Brian Krebs

Next up: SIM card slamming

May 21, 2018

In this case, however, the perpetrator didn’t try to port Rosenzweig’s phone number: Instead, the attacker called multiple T-Mobile retail stores within an hour’s drive of Rosenzweig’s home address until he succeeded in convincing a store employee to conduct what’s known as a SIM swap.

~ Brian Krebs from, https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/

slip:4uketo1.

Free swapping of SIMs is a feature making it easy to change phones [which might require different SIM card sizes] and to recover from entirely losing your device.

Age-old axiom: If you can imagine a situation where you would prefer to not use the feature, then someone can imagine a way to abuse that feature as a security vulnerability.

…and just a few days ago I was talking about not using your cell phone as a “second form of authentication.” :/

ɕ

Don’t give away details about yourself

April 16, 2018

I hope readers don’t interpret this story as KrebsOnSecurity endorsing secret questions as a valid form of authentication. In fact, I have railed against this practice for years, precisely because the answers often are so easily found using online services and social media profiles. But if you must patronize a company or service that forces you to select secret questions, I think it’s a really good idea not to answer them truthfully. Just make sure you have a method for remembering your phony answer, in case you forget the lie somewhere down the road.

~ Brian Krebs, from https://krebsonsecurity.com/2018/04/dont-give-away-historic-details-about-yourself/

slip:4ukedo1.

“Two Factor” authentication (2FA) is best. “Two Factor” means two DIFFERENT methods of interacting with you — so a web site login, which requires also sending you a code via a message to your phone is “Two Factor”.

…and 2FA via your phone is a TERRIBLE idea, because you can easily lose it or have it stolen. There are better methods of 2FA, but I won’t bore you here.

So asking you “security questions” does not in fact increase security. But you’re stuck with it because you have no power of the entities you have to interact with. So what to do?

Treat those questions just like passwords — MAKE THEM UP!

However you are storing your passwords — that’s an entire other discussion — just ALSO record the questions they asked, and the REAL-SOUNDING BUT TOTALLY FAKE ANSWERS.

I repeat…

MAKE UP FAKE ANSWERS AND STORE THEM WITH YOUR PASSWORDS.

You might be AMAZED to discover my mother happens to have 42 different maiden names.

You might be AMAZED to discover how many different cars I learned to drive stick on.

…or the 42 different names for my first dog.

…you see where this is going?

Normally, I try to keep these ramblings succinct, but here’s a fun story…

Many moon ago, Tracy and I had a Blockbuster account. We were in the store, in the check out line, and the cashier says to me, “Oh, can I have your phone number?” We had been customers so long, it was before Blockbuster figured out people just keep the DVDs, and so they wanted to be able to start calling people. Someone expanded their customer database fields, added a new data field to the checkout screen and then trained or prompted the poor cashiers to gather this data. (This is called “compliance” in the industry — getting the people at the point of sale terminals to comply with the database marketing strategies of the home office.)

Anyway. Here’s this nice high school girl just doing her summer job, and of course, I can simply say “No.” But then they’re probably going to ding her “compliance” score with corporate. (In some cases, your pay, bonus and even employment are tied to compliance scores.)

So without missing a beat, I help both her (compliance) and I (privacy) and I give her my phone number with two digits flipped. I just immediately smiled and said 6 – 1 – 0 – 8 – 6 – 7 – 5 – 0 – 3 – 9 (shoulda been 5309 — you know I’m making numbers up right :)

…and Tracy says, “wait, that’s not our number,” thinking she’s being helpful.

“Exactly,” I say with a smile.

The cashier realizes I had just plainly lied to her. (Technically, I was trying to lie to her corporate overlords.)

…and I said, “oh sorry, 6 – 1 – 0 – 8 – 6 – 7 – 0 – 5 – 3 – 9”. (Same crap, just with two other numbers flipped. I always loved those ‘remember this string of numbers games’.)

“Is that really your number?”

“oh! Sorry, 6108675123… wait, no, 610876432178 … hmmm, you don’t seem to like these digits I’m saying… how about 6105551212?”

Now she’s like, “You’re weird.” (Unrelated ad hominem attack, but alas, true. But probably explains why girls IN high school never asked for my number.)

“…and Blockbuster still doesn’t have my phone number.”

At which point, she [I presume] took the compliance ding and didn’t enter any numbers.

To this day, (we have the same phone number,) Blockbuster — and whomever eventually bought their customer data because that’s the only thing they had in the end worth money — does not have my home phone number.

So there’s a little glimpse into Craig’s head.

Maybe you just realized why 2FA with your phone is really REALLY bad? You’re also giving away your phone number.

Wait, you read this far? Great, here’s how you REALLY do 2FA properly:

https://en.wikipedia.org/wiki/Google_Authenticator

ɕ