Probably SMS as a 2FA option on Gmail, which is the real problem. Once you add your Yubikey and set up TOTP as a backup, you need to go back and delete SMS as a 2FA option. Had gmail been configured correctly, the SIM swap would have far less serious.

SMS 2FA is a security risk!

I used to work tech support for cell phone providers, and while we were trained about fraud, the nature of the industry low wages, high turnover, makes this a security flaw that financial institutions should not risk.

How is SMS a security risk? As far as I know, SMS is closely tied to a person's identity, especially 'know your customer' regulations. I'm curious how it's a security risk; as far as I know they have to be unique, which is good

Simjacking.

https://en.wikipedia.org/wiki/SIM_swap_scam

Wait. Isn't it painfully obvious when you've been simjacked? If your phone suddenly loses signal and refuses to register with the network, you know something is up. You may think it was a malfunction of your phone or your network, but it's pretty much a definition of a modern-day "drop everything you're doing and deal with it" emergency. You can't not be aware of it, or be unsure if it happened to you.

The phone may not lose signal immediately (or at all) - this is implementation dependent, so it's not a reliable indicator.

By the time you notice and can react it's too late. There have also been many prominent examples of people who got their cryptocurrency exchange accounts broken into with SIM hijacking which was conducted while the victim was asleep.

So maybe the attackers just wait for the right moment to strike. Like say Feb 13th. https://www.reuters.com/business/media-telecom/t-mobile-down...

But if the attacker already has your info, then couldn't they just add another line to your mobile plan, so your handset continues working, just with a new, unbeknownst to you phone number? That way it wouldn't be noticable on the handset.

The real question is how long do you think it would take you to break into your own Gmail account after the passwords been changed and the attached phone numbers also been changed?

Probably longer than it would take an attacker to drain bank accounts, I figure.

You very much can not be aware of it. Consider what happens when you're simswapped at 2 am. Are you going to notice that? Probably not. And maybe not after you get up and check your phone. Because your phone may be connected to the internet via your home wifi and you don't even notice your phone has no bars and no service because you're still able to browse the web and check email.

Check out this article: https://krebsonsecurity.com/2023/02/hackers-claim-they-breac...

Anyone can walk into a T-Mobile store with a fake driving license with your name on it and claim they need help moving their phone number to their new phone. This is of course your number. They will then receive all of your SMS messages.

Or, you know, they can just bribe the store employees. Has happened before, still happens, will keep happening as long as a phone number is considered important for anything at all.

Do you live in the US? You don't need an ID to get a phone number here so SMS is not necessarily tied to your identity and it has nothing to do with KYC.

Moreover, you don't want it to be tied to your identity. The fact that anyone can pretend to be you and hijack your phone number is exactly what makes it insecure.

No the other problem is Google allows adding recovery phone numbers that bypass 2FA :D

https://support.google.com/accounts/answer/183723?hl=en

I can use my phone number for 2FA and/or as a recovery phone number. Would you advise to remove it from both places or just from 2FA?

Remove it from both. However make sure that you have quite a lot of backups of your 2FA backup keys, and maybe even one offline backup of your seed, if you lose them, the account is gone (which is a good thing, I guess).

Thanks. I have Google backup codes as well as multiple Authy installations, Google prompt and a recovery email address so I guess I should be covered :)

What is "Google prompt" here?

It’s a notification pop-up that the Google mobile app can send, asking for login confirmation.

I see, but doesn't have the same issue as sending an SMS to the phone if the phone has been stolen in that the thief can just say "yes" to the prompt?

No, it's not quite the same issue. SIM swap works remotely without anyone getting a hold of my phone.

A stolen phone can of course be a problem as well, but at least it's somewhat under my control and I may notice pretty quickly when it's gone.

2FA on everything. No password reused. Only similarity is both had the T-Mobile number attached to them.

I initially thought only Amazon was compromised. I thought it was due to us throwing away a FireTV device (assumption: we didn't log out and de-register) that was then used to order items.

And then I found they added filters to my Gmail account to hide the Amazon orders, and went into full panic mode.

Interesting. Was your 2FA setup to use Google Authenticator or regular SMS? It's been a while since I used Google services but from what I recall from a previous company where we used Gmail was that the only way to do 2FA with Google Authenticator if you lost access to the phone was with a backup code you are given at 2FA setup time. Is that no longer the case?

2FA with authenticator. As someone correctly points out, Google appears to keep SMS as a recovery option unless you specifically opt out?

Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.

Just noticed that Authy’s answer to the FAQ of “ Is the Authy App Susceptible to a SIM Swap?” does not have the word “No” in it.

Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings

https://support.authy.com/hc/en-us/articles/360012427914-Is-...

SMS is just used to sign in. Everything is encrypted, and you can't access any data without a password. If you don't have the password, you don't get the data. There is no recovery.

Your OTP secrets should be e2e encrypted if you set up a backup passphrase. Worst case: someone can download your encrypted seeds.

I’ll agree though that Authy’s docs are really ambiguous about account recovery.

So both were compromised through TMobile sim swap, which was the backup for not having access to your 2FA?

I wonder then what the point is of having 2FA at all if you can just click a few buttons to bypass them with an SMS.

Were you specifically targeted in any way that would make the attackers go find your phone number and perform the swap?

Wouldn’t this still mean they cracked your gmail password? Or am I not understanding how this was executed?

I would assume they got a password reset code sent to SMS.