How to Keep Your Crypto From Being Stolen Via Your Phone - Ep.128

Transcript

hey everyone just a quick announcement before we begin today's episode thanks to everyone who participated in our survey we got lots of great and helpful responses and many of you said really nice things about the show so thank you for that I just want to take a moment to dispel a few myths that I saw several people suggested that I cover the news in some way and many people were unaware that I have another podcast and confirmed well guess what unconfirmed it's a shorter 20 minute podcast where I tend to dive in at that week's news it comes out every Friday and that's on all the same platforms that Unchained is so you can find it wherever you listen to this show some others were unaware that we do put the podcast on YouTube it's audio only but you can find and subscribe to Unchained

as well as unconfirmed on YouTube it's also on Spotify for those who asked and a host of other platforms like Pandora stitcher tune in Google Play I heart and many others including as some of you have discovered United Airlines also for those of you who requested transcripts we have them for Unchained they may not be published right at the exact moment that the podcast goes live but they are always on the web site within a couple days finally we have five winners of a free cost of Bitcoin lightning node plus a free year of casas gold membership including a multi six security app for iPhone and Android at rezar Hardware wallet a Casa Faraday bag and 24/7 support the winners are Andy from Denver

Gabi civils Henry elder Julian Gaul and rosemary Heather congratulations thanks again to everyone who participated in the survey and thanks takasi for this donation now on to the show hi everyone welcome to Unchained you're know hi free source for all things crypto I'm your host Laura Shin it's not easy keeping up on all the news and crypto if you want to short and quick look at what I think are the top stories every week sign up for my weekly newsletter just go to unchain podcast comm and enter your email address into the box right on the home page sign up today interested in the crypto weekend retreat I'm teaching with Milton tamir's of coin shares and geology of apprecia

of future perfect ventures in September if so be sure to check out the show notes for the link to sign up also Unchained is now on YouTube you can find the most recent episodes there every week on the Unchained podcast channel Kraken is the best exchange in the world for buying and selling digital assets it has the tightest security deep liquidity and a great fee structure with no minimum or hidden fees whether you're looking for a simple fiat on ramp or leveraged options trading Kraken is the place for you cipher trace cutting-edge crypto currency intelligence powers anti money laundering blockchain analytics and threat Intel leading exchanges virtual currency

businesses banks and regulators themselves use cipher trace to comply with regulation and to monitor compliance grow your crypto and earn up to 8% per year with crypto comm it's the place to buy over 40 coins at true cost with no fees and no markups download the crypto comm app to the topic of today's episode is sim swapping also known as phone hijacking or phone porting here to discuss our rich Sanders co-founder and chief security officer of cipher blade and Harry dent Lee director of security at my crypto comm welcome Richard and Harry thanks very much on the topic of today's show is a phenomenon that's been hitting

crypto people in particular for at least three years now and what happens is victims get their phone numbers compromised which can lead them to having their crypto stolen or being extorted or having other bad consequences so before we dive into the meat of this discussion though why don't you guys each briefly describe your companies Harry why don't we start with you what does my crypto do sure my crypto is a blockchain interface right now to the ethereum blockchain it'll say is an interface so you can manage your funds and Takens sending and receiving and rich what about cypher blade

separably it's a blockchain investigative firm we investigate scams err hacks we also provide advisory to exchanges to icos and we also provide legal services and your two companies teamed up on this massive post post isn't even a word because you guys called it in the title a Bible which is probably a better word it takes 50 minutes to read and it covers in detail these kinds of attacks how to prevent them and what to do if you fall victim to them describe what this attack typically looks like what what is it that the attacker does so what one of these attackers will do is

they're either going to social engineer a phone service representative or they're going to have an insider and the phone company and what they're doing is they're changing who owns the phone number associated with the account so they're gonna basically port it to a sim another sim card that's why it's called a sim swap once they do that what they're able to do is they're able to reset any accounts that phone number is connected to so for example a lot of people instead of using Google Authenticator they have it still set to SMS reset so from there they'll be able to reset a Gmail and then from there people usually hit they're gonna have money stolen from them in the sim swap they might make the mistake of having a private key or a seed freeze stored in Google Drive or from the Gmail they

might search and see what exchange accounts this person has those exchange accounts might also be resettable via SMS reset and that's a financial loss takes place and so how does the initial piece happen where the phone number gets switched to a different device so what ends up happening is one of these sim swappers will either call the phone company and pretend to be that individual and a lot of people don't have security settings on the account so it's really just a matter of sounded convincing and if they don't have security settings they're just gonna need to know really basic info like possibly address or some very very basic stuff that can be found via open source

