?
How was it that you diddnt notice $500 buys on your cards?
Not happy with you being had - but what about your profile made you a ripe target?
Is there a place that you visit on the regular where you would be seen as a "whale" and were targeted as such?
I would look at the places you visit as to how one may first, see you as a whale, and second have the time to take your PII....
You were a a target, not some random.
BTW - give me some of that big-swinging-credit-balls you seem to gotts...
15 * 500 = 7,500 USD. Having a steady job should put that within reach.
I don't know if it's controversial, but I think for most people, keeping up with your current card statement isn't something you do daily. Sometimes companies have a way to notify you of new charges immediately, sometimes not. Being surprised at the end of the month is more common than you'd think.
It will be easier to go after high income middle class types than HVTs, who will likely have someone watching things closer than busy working folk.
If you hit a target for multiple low value charges you face less scrutiny than large transactions. Fraud should pickup multiple purchases of the same product to different addresses though.
So you didn't have one lol. I understand that's an extremely frustrating situation though. Part of making backups is testing them once in a while (at least making sure they exist). Something else you could've done previously was to use Authy or Aegis which helps you backup the seeds themselves encrypted under a passphrase so you can recover the accounts even if you lose everything else. Although of course, all of this depends on your threat model, if you don't care about SIM swaps or if losing the account is still much more worrying then I guess it's just a unnecessary hassle/risk.
How do you know T-Mobile was the entry point, and not say, Google (e.g., Google Chrome, Google Ads)? What type of phone did you have (e.g., Android or iPhone)? What is your browser and Search Engine on your smartphone?
Thanks!
I used an iPhone, Safari mobile, Google search engine.
Did you happen to report to Apple and Google (for documentation)?
We need more robust security integration to catch things before they are pushed to results. I understand latency will increase, and some ads revenue will decrease. But like, isn't it also cool to have a customer base that is better protected against egregious attacks, attacks that could be prevented? IMO, yes. It's called "stewardship."
It’s hardly a second factor if it can be used to entirely replace the primary one.
https://support.google.com/accounts/answer/183723?hl=en&co=G...
I think years ago I found my number there with no-recollection of every agreeing to it and quickly yeeted it. (You can remove the number but keep recovery email)
You can also enable Advanced Protection[1] for your Google account, but other repeat offenders like Github will continue to allow SMS fallback to bypass 2FA if you have a phone number listed anywhere.
I gotta admit, that's pretty clever. Crude, but effective.
Our group is small enough that I get very few alerts at all, and I've caught two compromises that way.
Of course I only found this out after being burned by it. Turns out they’d sent me a message telling me the item I returned was not in the same condition it was sent in (it was), but the message was utterly lost in the flood of ‘order received/sent/delivered’ mails they send (with the same subject).
What your experienced can't be done with just a sim swap attack, as you would have lost access to your phone number. And it can't be done with the described T-Mobile hack, as it would have given the hackers silent access to your texts, so they could have reset your Gmail password, but then you would have noticed a password change (and you claim it didn't change.)
There are lists floating around with 10s of thousands, or hundreds of thousands of users with known passwords in Google, Amazon, Paypal, Coinbase, etc.
Episode 112 of Darknet Diaries (March last year) has a really good breakdown of these markets: https://darknetdiaries.com/episode/112/
Sounds like an easy way to burn your exploit after using it a few times to get electronics off Amazon.
I’ve heard multiple independent stories from a few friends in Law Enforcement about cases involving trafficking of large quantities of stolen GoPros (obtained via methods not unlike what happened to you).
Interesting you mention NYC - at least one of these cases involved a very high volume fencing syndicate operating as a legitimate storefront in NYC - with merchandise fraudulently obtained from Amazon[0]. A friend of mine worked this case.
Small, fairly high value, high demand, and no remote shutdown/disable/reporting - somewhat of a perfect storm I suppose.
[0] - https://www.cnbc.com/amp/2018/06/07/how-the-finans-stole-1-p...
They'll have all the original packaging and put it up as a "pre-owned" unit, but then you open the listing and they have 20 of them for sale.
We also had a local hotel/waterpark that was running a burglary/fencing operation in the mid aughts. The room cleaners would look for gopros, iphones and other electronics. If they found anything, they'd take it and hand it over to the two managers, who then fenced it out to local guys who'd either pawn them or sell it on Craigslist and they'd split the money.
Customers routinely complained to the managers who were the fences so they'd tell the customer they'd fill out a complaint form and send in a police report to the local PD. Obviously, that never happened. This went on for about two years until people on social media and review sites like Yelp started discovering what was happening was not an accident. They finally busted the ring and within a few weeks, the waterpark and hotel were shut down for various other repeated OSHA and other infractions that went unfixed. The local paper reported even though they busted the ring, the money and the goods were long gone, leaving the victims with little recourse.
If you're the victim of a crime, you should do the police report yourself - also for things like insurance claims.
Not always.
- My Gmail account was compromised
- My Amazon account was compromised
In Gmail, they added a filter to hide any shipping or customer service messages from Amazon.
In Amazon, every other day, they placed an order for a ~500 USD GoPro device, delivered to an address in NYC. This address changed with every order.
Both passwords to both accounts were kept the same.
After I caught on to the above once I received my credit card statement, in November:
- They attempted to purchase something with my credit card. Security mechanisms triggered, and a verification code was sent to my phone at 4am in the morning. They successfully validated and placed the order. My credit card company assures me they input the right verification code.
- They applied for an Amazon credit card using my identity. It was auto approved, and they used the credit card to purchase ~5k worth of items.
I moved everything off of that T-Mobile number, and switched over to GoogleFi (only to learn GoogleFi uses T-Mobile also... still better than T-Mobile directly I'm hoping).
Edit:
I also wiped my phone, eventually thought that wasn't far enough, and switched to a new device entirely. I'm still unsure how the above occurred, because some of it feels beyond the scope of a SIM-swap.