T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs: Report (tmo.report) 72
T-Mobile employees from around the country are reportedly receiving text messages offering them cash in exchange for swapping SIMs. SIM swapping is when cybercriminals trick a cellular service provider into switching a victim's service to a SIM card that they control, essentially hijacking the victim's phone number and gaining access to two-factor authentication codes. From the Mobile Report: The texts offer the employee $300 per SIM swap, and asks the worker to contact them on telegram. The texts all come from a variety of different numbers across multiple area codes, making it more difficult to block. The text also claims they acquired the employee's number "from the T-Mo employee directory." If true, it could mean T-Mobile's employee directory, with contact numbers, has somehow been accessed. It's also possible the bad actor has live/current access to this data, though we consider that less likely due to the fact that some impacted people are former employees who have not worked at the company in months.
Still, the biggest issue here is how this person (or multiple people) obtained the employee phone numbers. We're not sure yet which employees are impacted, but based on comments online it seems at least a few third-party employees are affected, and we've independently confirmed current corporate employees have also received the message. Though we can't say for certain, this likely means the information is not the same data as what was leaked during the Connectivity Source breach [from September]. We can't, however, eliminate that possibility. As mentioned, there are reports that some of the contacted people are former employees, and haven't been employed at T-Mobile for months, so the information being acted upon is likely a few months old at the very least. That being said, we're pretty confident based on corporate employees being included that this is a different source of data being used.
Still, the biggest issue here is how this person (or multiple people) obtained the employee phone numbers. We're not sure yet which employees are impacted, but based on comments online it seems at least a few third-party employees are affected, and we've independently confirmed current corporate employees have also received the message. Though we can't say for certain, this likely means the information is not the same data as what was leaked during the Connectivity Source breach [from September]. We can't, however, eliminate that possibility. As mentioned, there are reports that some of the contacted people are former employees, and haven't been employed at T-Mobile for months, so the information being acted upon is likely a few months old at the very least. That being said, we're pretty confident based on corporate employees being included that this is a different source of data being used.
Salt the lists (Score:3)
How hard would it be to plant a few ringers in the employee directory for the next time someone makes a dump of the employee directory? Ringers who have for example a side gig wearing a badge and a gun...
Map publishers use this trick to catch copyright infringement. A
Re: (Score:3)
Well, they used to, anyways.
https://www.bloomberg.com/news... [bloomberg.com]
I don't think that'll work (Score:1)
People do not make good decisions when under pressure despite what 80s action films would have you believe and low pay for customer service jobs coupled with skyrocketing rents have put hundreds of thousands if not millions under some very heavy pressure in the form of homelessness or threats of homel
Re: (Score:3)
You think the badge and a gun types care about this? They will refer you to the DA. And a DA is not going to care without an actual person asking them to enforce the law, because someone needs to be named as the one filing charges. Very rarely will the DA decide to follow up on their own, and usually only when there's a pretty obvious paper trail through someone in the country. Because otherwise it's just noise.
And, every company would need to add someone outside the company who will actually care about the
Re: (Score:2)
And what purpose would that serve? There _are_ obviously employees that report this already. So no improvement there. And from that point, anything that can be done can be done anyways.
Re: (Score:2)
Or like test 10% of the employees a month and give them $25 for reporting it and additional training for not reporting it.
Now your workforce isn't vulnerable at a cost of ~$25/year/employee.
Similar to the fake fishing emails a lot of employers send.
Re: Salt the lists (Score:1)
They are getting $300/swap. One of the people indicted for cooperating was doing several dozens per week. It is obviously more valuable to the criminals, each successful swap is worth thousands.
It's a good thing customer service reps (Score:5, Interesting)
Re: (Score:2)
Indeed. First rule for your own security people, and basically everybody that has a good position for an insider-attack? Make sure they are satisfied with their job! And that is the _only_ thing that really works. For example, things like DLP works somewhat against people accidentally exfiltrating data, they are completely useless against somebody intentionally stealing data if that person has two working braincells.
While this is obvious to anybody sane, for some reason "suits" routinely do not understand t
Re: (Score:2)
Doesn't just work for your employees, it is the same on a larger scale for your population. As a government, make sure people have more to lose than to gain for mugging someone for the 20 bucks in their wallet and you will find that you don't have a crime problem.
Re: (Score:2)
That depends on the approach. Send people to prison? Does not work, criminals, whether small or large, never think they could get caught. Even the death "penalty" does not work.
On the other hand, make sure nobody has to mug anybody because it is not difficult to actually get a decent job? That has a lot better chances.
