h3h3Productions
5 HN mentions · mentioned in 5 months, 2016–2022
9:07 · 4.7M views · Jul 8, 2016
h3h3Productions describes how a hacker took over their phone number by getting a SIM card from T-Mobile, and gives security advice such as using a hardware key and an authenticator app.
HN cites it as a well-known example of SIM-swap social engineering that defeated even a carrier PIN, in discussions of SMS-based two-factor authentication.
5 comments from Hacker News
Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number of people at the company with email access). This is one of those things that everyone says "Ha, I'm smart. I'd notice. You can't trick me." And maybe you are. But you're also distracted. And that's my greatest advantage against you. All I need is to sneak in an unexpected Github prompt that looks completely authentic, and now I have your Github password. Wanna bet you don't have 2FA turned on, even though you know you really ought to? And even if you do, it's getting easier to social engineer your way past AT&T's lovely customer support: this video Ok, what's the point? This: Every character in the URL bar unrelated to the apex name is a deadly distraction. Right now, how do you know you're actually on HN instead of some knockoff? "ycombinator.com". How many characters do you have to read unrelated to that? " [LINK] . /item?id=17927972" The most vital part of a URL for vetting identity is also, usually, the hardest to see. Now, I don't know whether google made this change in order to assist with this. But it's one possible justification, and a step in a good direct
But, to add, sim swap attacks are a known issue and anything of value becomes a target. The main issue is that retail employees in 'authorized reseller' locations are allowed to make changes to accounts with the PIN of the account holder, but that is often easy to guess or is easy to figure out by anyone that does enough digging into someone's life. [LINK] this video (tldr he got cold called to set up 'extra security', gave the attacker a PIN number, and the attacker used that to impersonate them within a T-Mobile store and swap the sim card from the phone into a new phone, thus receiving SMS 2fa codes for their accounts).
Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit. [1] [LINK] [2] this video [3] [LINK]
One of the biggest weaknesses of SMS 2FA that I didn't see the article cover is when an attacker can socially engineer their way into your account with your cell service provider. I'm thinking of a high-profile example when an attacker tried to take over h3h3's YouTube account by requesting his SIM card from T-mobile by pretending to be a T-mobile employee: this video
Either some sort of ss7 exploit [0] or the attackers socially engineered the cell service provider [1]. This happened to some big YouTubers in the past [2]. [0] [LINK] [1] [LINK] [2] this video