Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Scammers Work Around Two-Factor Authentication With Social Engineering

Unknown Lamer posted more than 2 years ago | from the duh-you-need-three-factors dept.

Australia 186

mask.of.sanity writes "Thieves have made off with $45k after they intercepted a victim's two factor online banking codes used to verify large transactions. The scammers got the Australian executive's mobile number from his daughter, and work place details from his willing secretary. Armed with this data, they bluffed Vodafone which ported his phone number, meaning the criminals could verify the bank's two factor verification codes generated during their spending spree and the victim never knew a thing."

cancel ×

186 comments

Sorry! There are no comments related to the filter you selected.

Victim never knew a thing? (1, Interesting)

icebike (68054) | more than 2 years ago | (#38276530)

Including that his phone didn't work any more?

Was he traveling out of country or what? That must have been one fast shopping spree.

Re:Victim never knew a thing? (5, Informative)

Fjandr (66656) | more than 2 years ago | (#38276534)

He received an SMS which he believed to be from Vodaphone, stating that they were having network difficulties and he would experience loss of cell service for the next 24 hours.

What's the point of this story? (0)

Anonymous Coward | more than 2 years ago | (#38276760)

While some are better than others, no form of security is absolutely 100% perfect in every way. In case you hadn't noticed. News at 11.

Re:What's the point of this story? (5, Interesting)

bill_mcgonigle (4333) | more than 2 years ago | (#38276832)

The point is that if you trust your cell phone to be a 2nd authentication factor for your banking, you've contracted out your security to [the dumbest customer service rep at] your mobile carrier.

Also, being broke is probably a pretty good strategy for avoiding these kinds of problems.

Re:What's the point of this story? (4, Funny)

Arancaytar (966377) | more than 2 years ago | (#38277096)

Also, being broke is probably a pretty good strategy for avoiding these kinds of problems.

If you're not broke, you don't need to worry either, because the scammers can soon fix that.

Re:What's the point of this story? (0, Flamebait)

justforgetme (1814588) | more than 2 years ago | (#38277172)

Well, that all might be true but
1) that is not a hole in auth, it is a policy hole in the fourth party (carrier)
2) I believe, since the carrier is bound legally to the person with a contract to allow him and only him to use that telephone number, they should be fined a humongous sum and charged for criminal offenses for a) toying with customer private data b) invalidating their contract to said customer c) not having clear policy for such things d) being a company while apparently they can't even approximate the digestive output of a monkey having eaten rotten bananas. Another way to handle such mishaps would be to stone the rep along with every single one of his superiors. public skewering might also work. ...
Damn did I get infuriated by this!

Re:What's the point of this story? (1)

sortius_nod (1080919) | more than 2 years ago | (#38277398)

You're missing the point of the GP's post. You rely on the fourth party, but really, you know little about their security requirements. I personally refuse to use 2 factor unless it's via a time sync key (can be done easily via a phone app) as any message being sent to you can be intercepted in various ways.

Re:What's the point of this story? (4, Interesting)

GrpA (691294) | more than 2 years ago | (#38277642)

Not True. The product is AFAIK, A Telstra product under which they use SMS to provide a "token" as an additional factor.

Given that there have been many confirmed examples of MNP ( Malicious Number Porting ) in Australia, this is known weak security. Under the circumstances, its entirely reasonable to assume that the Bank knew this was likely.

However I can't see them rushing out to address the issue in the near future. In fact, with some banks, it's impossible to turn off the ability to transfer out large sums of money. You can turn it off easy enough, but anyone who accesses the system can turn it back on by default by clicking a screen saying you agree to the risk. :(

All the major banks in Australia have this form of security. On the other hand, all the credit unions ( everyone except the "Big 4" Banks ) use VIP ( Verisign Identity Protection IIRC ) which can be downloaded to most smartphones and works as a soft-token.

Security in Australia, as with much of the world, is severely compromised by CEOs and CTOs who really don't understand it and as long as they can blame someone else, then due diligence is done.

GrpA

Re:What's the point of this story? (3, Interesting)

Bert64 (520050) | more than 2 years ago | (#38277734)

1) no it's a hole in the auth, since they used a known weak method that relies on the security of the telco over which they have no control

2) the problem is how do they authenticate that it is the customer requesting the number porting?
Most likely they will ask some "security questions" over the phone which a good social engineer will know the answers to...
If doing it in person in a shop they just ask for a signature, which ofcourse is totally arbitrary and trivially easy to fake...

Even if the telco has strict policies, how is the actual number porting carried out? Usually it is based on carriers trusting each other not to submit rogue requests, so all it needs is one rogue or compromised carrier...

Re:What's the point of this story? (1)

Mitchell314 (1576581) | more than 2 years ago | (#38277384)

From personal experience, I can inform you that it's not. If your account has some positive number in it, I can assure you there's a sea of pricks waiting to empty it, no matter how small.

Re:What's the point of this story? (1)

DarwinSurvivor (1752106) | more than 2 years ago | (#38277778)

Unless you have credit, in which case they'll just max THAT out.

Re:What's the point of this story? (5, Interesting)

rtfa-troll (1340807) | more than 2 years ago | (#38276894)

no form of security is absolutely 100% perfect in every way..

Right; but that's not something new. No bank vault has ever been 100% safe either. The difference is that the bank takes responsibility for that so they ensure that it's "good enough", whatever that means. If money gets stolen from the bank vault they don't say "oh that was money from your account; sorry". With electronic security, there's often a level where they blame the failure of their own security measures on "identity theft" and make it the customer's responsibility. Two factor authentication of this kind is fine for a transaction of a few thousand dollars; It's not enough for transactions of hundreds of thousands of dollars. For 45k AUD that's a judgement call. `

This case is not like most American and some European banks though; Commonwealth Bank discovered the problem its self, is paying off the cost of the transaction and, even so, warned their customer. When they take the responsibility for the losses then what systems to use or not use become their commercial judgement. They looked at an MNP security system and decided there was something wrong with it. Maybe they now change their mind, maybe not. That's exactly the right thing. Hopefully they can persuade Vodafone to at least send a text message warning customers that their number is being ported before they actually do it in future.