Re: (Score:2)
People here have a lot to lose. Even those that have nothing. They still got their freedom and they can kinda-sorta survive on dole. It is possible. There's nobody going "Either I have this fucker's 20 bucks or a roof over the head and three meals a day, either way, it's win-win".
Re: (Score:2)
You assume criminals of this type are good at risk evaluation and planning. Observable evidence shows that is not the case. And hence this idea is not working. At all.
Re: (Score:2)
Weird. Because it is. Unlike most US-cities, you can walk across the ones here at any time of day, wherever you like. And the chance of returning with your wallet and all kidneys is pretty good.
Re: (Score:2)
I would attribute that to a) cultural differences and b) most US cities are actually not that dangerous.
Re: (Score:2)
Putting themselves in a position where they had to take a shitty job, and then taking a shitty job, are two prerequisite bad decisions.
I guess that's someone else's fault too, eh?
Re: (Score:2)
I don't care whose fault it is.
I care who solves the problem.
People who only look for culprits will never have a solution. You'll have someone to blame and feel good about yourself because it ain't you, but the problem remains.
Re: (Score:1)
I don't care whose fault it is.
I care who solves the problem.
OK, let's go with that. So, pray tell, who should "solve the problem", i.e. provide the money needed to satisfy this form of extortion? Are you volunteering? Maybe the Tooth Fairy? Me through bigger taxes? Me through increased price of cell service? And more importantly, who will provide the money to satisfy all other extortionists going "pay me a rent or I will turn to crime" that will want a slice of that cake too, after we establish that this is a perfectly valid form of existence within society?
Re: (Score:2)
So, pray tell, who should "solve the problem", i.e. provide the money needed to satisfy this form of extortion?
I have a suggestion. How about their employer? https://www.macrotrends.net/st... [macrotrends.net]
Re: (Score:2)
T-Mobile should solve the problem.
They should do tests like this periodically and see if anyone responds, and give a small payout to those that report.
If they don't randomly and hit the vulnerable employees approximately once a year it would be very little cost (give them a small gift card less than $50).
Employees that fail to report get extra training, employees that buy in get fired.
Now the calculous isn't $300 for a potential jobloss/criminal situation vs nothing.
It's $50 for if it's a test, vs certain j
Re: (Score:3)
How about holding T-Mobile responsible for allowing Sim-Swapping to happen? It's way overdue.
Re: (Score:2)
I only look for a solution for things that are my problem to solve.
Yeah it is (Score:2)
People are born into poverty all the time. My mom was a chain smoking alcoholic and it had a significant effect on my life. On the other hand she was able to hold down a job and so I have been too. Since I don't drink and smoke being a nerd and all I did not pass that down to my kid. But even taking that into a fact the incredibly high cost of college and the extremely low pay for anyone under 40 means that my kid i
Re: (Score:2)
Re: (Score:2)
Re: It's a good thing customer service reps (Score:1)
Every organization at every level is vulnerable to these things, criminal enterprises make a lot more money than legitimate ones. We are talking about attacks that can empty peopleâ(TM)s bank accounts, savings and investments while opening lines of credit, sometimes worth a million in one fell swoop. You are going to pay the sales clerk $120k/year to defend against this attack?
SMS-Based MFA Has To Go (Score:5, Insightful)
Re: (Score:1)
There used to be a time when we could rely on legislators to mandate basic security measures, but...
When was that?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And the relevancy to the story is?
Re: (Score:2)
Re: (Score:2)
Probably not. There are other attack vectors that can be used after a SIM swap. The SMA "authentication" path is just the most easy one and hence the one done most often.
As to hardbase-tokens, that is on the users. Large bank here tried to get corporate users hardware tokens a while back, but they would charge $20 or so for each of them (which is basically what they cost the bank overall including configuration). Nobody was interested.
Re: (Score:3)
TOTP and hardware-based tokens are more secure but many service providers don't support them.
I've been modded troll for saying telephones and SMS are broken. Someone can hijack your telephone number, assume your identity, gain access to your accounts and these companies all act like it's OK because they're following industry standards.
TOTP and security fobs are great, until someone convinces your service that uses them, that you lost yours and that they should let them identify in some other less secure method... Instead, lets put an end to SMS and phone number hijacking, even if that means aband
Re: (Score:2)
Usually when you set up 2FA with TOTP codes you get a set of recovery codes that you keep safe, in case you lose access to the TOTP ones.
The better solution for most people though is Passkeys. Can't be stolen like cookies or phone numbers, don't need to muck about with TOTP codes etc. Sites don't even need to keep you logged in via cookies as they can just log you back in the next time you visit, seamlessly and automatically.