other times what ends up happening is that there's an insider within the phone companies which is essentially an employee that sim swappers will pay in order to port the phone number to a difference in card that's the initial setup well and how are the perpetrators finding those employees so that's a big misconception I've read and heard that a lot of it apparently it's believed that it comes from sharing phone numbers at conferences which is actually not the case the majority of the time it's just a matter of these Sims whoppers looking at who has a decent net worth and who looks like an easy target it's a hybrid of the two and there's all kinds of

there's their cold essentials and you can go out there and go on like Spokeo or true finder or plug in someone's name oh it's our you're gonna be able to find their phone number oh but actually I'm an when you when the perpetrator wants to find an employee to bribe how do they do that do they just like walk into a store and or do they call the the mobile carrier directly and ask the CSR hey can I give you money if you do this thing or or how does that part work I've never seen either of those take place but I've never seen one clear-cut way that I would say is the methodology for that sometimes it does come out the outreach I would say the most common one I have

seen is that it's one of these sim swappers that has a friend that joins a company with the explicit purpose of doing this but I've also seen them kind of out reaching on other forms especially the sim swappers that were with that group oh gee users they would find people with these phone companies perusing through LinkedIn and Facebook and engage in Mumper inter counts okay and just describe for people who own users are so edgy users is slash possibly soon-to-be was a website where a lot of the users on there would go after what were called og accounts and those were typically Instagram or Twitter or steam or other types of accounts that had desirable user names like things that would be only three

letters or they were considered to be rare accounts and there was a marketplace for them and a large portion of those accounts were illicit Lee obtained and essentially where that evolved is that it evolved from them stealing accounts and to stealing money okay and they have I guess done a number how like how wide scale are the attacks that they have done you know these like sim swaps so just to clarify it not everybody on oh gee users was a sense whopper within the context of what we're discussing now which is some swapping relevant to cryptocurrency they were really big on account hijacking in general but it was a select

portion of them that engaged in some swapping with the explicit intent of financial gain so if you google like Sims whoppers arrested you see names like Joel Ortiz or Joseph Harris Xavier Nevarez they were all the OG users that decided that they were going to go after money all right and then just to go back when you were talking about how the attacker will call the phone company and get the phone number switch to their device what if you do have a pin code on your does that protect you not all of the time and that's for two reasons if there's an insider within the company

well then that's moot if there is not an insider and they're doing the traditional social engineering approach there's a couple of different things that can happen the service rep can entirely overlooked it or you have to bear in mind you're dealing with social engineers and the unfortunate reality is that these phone service reps and and this is not disrespect intended to them but these are not folks that are compensated extremely highly and extremely trained so think of it like this if you're doing your first job you're early on in your career field and somebody calls you panicking freaking out my husband needs this account unlocked it's an emergency I need to get in touch with them odds are you're gonna

end up getting convinced to ignore having a pin code on the account there's also other things that I have seen like I've seen PIMCO's and pass phrases that are extremely easy to guess like last for be social or you know numbers of a street address which are just sloppy OPSEC practices all right so from the victims side what happens how if it's happening to me what would be the signs that I'm now being targeted in this way right so you'll see a suddenly your service rule will go and you have no signal you won't be able to receive inbound or outbound calls or messages or sometimes you'll get a call back from the CSR

saying hey we got disconnected let's continue the conversation and that just means that they got a CSR that they couldn't say sure engineer first try at least to put your number to a different sim and then I believe they also if they are successful then they start trying to get into your email accounts and stuff so would you also experience other kind of signs that have to do with your email yeah that depends on how you set up your email assuming you've only got SMS 2fa on your email there you will maybe see on your phone that

you'll be signed out of your email account or you'll get a notification on a backup email associated with email address saying a new login attempt if you don't have SMS to ethane you have something like depo authenticates or Outlook Authenticator then you'll get a notification on your phone from the app to say authorize this login so then once so let's say that they do get into these accounts in particular your email what are they what do these attackers typically do once they get in to an account like that they would look into your email address inbox to see what kind of emails you get from exchanges to

see which exchanges they can pivot to and get access to sometimes they would do reset passwords and then since they've got access to email account resetting the password is trivial assuming you don't have another method or two factor authentication such as Google Authenticator well then if they can they can maybe open a support ticket with your email address saying I lost made to a fake a backup codes can you remove to a fail and to build off of that as well a big mistake that I see a lot of is people will store their kyc documents on something like Google Drive so it's fairly easy for one of these

since whoppers if even after the fact to social engineer one of these exchanges into transferring or removing rather and Google Authenticator another thing that's worth mentioning is that these some swaps almost always operate in teams so they're going to have the person that does the actual breach whether that breach is the social engineering of a service provider or the insider once that happens though they have multiple people they have someone that's going to search the account like I was talking about seeing which exchanges they've already got copy and paste they're going to query every exchange they're going to query for private keys and then from there they're just dividing a conquering yeah when I wrote about this in 2016 I wrote the the intro kind of incident that I described was one in which