Re:Victim never knew a thing? (2, Funny)

tdelaney (458893) | more than 2 years ago | (#38277080)

Considering it's the Vodafail [vodafail.com] network, a 24-hour outage would be considered normal service.

Re:Victim never knew a thing? (1)

w0mprat (1317953) | more than 2 years ago | (#38277094)

Porting between carriers and devices, in most cases, requires so little authentication it's rather disturbing. It does not require any meaningful ID of the person before proceeding or at least I'm not aware of a carrier that does.

Re:Victim never knew a thing? (3, Insightful)

93 Escort Wagon (326346) | more than 2 years ago | (#38277538)

Porting between carriers and devices, in most cases, requires so little authentication it's rather disturbing. It does not require any meaningful ID of the person before proceeding or at least I'm not aware of a carrier that does.

But the problem is - post Ma Bell, when the carriers used to make the customer jump through numerous hoops and bend over backwards before they'd allow you to port your number to a different company, people screamed bloody hell. This current state of affairs is the way it is because it's basically what the customers (and their politicians) demanded.

I'm not saying it's right - just that it's not completely the carriers' fault.

Re:Victim never knew a thing? (0)

Anonymous Coward | more than 2 years ago | (#38276546)

FTA: "As the port request was processed, the criminals sent an SMS to Craig purporting to be from Vodafone. The message said that Vodafone was experiencing network difficulties and that he would likely experience problems with reception for the next 24 hours. This bought the criminals time to commit the fraud."

Re:Victim never knew a thing? (5, Funny)

srjh (1316705) | more than 2 years ago | (#38277076)

As someone on Vodafone in Australia, this should immediately have started ringing alarm bells.

No way they'd have the problems fixed in 24 hours.

must post before I even read the article :) (2, Insightful)

Anonymous Coward | more than 2 years ago | (#38276586)

"George Craig .. was told that his .. mobile phone .. was used as a tool in the attack .. the criminals sent an SMS to Craig purporting to be from Vodafone. The message said that Vodafone was experiencing network difficulties and that he would likely experience problems with reception for the next 24 hours" link [scmagazine.com.au]
 

Re:Victim never knew a thing? (-1)

Anonymous Coward | more than 2 years ago | (#38277110)

He was with Vodafail [vodafail.com] .

He wouldn't be all that suspicious about the network not working any more.

Account security (4, Insightful)

Fjandr (66656) | more than 2 years ago | (#38276566)

This just goes to show that you should always have additional protections in place for protecting accounts (in this case, a mobile number) that can be used to control, secure, or otherwise materially modify other important accounts.

Re:Account security (1)

Pubstar (2525396) | more than 2 years ago | (#38276616)

Thinking about the attack that they did, even the way Chase has to send a verification code every time you log in to a different computer would be useless against this attack. They could just have it send the verification code to the phone through SMS.

Re:Account security (4, Insightful)

enoz (1181117) | more than 2 years ago | (#38276722)

A Hardware Token (such as RSA Securid) would have prevented TFA's fraud. SMS is clearly not a good replacement for real Two-Factor authentication, though it is cheap for the banks to implement compared to other options.

Re:Account security (5, Insightful)

LordLucless (582312) | more than 2 years ago | (#38276788)

SMS is clearly not a good replacement for real Two-Factor authentication

Two-factor auth isn't a panacea. SMS (or rather, mobile numbers) are real two-factor authentication - or, more accurately, they are a valid second factor. Something you know, something you have, something you are - pick any two. Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.

The fail at this point wasn't that the bank implemented security poorly - it's that the Telco did. They didn't even have one-factor authentication. They asked for two points of information - customer number and DOB - neither of which can reasonably be considered a secure secret. Even then, the Telco is following the process that it has been mandated to follow by the government - including the data that should be used to verify identity. If the government are going to mandate requirements for business processes, then they should either be damn sure what they're mandating is secure, or they should explicitly leave security implementation up to the business.

Re:Account security (3, Insightful)

jamesh (87723) | more than 2 years ago | (#38276932)

Two-factor auth isn't a panacea. SMS (or rather, mobile numbers) are real two-factor authentication - or, more accurately, they are a valid second factor. Something you know, something you have, something you are - pick any two. Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.

It sure does. You might say it's the Telco's fault for allowing the service churn to happen, but this lack of security is widely known which makes the SMS as a second factor all but useless, and the banks are stupid for allowing it.

Re:Account security (4, Interesting)

bloodhawk (813939) | more than 2 years ago | (#38277160)

Two-factor auth isn't a panacea. SMS (or rather, mobile numbers) are real two-factor authentication - or, more accurately, they are a valid second factor. Something you know, something you have, something you are - pick any two. Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.

It sure does. You might say it's the Telco's fault for allowing the service churn to happen, but this lack of security is widely known which makes the SMS as a second factor all but useless, and the banks are stupid for allowing it.

You are confused. SMS to your mobile IS TWO FACTOR AUTH. just because it sucks doesn't make it not two factor auth. Besides when directly targetted there are very few good two factor auths that are practical that can't be defeated by a well targetted scam such as this. RSA/Vasco tokens can be stolen as can Smartcards or USB keys and when you are talking about scams in the amount of this article then the theft of a token isn't that much of a reach either. It isn't like it takes long to empty a bank account.

Re:Account security (2)

jamesh (87723) | more than 2 years ago | (#38277354)

You are confused. SMS to your mobile IS TWO FACTOR AUTH

you said "Password and mobile number is a reasonable choice. The fact that your mobile number is (apparently) so easily stolen doesn't negate this.". I said "It sure does". I wasn't disputing that password+mobile number was two factor auth, I was disputing that it was a reasonable choice.

I may be a bit out of date here but I thought that sniffing an SMS wasn't really that difficult for a sufficiently motivated criminal... but maybe it's sufficiently difficult with today's 3G networks? Last time i checked most carriers didn't encrypt GSM communications, which makes the second factor more about the SMS itself than the phone number.

