I am currently in the middle of an identity theft attack. It all started with someone trying this SIM swapping attack on me. Luckily Verizon prevented it.
After failing to get my number they still were able to access my debit card. Since they didn’t have my number they initiated a text bomb attack where I received hundreds of signup and 2FA texts. Buried in the middle of those was a withdraw alert from my bank.
Luckily I spotted it.
All in all this has been a very bad experience for me. While I do feel bad for the violence inflicted on this guy I wish there was something more we could do as a society to prevent people from following in his footsteps.
First I “locked” my phone number disabling transfers (although I suspect this is vulnerable to social engineering attacks).
I have also frozen my credit with the three credit bureaus (the attacker also opened a new line of credit in my name)
I am also closing the bank account that was compromised. They aren’t giving me any info but I suspect the attacker got my debit card via social engineering. It was a new account and I hadn’t even received my debit card yet.
I have a subscription to a credit monitoring service as well which has proven its worth in this situation.
Otherwise honestly I am not sure what to do. It sucks to know this person has my name, social, phone, and other info. I basically plan to keep my credit frozen indefinitely. I am also disabling text based 2FA for me and my wife wherever possible.
You need to give your ssn to so many people over your lifetime and you’re essentially trusting that all of them will be trustworthy and secure with it.
This could be easily solved with public key cryptography, but it would also confuse so many people it would be hard to implement.
If there’s an upside to the crypto craze, maybe it’s teaching people about cryptography basics.
If this were being used for SSNs, you'd have a central authority to restore access. If you lose your passport, they can issue you another one and mark the old one as lost/stolen. You can do the same thing for key pairs.
The main problem it solves is giving a sketchy client your SSN on your I9 without allowing them to use it/leak it to scam groups to spin up a credit card on your behalf.
The main problem with the “key escrow” scenario is that the government can access your private key, so this solution is still not meaningfully secure. What do you think is more likely: that this new institution will be magically invulnerable? Or perhaps you will have just created an irresistibly valuable target for social engineers and hackers that inevitably will fall?
Good news. A good chunk of the world already uses crypto for identification. My eID card is just that, i can auth with a chip and pin. This is normal in a lot of the EU.
I don’t want my identity to be linked to many of those accounts. So I’ll take a yubikey. Second, I’m glad I don’t live in a country where I’m required to carry id.
You don’t have to but in situations where you are unable or unwilling to show your ID and a peace officer wants to check your identity, they’re entitled to take you to the precinct.
I’ve “locked” my number and it requires a transfer PIN. I hope Verizon’s systems won’t allow a transfer without that pin even with a malicious employee, however I wouldn’t be surprised if they are able to override it.
Apparently my attacker had a fake ID with my name and their photo. It’s possible a store employee could override the transfer lock if they are sufficiently convinced it’s really me.
I've heard many cases of transfer locks being broken. From what I understand, it is even possible to simjack at a higher level than the individual telco.
Thus, I don't even bother with stuff like this, the only solution in my eyes is to not rely on SMS 2FA and if you absolutely have to, at least use a GV number. While GV isn't totally secure either, at least it is disconnected a tiny bit from my cell number and doesn't have humans backing it (we all know that Google never answers the support phone).
In one of Sid Myers games he has a quote that always stuck with me "Human behavior is economic behavior. The particulars may vary, but competition for limited resources remains a constant. " and you can watch that play out here.
Crypto prices are falling and violence around that community goes up. Corporations see the economy going into a recession and start layoffs. I wonder if more fraud, wage theft and illegal tax avoidance happens during economic down turns as well?
Pravin Lal's speech stuck with me even more, it seemed prescient and relevant for how the mid/late-2000s and early 2010s played out.
"As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with freedom and vitality, but the free nation gradually constructing its grip on public discourse has begun its rapid slide into despotism. Beware of he who would deny you access to information, for in his heart he dreams himself your master."
Adverse issues (e.g., fraud) tend to get noticed more in downturns, because, generally, everyone cares more about the details in those times. In times of plenty, they also occur (perhaps even as much), but people are more willing to let the same behavior pass because everything is going well.
At the risk of stepping too much into the meta, I wouldn't be surprised if there are some innate behaviors from evolution for responding to downturns (e.g., caring more about fairness).
The innate behavior idea makes some sense. One example: Unemployed married men are something like twice as likely to be divorced as men who are employed. People typically don't say "I divorced him beacuse he doesn't make any money" but suddenly behaviors that were tolerable previously become deal breakers once a man loses his job.