Jarrid kena who he founded one of the earliest Bitcoin exchanges Tradehill which didn't last super long but he was a very early miner and when I say very early as he described it sometimes he would hook up to the network and there would only be four people on the network so he was earning those 50 bitcoins every 10 minutes you know fairly frequently and he said that he he believes that within seven minutes he was locked out of 30-plus accounts so you know when you say that there are people working in teams and they sort of you know comb your email and just keep locking them out and changing your

passwords and everything like they know what they're doing they're doing it quickly and they can do multiple accounts because there's a number of these people you know within a matter of a few minutes and this was you know even before he he really understood what was going on with his phone so alright so what are some of the worst consequences you've seen for the people who have been victims of such attacks like how much money have they lost or have they been extorted in some fashion or like what are some of the various ways this has played out for them so there's a really wide variance of financial loss and typically the lower end is in the 30 to 50 K range and then at the higher higher end you have like Turpin who lost the 24

million well it's been yep and it's typically not in the seven-figure plus range it's typically in the 50k at a six digits range however one trend I definitely have noticed especially this year is that typically people now have the wherewithal to have either Authenticator on the exchange or you know not store a private key or a seed freeze on Google Drive but what's typically going on is that these people will get sim swapped and what ends up happening is you swap their primary email is they'll have a recovery email that they can use for the account so even if you have Google Authenticator on your main gmail account if you have an old email one that you probably

entirely forgot about it could be like an old work or college email that you had secured via SMS that's how they're getting in and the change in tactic the way that the sim swampers are continuing to monetize it this day is that they're transitioning to extortion so they might steal business documents saps whatever the case might be and threatened to leak them they might threaten to leak it's gonna be a little crude I'm not sure if this needs to be edited out for the podcast but they might threaten to leak nude photographs and that's how there's any way to monetize it for the most part well and then they they want payment in crypto so it can't be reversed correct and so you sort of alluded to this earlier like who are the attackers targeting it seems to

be maybe not always the highest net worth people I mean net worth is one of two indicators it's always a balance and the example but I always like to give people is that if you have five billion dollars but it's secured like Fort Knox and you have five million dollars and it's secured behind a screen door well then what's the more attractive target the one that's behind the screen door right so it's a balance of the two and you said that they're finding them via conferences or how are they figuring out who to target so that's a big misconception I've read that one quite a lot that people were believing that because they gave out their phone number at consensus that's why they were getting targeted I haven't seen anything that indicates that to me I mean it's this could all be done hypothetically

100 percent remotely you don't need to go in person to get somebody's phone number you could find it via and it's Osen tool so as far as you know how they're identifying who these people are to even run their names in an ascent tool that's simply a matter of being on telegram reading reddit following what's going on in the industry especially one of telegrams recent updates was you're made by a number attached to your telegram account was made public and you had to opt-in to turn that off with your privacy settings so that could be another way that using being remote you could get someone's phone number yeah I literally just figured that out and I was like oh my god I can't believe that people were able to see my phone over so

is law enforcement making any headway in finding the perpetrators they absolutely are I mean if you look at the slew of arrests that took place just last year thanks largely to react in the FBI the thing is this is that law enforcement has very few staff that are extremely proficient in this and that's not a knock on them as it's roughly the equivalent of anyone of us being asked to perform surgery on a horse we have absolutely no context or background a lot of these cases are assigned to law enforcement personnel that barely have any cyber experience let alone blockchain and if you marry that with the just harsh reality that a of the majority of these go unreported to law

enforcement and be the minority that actually do go report it's simply don't have adequate data then a lot of those will go unsolved the reason why a lot of those folks from og users were arrested last year is that there were folks that were able to get law enforcement that data they need it and you know with in my case without stating exactly what the data that was it was stuff that would serve legally as attribution enough for warrants for arrests for asset seizure and even for prosecution and case authorities and so why is it why is it just not possible to tell the company don't port my phone number you know in like pretty much any circumstance in theory it is possible to tell them that

and practice though there's the two pain points I mentioned earlier which is you're going to have these phone representatives that are easily social engineered and you have the reality of the fact that there are going to be insiders and the thing is this you have to look at it from a business model for the phone carriers they're not collecting payment to act as a custody provider right and you also have to bear in mind the fact that a lot of these people that are requesting that their phone number be ported are doing it for a legitimate purpose so the overwhelming majority of the client base for these phone providers would provide a lot of pushback if they increase the difficulty of doing that all right okay so I think it's just going to be a risk factor for