Re:Account security (1)

93 Escort Wagon (326346) | more than 2 years ago | (#38277542)

It sure does. You might say it's the Telco's fault for allowing the service churn to happen, but this lack of security is widely known which makes the SMS as a second factor all but useless, and the banks are stupid for allowing it.

Google promotes it as well - is it okay to call them stupid in this case, or do we still give them a pass?

Re:Account security (0)

Anonymous Coward | more than 2 years ago | (#38276958)

or the business could maybe go out on a limb, spend some executive bonus pool money, and maybe take some responsibility on its own and try to do a bit better than what was mandated. at least in yhe us the mandated requirements are not likely to have been handed down from on high, but instead exactly what they proposed just to get congress or the regulators off their backs...
but this would take an executive team to look a bit past their country club social instincts, sacrifice a bit of the sociopathic "shareholder value" today, etc. oh, and take responsibility.

Re:Account security (1)

Hognoxious (631665) | more than 2 years ago | (#38277038)

SMS (or rather, mobile numbers) are real two-factor authentication - or, more accurately, they are a valid second factor. Something you know, something you have, something you are - pick any two.

The phone number isn't something you have. It's something that anybody could have.

Re:Account security (1)

LordLucless (582312) | more than 2 years ago | (#38277104)

The same could be said about anything. The seed for your token generator isn't something you have - it's something anybody could have.

Re:Account security (1)

Jeremi (14640) | more than 2 years ago | (#38277254)

The seed for your token generator isn't something you have - it's something anybody could have.

Err, how? (Besides physically stealing your token generator, I mean)

Re:Account security (1)

LordLucless (582312) | more than 2 years ago | (#38277498)

It all depends on the security of the authority that issued you your generator - much the same as your mobile number. If they hand out your generator seed willy-nilly - the way telcos appear to do for mobile number porting requests - you're just as vulnerable.

The issue here isn't that the technology wasn't good enough, it's that the trusted authority shouldn't have been trusted.

Re:Account security (0)

Anonymous Coward | more than 2 years ago | (#38277800)

However there's a difference here: There are cases where you legitimately want to transfer a phone number to a different phone. However there are no cases where you legitimately want to transfer a hash seed to another generator. Of course the bank also needs your hash seed to generate the code, but then, if the bank's computer is cracked it's probably easier for the attackers to just access your account directly.

Re:Account security (0)

Anonymous Coward | more than 2 years ago | (#38277424)

What he wanted to say is "your phone number is not a physical item". Thus it is not really two-factor authentication in the usual sense, it uses something you know and something someone else temporarily mapped to you, with that mapping being entirely outside your control.

Re:Account security (0)

Anonymous Coward | more than 2 years ago | (#38277658)

Since when was receiving a validation code over insecure unencrypted PSTN connect and then over GSM/CDMA considered a "what you have" factor? No, it's just another "what you know factor" which makes a total combination of two. Not proper two-factor authentication, at least time-synced tokens with one way hashing can at least emulate "what you have".

Re:Account security (1)

iluvcapra (782887) | more than 2 years ago | (#38276870)

Unfortunately zero banks in the US (or Australia) offers SecurID. PayPal does, but they don't really offer modern bank features, like bill pay or check/"cheque" writing, and the average bank wouldn't want to support such a thing, because there's no demand and it would intimidate customers -- irrationally, but so what? You'd need a bank reg.

Stories like this make me want to put all my money in Bitcoins. I HATE the whole Bitcoin concept and think its a crock, but with a Bitcoin at least I'm in charge of the security policy.

Re:Account security (0)

Anonymous Coward | more than 2 years ago | (#38276930)

Etrade has SecurID.

Re:Account security (1)

jamesh (87723) | more than 2 years ago | (#38276938)

Unfortunately zero banks in the US (or Australia) offers SecurID

I've had a token (not RSA but equivalent) for years for my bank account in Australia.

Re:Account security (1)

iluvcapra (782887) | more than 2 years ago | (#38276988)

Maybe I spoke too soon.

Re:Account security (0)

Anonymous Coward | more than 2 years ago | (#38277044)

I'm using a Vasco token with HSBC Australia ... (not advertising either .. just sayin' ..)

Re:Account security (1)

iluvcapra (782887) | more than 2 years ago | (#38277060)

I'm an HSBC customer in the US, after scouring their site I can find no mention of tokens or SecurID. It's annoying.

Re:Account security (4, Informative)

tsotha (720379) | more than 2 years ago | (#38277124)

Bank of America offers [bankofamerica.com] something they're calling a "Safepass Card", which looks suspiciously like SecurID to me.

Re:Account security (1)

cyssero (1554429) | more than 2 years ago | (#38277682)

Wrong, the Commonwealth Bank (bank in TFA ) offer 2FA hardware tokens [commbank.com.au] (à la SecureID) as an alternative to NetCode (the 2FA used in this instance). They offer this primarily to customers travelling overseas (and can't/don't want roaming) or those who are frequently out of coverage zones.It's free, too.

Re:Account security (1)

jonwil (467024) | more than 2 years ago | (#38277732)

Both HSBC Australia and the Bendigo Bank offer hardware tokens.

Re:Account security (1)

thegarbz (1787294) | more than 2 years ago | (#38277770)

Erm there's many banks that offer SecurID in Australia:
Suncorp
Westpac
NAB
ANZ
Commonwealth Bank offer them to limited customers only.

As for the US I think Citigroup uses them too.

Re:Account security (2)

mjwx (966435) | more than 2 years ago | (#38276940)

This just goes to show that you should always have additional protections in place for protecting accounts (in this case, a mobile number) that can be used to control, secure, or otherwise materially modify other important accounts.

I agree, but the average person does not unfortunately.

The average person will view this as the bank trying to get in the way of them and their money. In Australia there will be huge sensationalised reports about the EVIL BANKS stealing from hard working Aussie battlers and keeping all that dastardly profit for themselves where as in reality, the new security measures cost more to implement but the real problem is Bazza from Frankston is too dumb and lazy to learn how to keep his cash secure.

