Re:Finance worker pays out $25M after VC with deepfake CFO
by wolfgang42 on Sunday February 04, 2024 @05:16PM
(#39255089)
There is (or was) no authentication within the core of the public switched telephone network, since it was designed at a time when that was impractical and physical infrastructure was assumed to be reasonably secure. So you don’t need to fake signing, you just say “Hey, +1-555-555-5555 roamed onto my network and is making a phone call” and the recipient takes this at face value. (“Blue boxing” to fake the phone system into giving you free long distance phone calls worked for similar reasons.) STIR/SHAKEN is supposed to fix this, though I don’t know how far along implementation has actually gotten.
[ Parent
| on HN ]
Re:Finance worker pays out $25M after VC with deepfake CFO
by HeatrayEnjoyer on Monday February 05, 2024 @06:44AM
(#39260157)
What happened that made it insecure?
I've heard of stir shaken but I recall FCC ordered it mandatory multiples years ago. Did that not happen?
Re:Finance worker pays out $25M after VC with deepfake CFO
by xorcist on Tuesday February 06, 2024 @09:23AM
(#39274454)
They let untrusted people in on the trusted network, basically. Telcos are no longer considered national security. Privatization has given us a cheaper and better communication, but security hasn't always kept up.
The authencation above is between the terminal and the location registry (simplified, there are several other components involved). Not internationally between the telcos.