Or you know the gravy train is over and you can get 50% before it drains down to nothing + 20% of his imputed former income drained from the 50% he has remaining + a new man with a job.
I won't express an opinion on who is more altruistic, [edit] because I don't think I have sufficient data to draw a broad conclusion. Studies on college campus like these always seem pretty weak to draw societal wide conclusions from. These tiny experiments are usually conducted on college students and often are not reproduce-able.
"In one of these experiments, the researchers, led by doctoral student Paul Piff, gave participants the opportunity to share $10 with an anonymous stranger. A few days earlier, the participants had all filled out a questionnaire in which they reported their socioeconomic status. The results showed that people who had placed themselves lower on the social scale were actually more generous than upper class participants were."
This strikes me as a pretty weak study to extrapolate to any society wide conclusions.
Having spent my childhood in one of the poorer corners of the globe, it tracks with what I experienced, for what it's worth. When folks don't have much, group sharing any bounty received, and being the recipient of others', is how people survive.
It may also be the case that a community more inclined towards socialism ('sharing any bounty') doesn't fair as well, and is disproportionately likely to be poor. Not saying that's the case, but it's one possible explanation of why poor communities would disproportionately exhibit that behavior.
I honestly think you have it in reverse. If you and your community are poor, the only way to survive is through cooperation. The folks that didn't participate? You don't see them because they didn't survive.
So yes, you see cooperative behaviors in the poorest of communities. Because other behaviors at that income level are incompatible with life!
Chicken/egg. Populations that share poverty traits practice collectivism to survive. But collectivism is a local maximum that prevents stronger traits from capturing benefit, and thus inhibits them from taking hold.
In the long run, non-collectivist populations develop an advantage through hard times and environments. Collectivist populations subsist, and nothing more.
I noticed you countered by using 'cooperation', a word found nowhere in my above comment. I do not think this is an accident, and calling me to have it 'in the reverse' of a word I never said is no doubt a deliberate and misleading framing on your part, although I admit it is rather clever
? I used cooperation as a synonym for sharing the bounty, which is think is perfectly reasonable. Please assume good faith in discussions here. HN is run differently than most internet fora.
Notch, accusing someone of "deliberate and misleading framing" arguments because they didn't use the exact, precise language that you did is assuming bad faith.
Your argument is weak, obtuse and unproductive. He clearly explained why you're wrong by explaining a culture he was deeply familiar with, and your response is a faux-intellectual straw man.
If you can't deal with the fact that you're not the suppository of all wisdom, please get off HN and go outside.
Clearly my argument 'one possible explanation of why poor communities would disproportionately exhibit that behavior' is weak and one saying literally 'other behaviors at that income level are incompatible with life' is not? I've merely made a conjecture, I find it extremely weak, obtuse, and unproductive to just say welp 'incompatible with life' as if that is that.
My argument was a mere possibility. The counter argument was a factual statement about literal 'incompatible with life.' The latter is much stronger, in fact my counterparty made a statement much more closer to how one who believes they are the suppository of all wisdom would behave.
Going back and phrasing this as "sharing any bounty" being synonymous with "cooperation", and then using cooperation in connection with saying I got it in reverse, is about as bad faith as it gets.
You've already demonstrated that you don't know how to play the "spirited debate" game with other people, and for that reason nobody wants to play it with you.
If you want to get the last word in so you feel like you've "won", go ahead. I'll quiver before your superior and enlightened intellect.
I’ve been to over 40 countries and I can tell you this is true. The people that have the least are some of the most caring people, who will insist on feeding you even when they don’t have much food to give.
It is economic disparity that creates violence. Only when villas are in reach of a small poor town do you start to get petty muggings, scams and murders.
Can attest to this, numerous times I have been invited to dinner, helped tremendously for no reward and met with just pure humility from dalits (untouchables) when backpacking in India.
I am not claiming that people from other castes behaved badly, in contrary, but when you see how little those people have (ie 3 generations, or 10 members of family sleeping in 1 room 3x3m and that was their whole 'house' - just 4 super basic walls with no roof, nothing else). Coming back to my relatively crappy eastern european country where people constantly complain how poor they are compared to ie germany made me feel sad, ashamed and badly out of touch with my folks...
>It is economic disparity that creates violence. Only when villas are in reach of a small poor town do you start to get petty muggings, scams and murders.
I remember hearing about this in a Jordan Peterson video. The correlation between economic inequality and young make violence is apparently one of the strongest in all of sociology, and still applies regardless of the size of the geographical boundary you draw.