So the system we have is probably the best system we're going to get. Its the worst the dumbest will put up with. They dont care about their own security, hence the bank has to protect them.

In either case, the fraud victim will get their money back, telco's will make it harder to port numbers over. As far as attacks go, this one takes a lot of effort and some money to start. Futher more, it requires the hacker to live in Australia and register their SIM card in Oz (which you require photo ID to buy, well in theory anyway). So to find the attackers, they need to locate the SIM (telco's will turn that over without question) then ask the Telco who bought the SIM and what ID they used.

Re:Account security (1)

Fjandr (66656) | more than 2 years ago | (#38277142)

Given how much is being linked to a cellular number, I actually would support making number portability more difficult (in that securing a process almost always makes that process more difficult/complex).

Unfortunately, politicians seem to swing from one extreme to another with little in between, so any regulations mandating increased security are likely to either be completely ineffective or much more inconvenient than necessary.

Something like SIM registration seems like it would go a long way toward combating this sort of hijacking, and should be relatively easy to implement.

Re:Account security (2)

mjwx (966435) | more than 2 years ago | (#38277154)

Given how much is being linked to a cellular number, I actually would support making number portability more difficult (in that securing a process almost always makes that process more difficult/complex).

Something like SIM registration seems like it would go a long way toward combating this sort of hijacking, and should be relatively easy to implement.

We've go the same problem as with the banks. After banks and speed cameras, telco's are the favourite targets of the sensationalist bollocks brigade.

Any move to make it more secure will be met with scorn and venom from anyone who doesn't want to understand why it's happening. Right between signing up for the Vodafail page and complaining about how bad their teclo is.

Re:Account security (1)

jonwil (467024) | more than 2 years ago | (#38277440)

Considering my mobile number was previously registered with Vodafone in my mums name (at the time I signed up, I didn't have enough credit history to get a postpaid plain in my own name) and I was recently able to switch it from Vodafone to TPG Mobile without either entity seeing any kind of actual ID (and I dont remember providing ID when I first signed up to TPG for ADSL either) I doubt that there are as many requirements on getting a SIM card as there should be.

Re:Account security (0)

Anonymous Coward | more than 2 years ago | (#38277074)

My bank uses paper. The codes for confirming operations are on a piece of paper and behind a scratch-to-read protective layer. Sure, it can be stolen, but I usually notice it when somebody breaks into my house, as opposed to having no reliable way to check if my phone or PC has been broken into.

Not Thieves (4, Funny)

Anonymous Coward | more than 2 years ago | (#38276584)

They didn't steal anything real.

I don't believe in imaginary property.

Re:Not Thieves (3, Funny)

CohibaVancouver (864662) | more than 2 years ago | (#38276596)

I don't believe in imaginary property.

Please send me all your money, via wire transfer. Thank you.

Re:Not Thieves (1)

gnawingonfoot (2170666) | more than 2 years ago | (#38276652)

I don't believe in imaginary property.

Please send me all your money, via wire transfer. Thank you.

Clearly he doesn't have any--otherwise he wouldn't feel that way.

Re:Not Thieves (5, Insightful)

TheVelvetFlamebait (986083) | more than 2 years ago | (#38276666)

Whoosh!

Money stored electronically at the bank is one of the classic counterexamples to the belief that all property is (or should be) tangible. The GP is taking a dig at people who subscribe to this view.

Re:Not Thieves (1)

bill_mcgonigle (4333) | more than 2 years ago | (#38276804)

Money stored electronically at the bank is one of the classic counterexamples to the belief that all property is (or should be) tangible

You mean the kind that gets inflated away to worthlessness?

Re:Not Thieves (1)

Calos (2281322) | more than 2 years ago | (#38276902)

Yeah, the same as the little slips of paper-cotton blend and the hunks of worthless metal that represent their physical counterparts.

Re:Not Thieves (1)

TheVelvetFlamebait (986083) | more than 2 years ago | (#38276914)

Yes indeed, the kind that has never once inflated away to worthlessness.

But, if you disagree, I'd be happy to trade my 12 year old car for, oh let's say, 100,000 of those worthless, electronically-stored dollars? Think about it; you give me some worthless, replicable data, and I give you something that will give you at least a year's worth of transport. It's a positive bargain!

Re:Not Thieves (0)

Anonymous Coward | more than 2 years ago | (#38277500)

Well, I'm willing to give you a copy of the data telling the money on my bank account (it's just a number, after all) for your car. Indeed, if the number on my bank account is too small for you, I happily type a much larger number for you. However I demand that the number on my bank account is not modified in the process.

And yes, the data is replicable (indeed, I hope that the bank replicated it in the form of a backup; of course that unfortunately doesn't mean I've got at least twice the money, despite the bank holding that data at least twice). The data on the bank is not the money. The data on the bank only tells me how much money I own. The importance of that data is that it's the way how it is verified that I indeed own that amount of money (reduce that number, and no one will believe me that I indeed own more that that number tells, unless I can prove it with the help of other data).

Captcha: profits

Re:Not Thieves (1)

TheVelvetFlamebait (986083) | more than 2 years ago | (#38277570)

However I demand that the number on my bank account is not modified in the process.

Can you give me an explanation as to why you would make that demand (you could be jeopardising your free car)? For a worthless piece of data, you seem awfully possessive of it.

The data on the bank is not the money. The data on the bank only tells me how much money I own.

That's fair enough. Could you tell me why you should get any control whatsoever of this piece of data which is stored on the bank's private property? Why should they not be allowed to change the number at their whim? I mean, if they decided to set the number to 0, it's not like you've lost anything. You had no money before, and you have no money now. The only thing that's changed is the potential to gain money. But as we all know from multiple discussions about the **AA and copyrights, potential to gain money is not worth anything real, and should not be protected by law. Or am I missing something here?

Re:Not Thieves (0)

Anonymous Coward | more than 2 years ago | (#38277448)

Money is made property through laws. The property is not the bit pattern on the bank's computer (you don't own the number on your bank account, you own the amount of money given by that number). Money on your bank isn't naturally property (there's nothing which would physically stop you from increasing one account without decreasing another), it's made property-like through rules (it simply is forbidden to create money that way).

OK, so how is this different from ideas, which are also made property-like by law? Well, simple: The value of money to society would be actually zero if it were not protected by law. Money has value exactly because it is protected. However the value of ideas to society would increase if they were not protected. Of course the protection increases the ability for the individual to profit from an idea (actually, as it is handled currently, even that is not true; it's only the big corporations which are able to profit from protected ideas). But individual profit at the cost of the society is nothing which should be encouraged.

Re:Not Thieves (1)

TheVelvetFlamebait (986083) | more than 2 years ago | (#38277546)

Clearly you accept that valuable items need not be tangible. And, from what I can tell, you accept that some intangible items should be subjected to property laws. You've now gone to the next logical step which is to argue that ideas specifically should not be treated as property. The theme of this argument is that ideas are more valuable with less restrictions on them, which is undeniably true. An idea benefits only those who can access its implementation, and the more freedom they have to use and play with the idea, the more likely they are to develop some of their own.

None of the above is in any serious dispute. The problem arises from cultivating ideas in the first place. Plenty of people can have some kind of a brainwave along the lines of "Wouldn't it be cool if ...", or perhaps mentally work out some of the details. However, it is a lot less common to find someone with the knowhow, the means, and the opportunity to make an idea come into fruition. This, of course, depends heavily on what the idea entails, but always the implementation is harder to foster than the idea.

None of my inventions came by accident. I see a worthwhile need to be met and I make trial after trial until it comes. What it boils down to is one per cent inspiration and ninety-nine per cent perspiration. -- Thomas Edison

The 1% is cheap, and the rest is where almost all the value lies. This is the part that we support with intellectual property laws. As valuable as an idea without restrictions may be, the often overlooked genesis of the idea must be protected or encouraged somehow, because otherwise it makes no economic sense to expect people to put themselves through it. If we can find a way to protect the 99% of invention, while making ideas more free, I would support it 100%. Otherwise, I will stick with the best system we have until a demonstrably better one comes along.

By the by, not only corporations make money off ideas. Counterexample? Minecraft.

Re:Not Thieves (5, Insightful)

TheVelvetFlamebait (986083) | more than 2 years ago | (#38277616)

Sorry to double post, but I wanted to add something extra (not that it contradicts your viewpoint in any way). All property is artificial. It's an abstraction of possession that's protected by law. Let's say that I have a banana, and you take the banana from me, with no previous arrangement made between us. I now no longer possess the banana, but you do. What is there in the natural world to say that I "own" the banana and not you? Clearly possession is not enough.

Our laws define ownership. Without them, natural law would basically be along the lines of "It's yours until someone stronger takes it". People tend to place far too much importance on possession, not realising that what really underpins property is a complicated series of laws, without which property would hold no weight. It is but another reason why picking on intellectual property purely because it refers to something intangible is not really a valid concern (not that you do that, of course).

Social engineering is cheating (3, Funny)

Anonymous Coward | more than 2 years ago | (#38276630)

Magically hacking everything is so much more interesting.

physical card; sms and l/p (0)

Anonymous Coward | more than 2 years ago | (#38276638)

I guess this is why, we have SMS auth, your banking login/pw and a per-contract physical card with a grid coordinate numeric system.

The physical card could be duped assuming one would know the algorithm to generate such information and what coord the website is taking for that particular transaction, but that seems too be too much hassle as we have not had any such case reported thus far.

Re:physical card; sms and l/p (2)

viperidaenz (2515578) | more than 2 years ago | (#38276794)

I don't believe those cards have their numbers generated by any algorithms, its a randomly generated grid of characters. You need physical access to the card - like stealing someones wallet, copying it and returning it before they notice its missing

Re:physical card; sms and l/p (0)

Anonymous Coward | more than 2 years ago | (#38277412)

If someone is keeping it in their wallet it would be easier than you might think, you can read cards without physically swiping them through a traditional card reader, especially the not so common no-swipe enabled cards.

The Blame Game (5, Informative)

enoz (1181117) | more than 2 years ago | (#38276642)

So the banks say it's not their problem, it's the fault of mobile operators for making numbers portable. Yet the banks were offered access to the national mobile database so they could check if a number was recently ported, but declined to use the information. Meanwhile the fraudsters are getting away with their winnings...

Re:The Blame Game (5, Interesting)

xous (1009057) | more than 2 years ago | (#38276708)

It wouldn't make a significant difference even if they did.

There are thousands of examples of carriers being tricked into forwarding numbers by 3rd parties. I do it all the time for customers that port into us if something goes wrong with the porting process.

Often all I do is:
1. Identify myself as $MYNAME from $MYCOMPANY. (NOT $THEIRCLIENT)
2. State that I'm calling on behalf of $THEIRCLIENT.
3. Tell them that $THEIRCLIENT is in the process of moving to our services and need to forward the number temporarily.
4. Carrier asks for the forwarding number and it's generally done in 1-2 hours.

The only shred of validation that might happen is them checking my caller id. I've never needed an account number, billing contact name, authorization code, or anything. Just the phone number.

I've even offered to pay for the forward but been declined because I'm not $THEIRCLIENT. They were happy enough to charge the $THEIRCLIENT on my behalf.

Phones/SMS/etc will never be a reliable way to verify an account holder because it really can be anyone on the other end.

Re:The Blame Game (1)

enoz (1181117) | more than 2 years ago | (#38276748)

But the point is banks could have access to see if a number was recently ported. If they detected a number was ported they could take further action or require additional authentication. The banks choose not to use this information, and customers are defrauded.

Re:The Blame Game (0)

Anonymous Coward | more than 2 years ago | (#38277432)

But the point is banks could have access to see if a number was recently ported. If they detected a number was ported they could take further action or require additional authentication. The banks choose not to use this information, and customers are defrauded.

Right, that is true. But it is not required of them by law in AU (in the US the FCC does have some restrictions) although it would have been wise. However, you're still blaming the wrong people. The phone Carrier is the company who got scammed, not the bank. The bank is actually who caught on to the scam, blocked most of the transfers, and alerted their customer.

The fault lies mostly with the phone company, and also the AU government for not putting any decent regulations into place.
Porting requests get a little bit complicated. You do not call your current carrier to request porting to another carrier, you call a new company and setup services and sign a LOA (Letter of Agency) which they submit to your current carrier for the port-out request. At least that's how it works in the USA.
The process is the same in AU, but not the verification.
From the Vodaphone Q&A site regarding number porting processes:
"If you wish to port your Vodafone mobile number to another network, you will need to contact the new network, who will then arrange the port."

And:
This appears to only require a telco’s customer service representative (call centre agent) to ask some very simple questions – such as a customer number and date of birth – to verify identity.

The problem is that the porting process happens too quickly and without any physical verification of identity on the part of the new carrier.

Re:The Blame Game (2)

LordLimecat (1103839) | more than 2 years ago | (#38277006)

Phones/SMS/etc will never be a reliable way to verify an account holder because it really can be anyone on the other end.

Thats true with ANY kind of authentication, except for some kind of mythical, perfect, no-side-channel-attacks biometrics.

Re:The Blame Game (0)

Anonymous Coward | more than 2 years ago | (#38277140)

The reason 2-factor authentication works is that a would be fraudster has to burglarize the victims home, which is a hoop not many are willing to go though. Making a phone call is trivially easy compared to that.

Re:The Blame Game (1)

Z00L00K (682162) | more than 2 years ago | (#38276796)

This is one reason for me to not trust security solutions using mobile phones.

And if the target has a smartphone it's theoretically possible to intercept text messages and forward them to the perpetrator keeping the victim completely unaware of the attack.

One thing that perpetrators also can use is Over-the-air programming [wikipedia.org] to reconfigure the phone, and as an end user you can't tell if it is your legitimate operator that wants to reconfigure your phone or someone else.

Re:The Blame Game (5, Informative)

rtfa-troll (1340807) | more than 2 years ago | (#38276946)

So the banks say it's not their problem,

No they didn't. They paid up fully and automatically. First they blocked his account:

The team tried – unsuccessfully – to call Craig on his mobile. After several attempts to contact him, Craig’s bank account was frozen. The fraud unit eventually reached him on a landline.

Then they sorted everything out and paid for everything automatically.

Craig is satisfied that CommBank has done everything it can to resolve his specific matter, and he applauded the work of the bank's fraud squad.

They had even been part of a group which had investigated the MNP security fixes available but decided not to implement them because of security problems.

“We explored the Mobile Number Portability Database and decided not to progress the solution at the time due to limitations which we believed may have exposed our customers to undue risk," the spokesman said.

I hate banks in general as much as the next man in the times of this crisis induced by some of them but lets at least blame them for the evil things that they really have done. This is not one of them.

Re:The Blame Game (1, Interesting)

mjwx (966435) | more than 2 years ago | (#38277374)

I hate banks in general as much as the next man in the times of this crisis induced by some of them but lets at least blame them for the evil things that they really have done. This is not one of them.

Only because they are forced by the law to do what they did.

Banks can make things incredibly painful for people if they get hurt by fraud if they want to. One of my former bosses with a $20K AUD platinum card from an unnamed 3 letter Aussie bank had almost 19K swiped from it by card copiers a few years back. A lot of crap sent to Thailand, Russia, China and other places we couldn't prosecute. Basically he reported that he didn't make any of these transactions but the bank said they had to investigate. After a few days of being jerked around by the bank he called the Banking and Financial Services Ombudsman (BFSO) who could do little else but force the bank to give him a deadline for the investigation, they did, no more then six weeks.

So for six weeks, my former boss was $19K in debt with a 17% interest rate on that. 5 weeks and 6 days after the BFSO got involved the bank said they will refund the $19K, however they still sent him a bill for the interest as they had passed the 30 day interest free period on that card. Of course my boss fought this, and the bank dragged it out to over 2 months before finally reversing the debt.

So banks will help you if you're a victim of fraud, they'll even do it quickly if you're lucky or the case generates a lot of PR. But dont pretend banks are doing it out of the kindness of their heart. They _have_ to give your money back by law, but they dont have to do it kindly.

Re:The Blame Game (1)

EnempE (709151) | more than 2 years ago | (#38277338)

I believe the government forced the number portability onto the mobile operators in the name of fair competition, so really it is the government's fault ....

... or the butler, somehow that guy is involved.

note that the police have the guys on CCTV but no reported crime from the party that lost the cash (the bank) and hence no reason to continue investigating.

Doesn't two factor mean 2 pieces of info? (0)

Anonymous Coward | more than 2 years ago | (#38276680)

Two factor means 2 pieces of id (what you have, what you know). How'd they get his password (what you know)? Or did the bank decide that one new-technology-Out-Of-Their-Control-factor (what you have) is enough? Cell phone second factor is all cool (and cheap), but it's out of your control. Something like a secure token is much more controllable but unfortunately, more costly.

Re:Doesn't two factor mean 2 pieces of info? (1)

Anonymous Coward | more than 2 years ago | (#38276782)

Really? A $10 Yubikey [yubico.com] is more costly?

Re:Doesn't two factor mean 2 pieces of info? (1)

Mr. Freeman (933986) | more than 2 years ago | (#38277156)

Cheap 2 factor isn't too costly, but it's less secure. The more secure ones, like RSA, cost about $100 per token. (Although, how secure those are is really up for some debate since they fucked up a few months ago).

Complicated fraud.... (0)

Anonymous Coward | more than 2 years ago | (#38276790)

This is nothing but social engineering and lax security resulting in very minimal loss for the bank. It would cost more banks to address the issue than simply pay off damages.

You'd never hear about real cases, where perps create reverse lookup tables, clone cards and clean banks for millions, because that would really make you, the consumer, doubt security of financial institutions.

