T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account

ronjor · May 18, 2018

T-Mobile is investigating a retail store employee who allegedly made unauthorized changes to a subscriber’s account in an elaborate scheme to steal the customer’s three-letter Instagram username. The modifications, which could have let the rogue employee empty bank accounts associated with the targeted T-Mobile subscriber, were made even though the victim customer already had taken steps recommended by the mobile carrier to help minimize the risks of account takeover. Here’s what happened, and some tips on how you can protect yourself from a similar fate.
Click to expand...

https://krebsonsecurity.com/2018/05...thorized-sim-swap-to-steal-instagram-account/

guest · Jul 17, 2018

Instagram is building non-SMS 2-factor auth to thwart SIM hackers
July 17, 2018
https://techcrunch.com/2018/07/17/instagram-2-factor/

Hackers can steal your phone number by reassigning it to a different SIM card, use it to reset your passwords, steal your Instagram and other accounts, and sell them for Bitcoin. As detailed in a harrowing Motherboard article today, Instagram accounts are especially vulnerable because the app only offers two-factor authentication through SMS that delivers a password reset or login code via text message.

But now Instagram has confirmed to TechCrunch that it’s building non-SMS two-factor authentication system that works with security apps like Google Authenticator or Duo. They generate a special code that you need to login that can’t be generated on a different phone in case your number is ported to a hacker’s SIM card.

Hopefully as knowledge of this hacking technique becomes more well-known, more apps will introduce non-SMS 2FA, mobile providers will make it tougher to port numbers, and users will take more steps to safeguard their accounts.
Click to expand...

guest · Jul 20, 2018

Wireless Carriers Have A SIM Hijacking Problem They Don't Want To Talk About
July 20, 2018
https://www.techdirt.com/articles/2...ng-problem-they-dont-want-to-talk-about.shtml

Wireless carriers are coming under increasing fire for failing to protect their users from the practice of SIM hijacking. The practice involves posing as a wireless customer, then fooling a wireless carrier to port the victim's cell phone number right out from underneath them, letting the attacker then pose as the customer to potentially devastating effect.

Carriers, for their part, don't much like to publicly talk about the problem. In part because it's occasionally their employees that are helping to facilitate the scams for a little extra cash:

"(One hacker) said they do SIM swaps by using an internal T-Mobile tool to look up subscribers’ data. [...]
Quite often, those cellular carrier employees are more than happy to provide hackers with direct access to cellular carrier support system:

[...] An AT&T spokesperson said this kind of fraud “affects a small number of our customers and this is rare for us,” but did not respond when asked to clarify what “small number” means.

There's some steps users can take, including changing passwords frequently. T-Mobile users can also, for example, call 611 from your cellphone (or 1-800-937-8997), then tell a support staffer that you want to create a “port validation” passcode.
Click to expand...

guest · Aug 3, 2018

How Criminals Recruit Telecom Employees to Help Them Hijack SIM Cards
August 03, 2018
https://motherboard.vice.com/en_us/...-telecom-employees-sim-swapping-port-out-scam

Last year, Joseph Dixon* posted a picture of himself on Instagram, tagging it #T-Mobile, the company he works for as a store manager.
“Do you wanna make some money?” the person—a would-be scammer—wrote in an Instagram private message, according to Dixon. (*Dixon’s name has been changed because he was not authorized by T-Mobile to speak to the press.)

The deal was simple: the person would send Dixon the name, phone number, personal details of a T-Mobile customer such as SSN and home address along with the number of a new SIM card. Dixon would then log into T-Mobile’s online employee portal for customer service, called Quickview, transfer that phone number to the new SIM card and collect $100 in Bitcoin.

“I’ll be able to get at least 10 [targets] a week or more,” the would-be scammer wrote Dixon, meaning that Dixon could make up to $1,000 per week.
[...] “This is not new,” Dixon told me, referring to SIM swapping. “T-Mobile has had this issue for years and they seem to not be doing anything about it.”
Click to expand...

Rasheed187 · Aug 4, 2018

mood said: ↑

Wireless Carriers Have A SIM Hijacking Problem They Don't Want To Talk About
July 20, 2018
https://www.techdirt.com/articles/2...ng-problem-they-dont-want-to-talk-about.shtml
Click to expand...

OK, so I guess we can't rely on smartphones for 2FA security anymore, companies will need to come up with something new. Reddit probably got hacked the same way:

https://www.wilderssecurity.com/thr...rlier-in-security-breach.406748/#post-2772499

guest · Oct 10, 2018

mood said: ↑

Instagram is building non-SMS 2-factor auth to thwart SIM hackers
July 17, 2018
https://techcrunch.com/2018/07/17/instagram-2-factor/
Click to expand...

You Can Now Turn on Better Two-Factor Authentication on Instagram—and You Should
October 9, 2018
https://gizmodo.com/you-can-now-turn-on-better-two-factor-authentication-on-1829628325

[...] it announced in September that it would be bolstering the layer of security, adding a non-SMS method. Instagram confirmed to Gizmodo in an email that it’s now available to all users.

[...] security experts consider non-SMS two-factor authentication more secure because it can’t be intercepted by bad actors—instead, rather than retrieve the code via text message, users can use a third-party app, such as Authy or Google Authenticator.

To enable non-SMS two-factor authentication on Instagram, go to your Settings menu and choose two-factor authentication from the Privacy and Security section. Then, choose Authentication App.
Click to expand...

Log in or Sign up

T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches