2

There are several posts like these:

https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd

https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-instagram-email-tmobile

How does one protect themselves against an attack like this?

What are the specific logistics behind services or phones or technologies that can be used to create a structure which isn't vulnerable to this? And how does the data flow through it?

Also, how do high risk people like celebrities handle stuff like this?

Edit

These are the things that are most critical to protect

  1. Cellular account if used for any SMS (but maybe it can be avoided entirely by only using email recovery?)
  2. A "root" email account that is for recovery
  3. Domain accounts (eNome, namecheap, etc)
4

One of the main culprits for allowing this to happen is the marketing of 2FA as something more secure than just maintaining consistency with already well known security practices. The simple answer to your question is, don't use SMS based 2FA.

The longer answer to your sub-questions are:

  • Hedge your account credentials!
  • Don't connect your social network accounts with foolish easy-login features, like that provided by using Facebook and Google logins.
  • Compartmentalize your accounts according to importance. I.e. (Don't use the same Google account for your Banking operations as you use to signup to random websites.) For example:

    1. Banking & Assets
    2. Gov't Services
    3. Social Networks
    4. Random Web-site signups
    5. IoT / Mobile Device use
  • Avoid any SMS related service if possible (rather insist using Signal)

  • Use anonymization providers for temporary/disguised emails, Temp Credit Cards etc.
  • Another strategy is to use a phone number not normally associated with you such as a Google voice phone number. Or if it's allowed a land line that doesn't accept SMS to totally prevent that risk. – Daisetsu Oct 12 '18 at 22:53
  • 1
    so would you not use a phone for any recovery options, just a private email? – Uzimoto Oct 13 '18 at 1:28
  • A private email is more secure, because mobile networks are terribly insecure. Possibly using a phone from a trusted person, not in your own mobile (cell coverage) area. As you can hear, things get very tricky fast, when dealing with mobile network security. – not2qubit Oct 13 '18 at 16:42
  • 1
    I'm not satisfied iwth any of these answers really but I'll just mark this as the winner because no one else is answering – Uzimoto Oct 15 '18 at 18:43
0

You cannot fix the phone companies, and you cannot force the organizations you deal with to use strong authentication. The most effective protection is to use something other than a phone as a second authentication factor. Sometimes, this is a choice you can make on a system by system basis under names like "Use an app for authentication."

  • Many phone companies these days do provide special security options to protect against sim-jacking. Whether or not these methods are effective is another question of course, but either way I think you can't seriously attempt to answer the question "How do I prevent simjacking" without mentioning the security options that phone companies do indeed provide. – Conor Mancone Oct 12 '18 at 16:28
  • I was hoping for a little more specific answer, because I actually want to put this into practice. I'd also mark an answer if someone links me to an article with a detailed walkthrough. I'm looking for something such as.... "set up a gmail account with no phone SMS, choose printed recovery codes, print them out and put them in a safe in multiple locations. now use that email as your recovery email for all your services. when faced with a choice of A) sms or b) 2 factor auth app always choose B, if B isnt available then do ........."... this is a hypothetical answer but you get the idea – Uzimoto Oct 12 '18 at 16:49
  • For things like a bank or paypal, it's not as big of a threat of those get hijacked because they're insured. The biggest problems imo come down to A) Your "root" email that you use as the recovery email for everything, including B) your cell carrier account. If either of those are hijacked that's where things get bad. I considered a "burner" phone but it makes me nervous using a 2nd rate carrier as my single lynch pin that holds the entire thing together. Who knows if some schmuck migrates my burner number or something.. I trust that way less than AT&T not messing up the number – Uzimoto Oct 12 '18 at 16:52
  • the last one would be C) your domain registrar... I think for the most part everything else is a lot lower priority. and D) crypto stuff, but thats something I don't want in this answer because I don't care about that for this specific question, that is an entire beast altogether – Uzimoto Oct 12 '18 at 16:52
  • I've also heard google voice can be a good option for recovery #, but I don't know all the specifics which is why I was asking. – Uzimoto Oct 12 '18 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.