CBA Security is ok. (3, Informative)

Whiteox (919863) | more than 2 years ago | (#38276816)

To operate with that bank on-line, you need an Internet acc number (which is different to a normal account number), and at least a password. Additional secret question knowledge is required for 2 answers to set up a new transfer. Then, and only then is the SMS verification code needed. He must of been very slack to have made all that info available to the scammers.
Congrats to the bank to have picked it up. It's not the $45000 'raising a red flag' either. Once they rang me for confirmation because I sent a donation to a German software foundation - it was only $20.

Re:CBA Security is ok. (1)

mjwx (966435) | more than 2 years ago | (#38277344)

To operate with that bank on-line, you need an Internet acc number (which is different to a normal account number), and at least a password. Additional secret question knowledge is required for 2 answers to set up a new transfer. Then, and only then is the SMS verification code needed. He must of been very slack to have made all that info available to the scammers.
Congrats to the bank to have picked it up. It's not the $45000 'raising a red flag' either. Once they rang me for confirmation because I sent a donation to a German software foundation - it was only $20.

I've had United Community shut down my card because it was used in a Thai ATM. Thailand is not an unusual destination for Australians (for those in other nations playing along). I rang them at my expense (OK, about A$0.5 a minute, but still) and they said they would not unlock the card even though I could verify I was in Thailand and still in possession of the card. For the rest of that trip I had to go into bank branches to withdraw money, with passport and all.

As a side effect, I learned there is a nice Thai lady who works at Siam Commercial Bank with the same birth date as me.

As a more permanent fix, I withdrew my funds out of United Community the day I got back and closed all of my accounts. I'm with NAB now, despite a lot of small complaints (mostly around their internet banking site and SFA branches open on a Saturday) they've performed to expectations. Also, NAB Gold is great for travelling and shopping overseas (0% currency conversion fee).

was this really two-factor? (1)

MikeyO (99577) | more than 2 years ago | (#38276822)

This wasn't a failure of "two-factor authentication" this was a failure of the bank to have actually require two factors. It seems that the bank was relying on one of the two factors to be a "something you have" factor, which was the client's mobile phone, when in reality it was just another "something you know" factor. The "something you know" being just the phone number itself.

Re:was this really two-factor? (1)

blacklint (985235) | more than 2 years ago | (#38276866)

No, the scammers convinced the victim's phone company to transfer the number to a different account. Meaning they then had control of the second factor.

Re:was this really two-factor? (2)

BradleyUffner (103496) | more than 2 years ago | (#38276970)

No, the scammers convinced the victim's phone company to transfer the number to a different account. Meaning they then had control of the second factor.

I'd argue that an account doesn't satisfy the intent of the "something you have" part of 2 factor authentication. "Something you have" seems like it should be something physical, not a non-physical entity such as a phone account. If it could be tied to the physical cell phone via hardware ID it could work.

People are so careless about security (1)

Cherubim1 (2501030) | more than 2 years ago | (#38276900)

This fraud should not have occurred if the victim had been more vigilant about his online security. The crooks would, in addition to obtaining an sms token, have to also obtain a valid userid and password. Clearly, if they were able to get both of these details using social engineering or a keylogging trojan then the victim must be a careless and clueless idiot. He admits tio using an insecure machine for his online banking and is surprised at the outcome ? This is another good reason why a trusted and secure OS like Linux makes more sense for online banking.

Re:People are so careless about security (0)

Anonymous Coward | more than 2 years ago | (#38277252)

HAte to break it to ya, but there are a butt load of keyloggers for Linux too. If you want to live in a bubble of ignorance then you are the sort of person the next article will be about.

Re:People are so careless about security (0)

Anonymous Coward | more than 2 years ago | (#38277604)

The most secure solution would be to have a separate computer only used for online banking, booting from a readonly medium, and having nothing installed which isn't needed to access the bank account. Of course few people are going to go to that extreme.
But thinking about it, a netbook running a well configured Linux system used only for online banking should come close to this. Not really readonly, but I guess with SELinux you could get close.

Check out CitiBank: (0, Funny)

Anonymous Coward | more than 2 years ago | (#38276956)

CitiBusiness Online [citigroup.com]

I'm in the process of moving everything here as they have the best security I've seen of any bank. Their customers laugh at this article.

Steam & Netcode. (0)

Anonymous Coward | more than 2 years ago | (#38277012)

NetCode is a form of two-factor authentication that issues Commonwealth Bank’s online banking users with SMS messages before allowing them to transfer large amounts of money to unfamiliar accounts. When a new, large or unorthodox transaction is attempted online, the bank sends a verification code to the account holder’s mobile number. The code is then typed back into the online banking section as an additional authentication measure.

Doesn't Steam use Netcode when you use a different browser than it's expecting? What about Google?

The first factor (4, Insightful)

wvmarle (1070040) | more than 2 years ago | (#38277042)

Everyone is focusing on just the (in)security of the second factor, the telephone number, but what's missing from this story is that the scammers obviously also got their hands on much more information from this person first: they knew his bank login details (account name, password), and they knew his daughter's identity and managed to contact her.

The solution for SMS as my bank implements it, is that SMS is never sent to a forwarded number. That's arranged between the bank and the carriers or so, I don't know the technical details, but SMS is sent only to the original number. That's already a safeguard against arranging numbers to be forwarded, which other commenters note is quite easy to accomplish.

Anyway it is the classic story of when something goes wrong, it's usually not a single issue that went wrong. It's almost always an array of factors that have to come together "just right" to make it work. While it may be a good idea to review the security of the SMS as second factor, one should also look at how the criminals got their hands on the first factor and the rest of the information.

Re:The first factor (2)

jareth-0205 (525594) | more than 2 years ago | (#38277282)

The solution for SMS as my bank implements it, is that SMS is never sent to a forwarded number. That's arranged between the bank and the carriers or so, I don't know the technical details, but SMS is sent only to the original number. That's already a safeguard against arranging numbers to be forwarded, which other commenters note is quite easy to accomplish.