Historic studies on altruism often failed to account for all costs or benefits of certain actions. This led to results showing a great deal of altruism that later research overturned when scenarios were better crafted to control costs and benefits. It has been a while since I read the specifics but one example involved sales people who appeared to act altruistic and not take advantage of a seemingly oblivious shopper. Once the study was changed so that the specific sales person who took advantage of the shopper wasn't known to the researchers, only how often it happened, the altruism disappeared. There was a social currency of "appearing to be ethical" that was worth more than taking advantage of the shopper. Once that social currency was removed, the sales people reevaluated which options were most optimal.
This is all to say that any studies on altruism need to be scrutinized to see if some benefit or cost was missed in the experiment design.
That makes perfect rational sense to me. You would expect people who may come to rely on charity or who have relied on it in the past to be more charitable now.
If you're poor because predators (like police, the courts, a vindictive ex, whatever) take whatever wealth you have, then it might also make sense to be extremely benevolent with whatever you have before you get stolen. Then you'll get the social capital and when your neighbor has a good day you'll get some of that too. Almost like a method of decentralized banking.
Not to speak for them, but there are things to cite in the article:
> Prosecutors say the defendant fired a handgun into a Pennsylvania home, and helped to torch another residence in the state with a Molotov Cocktail — all allegedly in service of a beef over stolen cryptocurrency.
> Earlier this month, three men in the United Kingdom were arrested for attempting to assault a local man and steal his virtual currencies.
It's not particularly strong evidence that this violence is caused by a falling value but it's also not entirely unreasonable to be left with that perspective.
Mainly this bit: "Foreshadow’s experience is the latest example of a rapidly escalating cycle of physical violence that is taking hold of criminal SIM-swapping communities online. Earlier this month, KrebsOnSecurity detailed how multiple SIM-swapping Telegram channels are now replete with “violence-as-a-service” offerings, wherein denizens of the underground hire themselves out to perform various forms of physical violence — from slashing tires and throwing a brick through someone’s window, to conducting drive-by shootings, firebombings and home invasions."
I've started reading a book about systems theory and and that's what the quote made me think of. One flow is restricted and so another increases. I wish I had read the book a long time ago because I've barely started it and I'm already looking at things in a new way.
I know it's a game, but this quote is plain old competition for resources viewed with Ferengi lenses. If there's want and scarcity, there will be competition, no matter how fair.
Wow—I didn’t know this stuff was being done. While this has been shouted from rooftops for a while now, BANKS and related are still using SMS to verify things—this is yet another shout as to why SMS should not be used for 2FA.
There's reasons to be optimistic that the solution to preventing this type of attack (which is so troubling precisely because the difficulty of patching it is utterly colossal) might yet be around the corner. Band-aid mitigations, like programmable eSIMs and tethering one's phone to an online identity (as Google Fi does) have existed for a while now, neither of which is an ideal solution. I was surprised recently though by what sounds like credible speculation that Apple's next iPhone release may drop the SIM card slot completely. If true, I'm guessing that could be the Zugzwang that will force mainstream wireless carriers, notoriously allergic to investing in their own infrastructure, to finally make the needed upgrades to achieve a post-SIM card future — much in the same way, I'm hoping, that the elimination of the audio jack forced the adoption of Bluetooth on even the most viscerally reluctant consumer.
I think part of the challenge is increasing tech literacy in America. Most of my friends and family have trouble understanding password managers or hardware 2fa.
I think you're overestimating the problem. Here in the UK, banks send out physical 2FA devices (card readers, little calculator style devices, etc) for those who don't want something eg linked a smart phone app. They're easy enough to use for anyone who can use online banking, and those who don't need or want online banking don't need them.
Which banks still send these? Former HSBC USA sent me one before they shut down their consumer products but it was very poorly implemented in their web interface
We got credit cards with chips way after Europe. We don't have anything close to GDPR because enough voters don't understand data privacy (and ofc regulatory capture).
> We got credit cards with chips way after Europe.
That was largely due to POS terminals in gas pumps — we have LOTS of gas pumps and the POS devices in them aren't uniform or inexpensive. When I worked on payment systems the resistance was from the merchants, not the consumers.
Where research (and experience) has shown some degree of consumer dissatisfaction is with entering PINs, which is why chip-and-PIN credit cards aren't commonly seen in the US. Even in countries where it's commonly used, you generally only require the PIN over a merchant-set amount.
As a victim of these gangs, I’m sorry but I feel no sympathy. They swapped my sim and called in a SWAT raid on my house while they attempted to take over all my digital accounts. I’m lucky it didn’t end worse for me or my family.
