Hacker News Reader

Comment by Gwypaas | Hacker News Reader

How can a mobile carrier operate like this?? No authentication that the request isn't fraudulent?

In Sweden I switched to another carrier, still keeping the number in the same name. To do that I got a text message with a code I had to input to initiate the process.

When I ported my phone number from my father to me within the same carrier when I turned 18 that required the same confirmation to initiate the process and signed request/approval both from me and my father posted to the company, with associated emails about the process.

This isn't even hard? This is just basic steps to prevent identity theft....

View on HN

This is not about porting the number to a different carrier or even a different owner though. It's more analogous to getting a replacement SIM card.

The last time I had a phone stolen, I went to the carrier's store, they checked my ID, and gave me a replacement SIM. And the things is, if the customer service representative is empowered to do that, they could also be bribed by the attacker.

It's worse than this though. My colleague had his sim replaced by an attacker in October of last year even though his account had a note on it specifically to prevent this without the account holder being present and showing photo id. Not only can the customer service rep at your carriers store do this but so can the phone reps at all the other stores that sell phones for your carrier such as best buy. The bottom line is that SMS/phone numbers shouldn't be an identifying factor for security purposes.

I checked, to get a replacement sim my carrier sends out inactive cards that needs to be activated through their web service using the printed number on the card.

If you don't have an account you need to contact customer service, and to get through there they most likely authenticate you based on your SSN and an already active app on your phone (BankID) where you input your personal password.

This has actually created problems when people get their stuff stolen abroad. The ID application is authenticated using your bank and a device using your physical bank card, a generated number from the webpage and your pin and then the generated number is put into the webpage. So if you get both phone and card stolen it's essentially impossible to get into your accounts until you can get a new one posted to you. Especially fun if your bills end up in a digital mailbox requiring that login....

Using that app is how essentially all identification is done in Sweden since it's based on an already approved physical device and a personal password. With your bank as insurance that the information is correct based on your physical bank card and the account associated to it.

See recent Tele2 attacks. This is a problem in Sweden too.

Maybe the Tele2 attacks made them finally sort things out.

Googled. Is it regarding using social engineering to enable call forwarding last autumn? Can't find anything else.

Yeah. Which is how this guy got hacked, too. Whether it's by forwarding or new sim card is a detail. It's the same social engineering vulnerability.

And reading the article everyone was already at the time working on preventing it, because any unauthorized change is illegal.

The prevention seems to be either through BankID authentication or actually calling/texting the number being forwarded to make sure the request is legitimate.

What Tele2 attacks?

https://computersweden.idg.se/2.2683/1.710395/google-konto-h...

In your case, a dedicated attacker could socially engineer the carrier into changing you and your father's contact details and then port the number.

$100k is a lifetime's worth of money in some countries, and it can justify a few months worth of recon.

How? I still get a text to my physical phone with the active number being ported and use the code supplied to initiate the process.

Somehow making them change my contact details would just end up with the bills being sent to the wrong place, if you still have paper bills and don't have it automatically paid or goes to a digital mailbox.

Reply on news.ycombinator.com