This isn't the same as number porting. Porting is rerouting a number to a different SIM card, effectively permanently changing the network operator for a paritcular number. Many customers will have this on their number ,so if you stop it then you won't be able to use SMS for possibly a majority of users.

Re:The first factor (1)

wvmarle (1070040) | more than 2 years ago | (#38277346)

Indeed. Later I read the article, and found out the number had actually been ported to a completely different network.

How that is possible without putting down a signature and showing an ID document (if only at the receiving network!) I really can not understand. And I would think that this is a problem that goes much further than just allowing attackers to intercept banking details.

And besides, if they get the old network to give up the number, it has to go somewhere: attacker must have registered an account with the other network where the number can be ported to.

It's all in all a quite complex case, and because of that clearly highly targeted.

Re:The first factor (0)

Anonymous Coward | more than 2 years ago | (#38277480)

Everyone is focusing on just the (in)security of the second factor, the telephone number, but what's missing from this story is that the scammers obviously also got their hands on much more information from this person first: they knew his bank login details (account name, password), and they knew his daughter's identity and managed to contact her.

Yeah, they sure did. And the article is missing a critical key piece of information.
When you port a number, you call your NEW carrier to setup services. THEY send the port request to your current carrier, you don't do that part yourself. It works like that in AU and in the US, but here in the US we use some different authentication methods.

In the US, the new carrier has to have a signed LOA (letter of agency) and a recent hardcopy billing statement from the customer in order to submit the request to the current carrier. I don't know if AU has any such requirements, all I found in the links was a requirement that the current carrier has to contact the customer when they get a port request.
So right off the bat my first question is this: If Vodaphone actually called the customer to verify information, WHO the fuck did they talk to? Now, obviously it was the scammers, but NOT using the cell phone number because it had not yet been ported! So the scammers must have already compromised his phone account and updated his contact information to a different number, or convinced someone to forward phone calls, etc. Now it's also possible that the phone company took an inbound call and never called the number they had on file, but again that is their failure.

My point is that there had to be more compromise than the article reveals at first. And in all cases, it keeps coming back around to the phone carrier. Yeah, the bank should probably look at a better authentication system, but I really can't find much (if any) fault with them for this story.

It gets better (1)

thegarbz (1787294) | more than 2 years ago | (#38277782)

Everyone is focusing on just the (in)security of the second factor, the telephone number, but what's missing from this story is that the scammers obviously also got their hands on much more information from this person first: they knew his bank login details (account name, password), and they knew his daughter's identity and managed to contact her.

Commonwealth Bank for first time external transfers not only requires the traditional two factor authentication but also requires you to answer two secret questions. These are normally stock questions like the name of your pet, your mothers maiden name, etc.

To pull this off they likely knew quite a damn lot about him.

The downside to the bank in question is that all you need to raise your daily transfer limit is the SMS code, no additional questions.

It's the telco miss, what's the root pwd for ... (1)

Grindalf (1089511) | more than 2 years ago | (#38277240)

This is funny, it's like the old phrack magazine from the 80s where you have kids pretending to be the telco working on the line asking for the root password to complete a job. Nostalgia ain't what it used to be ...

After reading the comments... (2)

mwvdlee (775178) | more than 2 years ago | (#38277288)

The 20-20 hindsight is strong in this one.

Number portability (1)

grahamm (8844) | more than 2 years ago | (#38277352)

Number portability should be for moving between providers while retaining the same number (to save having to give the new number to all contacts).

When I have moved a number to a new (PAYG) handset (keeping the same provider), the process required me to quote the IMEI of both handsets as well as answering security questions. For a contract phone (which one would assume is what a business owner would have), surely the only time the number should need moving a new handset is when the handset is changed as part of the contract - in which case it should not be possible to move the number simply by making a phone call.

Wrong victim (2)

petes_PoV (912422) | more than 2 years ago | (#38277486)

they intercepted a victim's two factor online banking codes

Surely the victim here was the bank. They are the ones who gave away money to people who weren't entitled to it. They were the ones who allowed a weak form of authentication to be accepted. They are the ones who will bear the eventual loss.

The person who's account was used did nothing wrong. He didn't disclose any confidential information and (from what I've read) complied with the terms of his account.

We need to get away from defining the victims of these crimes as being the person who's name is on the account that was used - the account that the bank wrongly withdrew money from and gave away to the scammers. Unless we start identifying the true victims as being the financial institutions who we entrust with our money, yet have weak and inappropriate security measures the time will come when they shift the expectation and liability, so that the customer will bear the loss for something that is neither their fault not within their control.

Those are NOT two factors! (0)

Anonymous Coward | more than 2 years ago | (#38277646)

You got to be kidding me! A openly available information as the first "factor"?? This is what you get for acting like information can be owned. Idiots!

I have proper two-factor authentication here. With a encrypted chip card, a special pinpad reader that is tamper-proof, and FinTS which allows that reader to connect with the bank directly, without even my own PC being able to tamper with it. It shows me the actual transaction the PC requested from the bank. Only when I stick in the card, enter the code, and press "OK", will my bank ever do anything transaction-wise!

If somebody wants my PIN, I just have to destroy the card, and he can have all he wants. It won't help him one bit.
If somebody steals my card, that won’t help him too. Also I will go to my bank and invalidate the card. So now even the PIN won't help him.
And the PIN is a *biiit* longer that the usual 4 numbers, so guessing it like with EC cards is not an option. It will take at least a multiple of the time it takes me to invalidate the thing. ^^

Why is it even legal to do it otherwise? And why the hell do you use a bank that doesn't do this?
(If there is no such bank in the US, that would be quite the market gap. Just advertise that you're the *only* bank with *actual* security, and put a page online showing why. [That way they can't sue you for saying you're not the only one.]
But honestly, don't you have the Deutsche Bank over there? That's a German bank (obviously). And here in Germany, they offer the exact setup I described above. They don't openly advertise it, but they offer it. So maybe they do in the US too.)

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?