I see a lot of commenters here talking about how they have no sympathy for the kid. I think it's important to remember that it's hard out there these days. A life of crime may not be the only option available, but it becomes more and more appealing as access to education or training gets more difficult to afford, inflation increase outpaces wage increases, workers rights aren't expanded.
Dehumanizing criminals is a very privileged way of approaching the world.
What we have here is a child who was failed by society.
> I think it's important to remember that it's hard out there these days. A life of crime may not be the only option available, but it becomes more and more appealing as access to education or training gets more difficult to afford
No, no. It is a very discriminatory view.
Many very rich people are criminals.
I'm from a very poor neighborhood, from a third world country.
Many of my friends got into crime and died. Many more are hardworking, in my experience it is easier to find a criminal who was born rich than a criminal who was born poor .
I don't have much formal education. But using books that was going to waste, I learned programming, etc.
And Today it is much easier to learn ANYTHING.
> Dehumanizing criminals is a very privileged way of approaching the world.
What we have here is a child who was failed by society.
It's not Dehumanization. Someone works hard, buys something after years of work and gets robbed overnight. When someone defends the criminal in the first place, he is ignoring the guy who suffered without doing absolutely anything to deserve it. It's normal to hate the criminal.
And the poor hate criminals. Defending criminals is a very privileged way of approaching the world.
I am not a favor to kill criminals, etc. But sometimes when you get what you're looking for. And defending very bad behavior is not good for anyone, neither the boy nor society.
Flip that around. In a very real sense the criminal either chose to dehumanize his victims, or ignore the suffering he was causing (arguably worse). "Do unto others as you would have them do unto you".
Also, some people are just shitheads, and I don't think we can say with any degree of certainty where Foreshadow sits.
There's a lot of shitheads out there for sure and when one commits crimes in which there are victims one makes a moral decision to inflict some kind of harm.
Even with that, you can never truly know another person and categorizing who committed crime out of necessity and who is morally devoid is near impossible. I think we tend to judge our peers harsher than we judge our corporate overlords.
Imo this type of crime is a symptom of our broken society more than a symptom of a broken person.
Copaganda and western hero-villain stories teach us from a young age that there has to be a bad guy who needs to suffer for their actions.
The net is that a criminal like this is someone who makes a conscious decision that other person's life or property (which is also in most cases life via time spent working) don't matter, the only thing that matters is that they want something, be it money in this case, or sex/power/... in case of violent crime. In this case the only possible excuse is that it's a kid whose brain maybe sorta is not fully formed. On the other hand, while for some crimes you could argue about making bad snap judgments, etc., and for other cases you could argue that your victims are far removed and abstract so you don't grok the above decision as well (shoplifting from a chain store is a good example for both); for something like SIM swapping, with extreme level of planning and foresight, aimed at a specific individual, I personally accord a person continuously making this decision zero moral value.
Yeah there's obvious reasons why organized crime is dangerous, but it's designed to lure people in with quick money/protection/sense of identity and then trap them.
The same goes for any behavior where one knows adverse consequences beforehand. I remember I bummed my first cigarette from a stranger one day when I was stressed out as a teenager. When I got hooked on the addictive properties and irreversibility damaged my lungs should there have been no room for empathy?
I'm not saying choosing to view this kid as a victim solves anything or that people should share my view. I want more voices spreading it so people can see there's another way to see the world.
And fwiw like most people my attitude flips 180 when I'm the victim of a crime. I am after all, only human.
You seem to be asserting all this as fact when I think it's mostly conjecture or opinion. I find it far more dehumanizing to think of people just as the product of society.
Sure, some criminals are people who make “mistakes”. It was an error in judgement, they feel remorse and won’t do it again.
But many criminals know what they are doing is hurting others, their attitude is “who cares”? It’s a risk they take, if they get caught it’s just “the cost of doing business”. These are people who take your sympathy and use it against you.
Especially, when you do something that hurts people, there are ways to rationalize it. "If I didn't do it, someone else would", "they'll get it back from insurance or something, it won't inconvenience them too much", or just plain trying not to think about them at all.
But none of those options really work for the kind of identity theft where you take up loans in someone else's name, try to extort them with private information etc. The people who do that know perfectly well what kind of Kafkaesque hellhole they're sending their victims into. About the only thing they can do to justify themselves to themselves, is pick a victim they already hate for some reason.
