I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the passwords in almost all the accounts (like gmail, outlook) etc and hijack everything.

This also defeats 2FA (at least in Google) as anybody who controls my phone number can reset the password of gmail. Once an attacker has access to Google account, they can go on to gain access to almost every other website where my gmail account is the verification mail. This includes AWS or Google cloud where I could then be charged significant amounts of money.

So my first question is how do I prevent this from happening? Is there any way to tell Google to stop using my phone number as fallback for verification or tell them to use something else along with phone number.

2nd question. If this happens, how can I recover my accounts (Google and all the connected accounts) as soon as possible? This will be difficult because the attacker will probably change all my passwords. He/she might also go one step ahead to change the verification emails/phone number, effectively locking me out of my account. Also if I somehow, do manage to gain back the access to gmail, the attacker could meanwhile hijack all my other accounts tied up with gmail and change email id in them preventing me from resetting password there.

  • 2
    Some suggestions to mitigate the problem: 1) Use a different 2nd factor (phone or key-fob) for Gmail and other accounts. 2) Delete all stored verification emails from your Gmail; the attacker will have no info on accounts you use Gmail for verification (until and unless more verification emails arrive). 3) talk to your telecom to determine how easy it is to change your sim # with that company. Change phone company if they don't require verification that you own your phone before doing so. – Mark Ripley Jul 7 '19 at 10:27
  • FWIW, Gmail itself doesn't force you to use your phone for 2FA; you could use e.g. Google Authenticator (or Duo, or any other 2FA app...) to protect your email. Any services where you get 2FA confirmation via SMS would still be vulnerable, but it'd at least protect you a bit more. – Fund Monica's Lawsuit Jul 7 '19 at 19:58
  • @NicHartley Phone number is enabled in 2fa by default. Is there a way to disable it? – coderDude Jul 7 '19 at 20:21
  • 1
    @coderDude It's under your normal 2FA options. Add any other method, then click the little pencil next to "Phone", then click "Remove Phone". You can also use a hardware security key or, if you have an Android phone, you can have it sent through Android so you tap a button instead of entering a code. – Fund Monica's Lawsuit Jul 7 '19 at 21:42
  • @NicHartley Tx. Did that. Is there any way to disable text message for forget password also? – coderDude Jul 8 '19 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.