Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
ohai.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A cozy, fast and secure Mastodon server where everyone is welcome. Run by the folks at ohai.is.

Administered by:

Server stats:

1.8K
active users

ohai.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0-nightly.2025-04-15

#simswap

0 posts0 participants0 posts today
Public
BiyteLüm

SIM swap attacks are one of the easiest ways hackers steal your accounts—all they need is your number.

✅ How to protect yourself:
✔ Port your number to a VoIP provider (MySudo, JMP.chat)
✔ Use app-based 2FA (NO SMS 2FA!)
✔ Ask your carrier for a port-out PIN

📌 Keep your number private. Keep your accounts safe.

#Privacy#CyberSecurity#SIMSwap
Public
BiyteLüm

📵 Your phone number is your weakest link.

Hackers use SIM swap attacks to steal your number, reset your accounts, and bypass 2FA. It happens more than you think.

💡 Protect yourself:
✔ Remove your number from important accounts (email, banking)
✔ Use app-based 2FA (Aegis, YubiKey, OTP)—NEVER SMS
✔ Ask your carrier for a port-out PIN

📌 Your phone number shouldn’t be your identity.

#CyberSecurity#SIMSwap#Privacy
Replied in thread
Public *
Kevin Karhan :verified:

@GossiTheDog the sheer fact that #MSPs & #CSPs can access clients' setups without proper #authorization [including #KYC / #KYB, #AuthCode|s and proper authorization via contract] is already sickening.

Such fundamental #ITsec fuckups are reasons alone not to use #Azure or any #Microsoft products & services at all...

  • I mean, it doesn't require #Mitnick-level skills to pull this off, since it doesn't necessitate #Lapsus-Style #SIMswap or other means to gain access...
CyberplaceKevin Beaumont (@GossiTheDog@cyberplace.social)Attached: 3 images This is the partner.microsoft.com portal, it allows CSPs - Cloud Solution Providers - to gain access to their customer's environments. CVE-2024-49035 was around improper privilege management, i.e. being able to access things you shouldn't. It being in CISA KEV says it was being exploited in the wild. That portal allows a huge footprint of access by design.
#mitnick#lapsus#simswap
Public *
BrianKrebs

Feds Charge Five Men in 'Scattered Spider' Roundup

Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio.

Two of the accused I've written about extensively already. Today's story looks at how several of these guys were caught. For example:

"The phishing kits used for these campaigns featured a hidden Telegram instant message bot that forwarded any submitted credentials in real-time.

In August 2022, multiple security firms gained access to the server that was receiving data from that Telegram bot, which on several occasions leaked the Telegram ID and handle of its developer, who used the nickname "Joeleoli."

krebsonsecurity.com/2024/11/fe

#scatteredspider#fbi#simswap
Public
Emory

today i ran a #threatmodel of the changes to be in compliance with new #FCC requirements for #SIMswap attacks and the #safeConnectionsAct and i am telling you 100% straight faced Comcast engineers went to great lengths to ensure our compliance, and it will absolutely save lives and improve those of countless others. some days i get to see a system like this and it just fills me with hope in a way that is hard to explain. i love that people genuinely care about this sort of thing at Comcast/NBCU.

Public
Droppie [loma] 🐨♀🌈🐧​🦘

Recently my mobile phone company was subsumed into another. Today i setup my new online account portal. Upon entry i scoured it for any sign of a way to create a security Q&A to prevent hacker SIM-swapping theft, but nah, nothing. So i initiated a Livechat & said that's what i wanna do, & voila tis now done. So in theory, from here on, any Not Me Peep wot impersonates me [poor deluded saps, sigh, but anyway] & contacts them to sim-swap, should be unable to proceed sans first answering my nonsensical Q with its random-words complex A.

In theory. Well, that is my theory, which is mine, & nobody else's. Ahem. Ahhemmm hemmm hemmmmmmmmmmmm.

No, the A is neither Ann Elk, nor Brontosaurus.

#MobilePhone#Security#SIMswap
Public
Avoid the Hack! :donor:

T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs

I still stand by this: if #sms #mfa wasn’t still massively used (especially by the financial sector), sim swaps would be less attractive to sim swappers.

It’s also crazy so much trust is placed in telecoms guarding your phone number and MFA factor for your bank. 🫨

#security #cybersecurity #simswap

tmo.report/2024/04/t-mobile-em

The Mobile Report · T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMsT-Mobile employees, both third-party and corporate, are receiving cash offers via text to complete SIM swaps for criminals.
ExploreLive feeds
About