For the paranoid, 2FA is still important, but for most people and for most websites
Re: (Score:2)
The time when we could (sometimes) rely on legislators to mandate basic security was back when they understood how basic security worked. In these areas only (some) tech specialists do.
Re: (Score:2)
Re: (Score:2)
TOTP hashes can be backed up. ...
Just use an application that can do that
On Android, FreeOTP+ [google.com] has an export/import feature.
This is the way most people can use it, without technical knowledge.
And from the command line, there is oathtool [ubuntu.com]. I wrote a simple wrapper script that reads a file that contains the hashes, and returns the one time password.
Re: (Score:2)
Re: (Score:2)
You can always back up a TOTP seed by just screenshotting the QR code and printing it.
Re: (Score:2)
They can be backed up ...
See this comment [slashdot.org] for details.
How? (Score:2)
> Still, the biggest issue here is how this person (or multiple people) obtained the employee phone numbers
Probably in the same manner they get SIM swaps completed.
Re:How? (Score:4, Funny)
Re: (Score:2)
Or even, say, scroll the list while filming it with a HD camera. Good thing HD cameras are clunky and expensive and nobody has one. Oh, wait...
Re: (Score:2)
T-Mobile, the stupid security carrier (Score:2)
T-Mobile supports TOTP 2FA for account logins BUT doesn't allow you to disable SMS for 2FA. Every time you login it asks what 2FA method you wish to use, TOTP or SMS.
If T-Mobile really cares to stop this... (Score:2)
...they will text phish their own employees and publicize the busts. Most of the disgruntled will find a better way to make a buck rather than risk getting caught.
Re: (Score:2)
Re: If T-Mobile really cares to stop this... (Score:1)
Low offer? Itâ(TM)s $300 per swap. You can perform easily a dozen or so per week without ever getting noticed, it is what these employees do day in and day out as people buy new phones they swap the sim on pretty much every sale and a successful sales person would hopefully sell a few per day just to make back their own salary.
An extra $3k/week or even per month is not insignificant to like 99% of the population.
Re: (Score:2)
Re: (Score:1)
That is exactly how it works, last time one of them got caught by reviewing the amount of returns they had. So they would have a stellar sales record but a higher-than-average percentage of their sales would see returns (so you buy the phone, you swap the sim, you return the phone when the deed is done).
Re: (Score:2)
Re: (Score:1)
Even if they get caught, they get instantly released because this is a non-violent crime and even violent criminals are release on current no-bail policies. Literally nobody cares, if they get caught, it's one of the middle men that has pissed someone off for thousands of dollars and is easy to catch. The Mexican drug cartels are too much paperwork.
Re: (Score:2)
Its a trap... (Score:2)
When employees of a company get an offer to do something, this can be one of three things:
A "legit" offer, where one does something, gets money, and that's that. However, there tends to be no honor among thieves.
A criminal firm just logging that, and will blackmail someone who takes the offer, stating they will turn them to the workplace and LEOs unless they pay up.
Or, it could be someone working for the company who is looking for people who would say yes to the deal, to weed them out.
I remember something
Re: (Score:2)
Employee directory... "somehow" accessed (Score:4, Informative)
To get access to the employee directory, you really only need to subvert one individual who has access to that directory.
Re: (Score:2)
Right... because T-mobile is so strict about security. [theverge.com] *eye roll*
Simple deterrent (Score:2)
Web-services don't offer passkey/TOTP (Score:2)
Google Android offers PassKey and internal TOTP 2FA. Free software (And OTP, Aegis, 2FAs) provides TOTP with encrypted back-ups. Windows/Linux provides passkey/TOTP 2FA via KeePassXC and Chrome/Firefox. Considering this form of identity theft has happened over many months, it's unconscionable for businesses to use SMS as the 2FA. But most web-services don't offer passkey/TOTP; phone accounts, Facebook, BlueSky and Slashdot don't. Google and Microsoft (which attempt to be always logged-in) and Discord ar
here's a suggestion (Score:3)
...maybe we actually start treating China as an actual enemy?
Need better education (Score:2)
Re: (Score:3)
Not a valid proposal. The percentage of criminals who do a risk/reward analysis is roughly 1/(Avrogados' Number) ; the percentage of criminals who think there's any chance they'll be caught is similarly small .
Re: (Score:2)
Why is this a surprise ? (Score:2)
They have the access and the means so of course they're going to be targets.
Same with the wait staff at your favorite restaurant.
They get paid by organized crime to carry palm sized card scanners which allows them to obtain your credit card details after you hand it to them.
( Which is why I pay cash only when I eat out these days. I got tired of my card getting compromised. )
Now imagine a telecom who outsources many of their Network Admin jobs overseas where they can pay them pennies on the dollar.
How diffi