Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by welder on Tuesday February 28, 2023 @06:07PM
(#34976209)
That assumes their password wasn't already compromised. If they re-used their Gmail password somewhere else, the attacker could have already had their Gmail password and only needed the SIM-swap to verify the login.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by px43 on Tuesday February 28, 2023 @06:45PM
(#34976594)
Read up on credential stuffing, this is increasingly common. With all the recent breaches, there are groups that use old passwords to quickly identify MFA locked accounts behind re-used passwords. These lists are then sold to people who will, one at a time, pay about 10k for a SIM swap on individually targeted users.
There are lists floating around with 10s of thousands, or hundreds of thousands of users with known passwords in Google, Amazon, Paypal, Coinbase, etc.
Episode 112 of Darknet Diaries (March last year) has a really good breakdown of these markets: https://darknetdiaries.com/episode/112/
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by ghostpepper on Tuesday February 28, 2023 @09:42PM
(#34978112)
The parent comment has a point though - after SIM swap attack, all SMS messages would stop arriving at the victim device - unless the attackers swap it back again after every 2FA code. If they had access to a dashboard at t-mobile this might be possible but it sounds like a lot of effort to steal a few thousand dollars.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by mrb on Wednesday March 01, 2023 @01:44AM
(#34979465)
The victim (ctvo) claims in another comment down the thread that he had a unique Gmail password not re-used on any other service. So I wrote my comment assuming this is true. But, indeed, if his Gmail password was weak and guessable, then the T-Mobile hack would have allowed the hackers to validate MFA and log in.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by KyeRussell on Tuesday February 28, 2023 @07:06PM
(#34976797)
Honestly I’m a bit concerned an infosec professional has reached for “iOS device compromise” over a…more common and lower-effort explanation.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by zamnos on Tuesday February 28, 2023 @07:44PM
(#34977200)
If you believe Apple's marketing that iPhones are unhackable, I have a bridge to sell you.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by conjuredbytes on Tuesday February 28, 2023 @07:58PM
(#34977308)
No need to be aggro about it. No one’s suggesting iPhones are unhackable, just that realistically utilizing an iOS or Android exploit like that is a bit much for something simple like credit card fraud. Those exploits are valuable.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by wil421 on Tuesday February 28, 2023 @07:49PM
(#34977226)
Why would someone burn a device level exploit for $5k when you could sell the exploit for 10x or even 100x more?
Sounds like an easy way to burn your exploit after using it a few times to get electronics off Amazon.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by mrb on Wednesday March 01, 2023 @02:10AM
(#34979581)
What makes you think this was used for only $5k? In these cases, hackers usually target many victims, not just one.
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ...
by pohl on Tuesday February 28, 2023 @08:25PM
(#34977548)
Would you cite the marketing to which you referred? I’ve never seen it.
What your experienced can't be done with just a sim swap attack, as you would have lost access to your phone number. And it can't be done with the described T-Mobile hack, as it would have given the hackers silent access to your texts, so they could have reset your Gmail password, but then you would have noticed a password change (and you claim it didn't change.)