Sometimes I wonder what the world would be like if criminals had access to a court-like dispute resolution system. Obviously the details are too complicated to ever work out, but there would probably a lot less assault and murder.
criminals have a code of behavior, and a hierarchy.
if you look at 1% motorcycle clubs they have a code of behavior among each other.
messing with someones deal[competition] is against that code.
there is a murmuring of the commons that roughly equivocates some sort of due process, mostly pronounciations of a persons character, and qualifying an alibi.
when it comes to prison time there is hierarchy, depending on the nature of the crime, and who "co-workers" are, and unfortunately race often figures in it as well.
Just wanted to remind everyone that insisting on using SMS for 2FA and for notifications instead of push notifications is a deliberate inaction on the part of service providers that creates vulnerabilities and whole sprawling crime underworld.
The criminal world is dangerous. When large sums of money are involved it becomes even more dangerous.
Seems like a kid who had no idea what he was getting into suddenly found out how dangerous things can become. It's hard to feel bad for the "victim". Not only were they a "plug" for a crime that gains complete control of someone's life, they're also a criminal.
> "No1 cared about that nigga anyway, he snaked targs [targets] and flaunted it everywhere,” Gus said of Foreshadow. “I’ve been fucked over so many times I’ve lost millions. I am just a guy trying to make more money.”
No matter how evil a person is, they always see themselves as the victim. Every person I have ever met sees themselves as a victim. I am pretty sure Hitler saw himself as a victim as well.
Here the kidnapper, thief and potential murderer sees himself as a victim because he couldn't steal as many millions of dollars as he wished he could. I shouldn't be surprised by this behavior, but it still makes you laugh.
Very true, Dale Carnegie makes the exact same point in his book "How to win friends and influence people". Apparently people like Al Capone, "Two Gun" Crowley, and Albert Fall (the guy behind the Teapot Dome oil scandal) felt themselves victims as well, according to his book.
I just had to go through a lot of hoops to switch from a physical sim to a new esim on a new phone. My brother had a sim swap attack occur a couple of weeks ago in an attempt we think to get to the small bit of crypto he had. Apparently a sim swap attack was attempted and thwarted again earlier this year but they did not give me any details to me about the attack.
I'm glad our account has this extra protection on it but I'm still going to be going through and removing SMS 2FA on anything remotely important.
The term “trigger” in this context was initially used by mental health professionals in the context of setting off post-traumatic stress. I believe this here is an example of this primary (non-problematic) usage.
It then got politicized and associated with “snowflakes”, and endlessly mocked and memed. Actually may be that more people know the word now from right-wing trash talk than from mental health concerns.
I'm with you on that. I did kickboxing and other things for some years, so I've seen some blood from blunt force.
Blood dries quite fast and/or gets absorbed by the fibers of the clothing and will then turn into a darker shade of red.
Blood has a rather low viscosity. If you beat somebody properly up, there will be lots of little splashes of blood, this looks very "drippy", almost like paint that dropped down. If he's bleeding like that from the mouth, he'd most likely have swallowed some blood coughed it up and all over him. The sweatshirt would look very different at least.
If you beat someone up, you'll also have bruises all over his face. Normally you'd see green and blue eyes and bruises on his face, especially his cheeks. Some slightly missed hits always happen, especially when the opponent tries to duck or move away. This looks too "precise" and accurate for some random beat up.
Is this kind of nitpicking really necessary especially when the point GP was making is completely unrelated to the exact nature of the algorithm (it applies to both)?
Well hashing algorithms are resilient against baseball attacks, I am not able to reverse SHA256 even if you beat me to death.
I think it is important distinction for criminals to know, killing someone because one doesn't understand difference between AES256 and SHA256 is bad outcome for everyone involved.
Agreed. I'm glad the kid wasn't killed but I cannot feel sorry for a criminal when something bad happens to them. Hopefully this guy straightens out his life going forward.
There. We're all used up. If you want to make a comment like this, you can just link this one instead. Your 80 year old relatives can just say "FW: FW: FW: Check out this link on the Hackers New". I gotchu fam.
This type of result is unavoidable with anonymous cryptocurrency, and it will only get worse if we continue to accept anonymous transfers as a legitimate source of income. The new European MiCA regulation goes a long way into establishing traceability in crypto-transactions, but is still short of what's required.
Essentially, the whole current lot of cryptocurrencies should be detached from financial markets because they operate, by design, like a large money laundry service.
After failing to get my number they still were able to access my debit card. Since they didn’t have my number they initiated a text bomb attack where I received hundreds of signup and 2FA texts. Buried in the middle of those was a withdraw alert from my bank.
Luckily I spotted it.
All in all this has been a very bad experience for me. While I do feel bad for the violence inflicted on this guy I wish there was something more we could do as a society to prevent people from following in his footsteps.