people involved in the space and for those who I sort of want to get more of a picture of how widespread this is even back in that a 16-story I noted a whole bunch of people who had been targeted in this way such as Adam Draper Beauchene a lot of the founders of auger Brock Pierce and you know it's continuing there was just kind of an everyday person who I forgot he lost only like forget it was only like 8000 bucks or something as he was Kody Brown but he wrote about on on medium and that went viral and we mentioned Michael Turpin who kind of was

an earlier or or is an early crypto person who did a lot of PR for the various crypto teams Michael Turpin he lost what was reported as 24 million dollars worth of crypto I don't I don't know what the current value is he did eventually get a judgment of 75 million dollars in his favor this past May so this is still ongoing and the most recent kind of high-profile case of this was a security engineer or yeah a higher-up engineering person at bit co which is the security company having his phone over stolen from him twice in two

days so he lost more than $100,000 worth of crypto in that attack and yeah this is just something that pretty much anybody who has any involvement in this space should know about so to that and let's talk about the preventive measures what should people do to try to ensure from the get-go that they never fall victim to this attack and let's start with their mobile carrier what are some of the best practices they should implement there so you mentioned that this is a risk factor that people in the industry are just gonna have to deal with and in a sense you're right but in another sense I actually disagree with that this risk factor can be almost entirely if not fully mitigated so a

great example of that as you mentioned that the sim swapping Bible that Harry and I our team's collaborated on yes it is a 50 minute read but look at the amount of time that people spend whether there industry working in it it's a full-time job forty hours a week or even if they're just an enthusiast or an investor all things considered taking a few hours to do everything that's listed and that guide is a very very minor investment of time and the grand scheme of things so starting with the phone provider having a at a bare minimum it's gonna vary depending on the phone provider but having a pen code or a passphrase that could start I would always recommend telling them that you only authorized a support in person with

a government-issued ID that being said I would actually focus more and Harry will be able to expand on this greatly but I would focus more on as much as possible removing your direct mobile number from existence for anything that can touch your cryptocurrency yeah so let's talk about that if you're gonna do that I mean a lot of things do require a phone number so what should people do instead one thing that I've seen lots of people doing is going on to Google Phi which is a mobile network but it has been a real install or human support agents that can be socially engineered say you won't be

able to Caitlin I'm aborted so they use those virtual mälar numbers yeah and as far as I understand with Google Phi if you have a number there then you just go to a website and click a button that you know says like enable this number to be ported or or you know don't enable it to be purported so you're in control of that and you know if you want to switch carriers you can do it but if you don't then you can just block it so yeah it relies heavily on your Google account being secured but if you use all of your security tools then you should be good all right so well I want it also because

you guys did outline a slightly different method which is that people could also set up a separate Google account and create a Google Voice number on that account that again is not connected to your exit to your normal email but then use that phone number is that did I understand that right that that's another option as well yeah that's another option I say assume that one day you'll get your prime email account what Google account should I say it will get hacked but then you'll have one that is that you only ever use just for that Google Voice number and you ain't used for your primary email so it's just another

barrier there's to keep you safe if you assume that one day your primary email account will get hacked and so we're so they use this number on anything touching crypto or anything financial and and where else should they just use this number as their phone number going forward in as many places as possible as they can they can there's no reason why they couldn't today I would only use it for anything financial myself to expand on that when it comes to cryptocurrency in particular the exchanges I can't think of and how are you absolutely correct me if I'm wrong but off the top of my head I can't think of a single exchange that offers only SMS Authenticator and not Google

Authenticator well that's good and we'll talk a little bit more about Google Authenticator but let's first actually talk about why it's so important for them to secure every Google account that they have I know you sort of mentioned this like so basically I feel like what people maybe need to imagine is that it's sort of like quarantine or something where you create a little universe where that phone number and that email touches like certain things but like nothing else in your life is that sort of the right picture to have that's a perfect analogy yes okay so talk about how to set that up so that people don't mess up and don't end up

having that one little crack that the attackers can use to unlock everything so to start from the very beginning a lot of people have an email account that is super-old that they made maybe when they are a teenager they went they didn't really care much about the online security they then grow up a bit and create in your account and on the when you're creating in your account some of the providers asked for a backup email in case you forget your password and then people use that very old email account that they made when their teenagers didn't really care about security so now you're your new primary email account is vulnerable because it's

linked to that very old email account and the bad guys will get out the old email account that will probably be in some public dumps somewhere and then pivot from that email account into your primary one and then they've got your identity so what people need to do if they want to prevent that from happening is what they need to remove email backup from their Google accounts or any other online accounts basically have the only backup mechanism as 2fa or backup codes that you start offline great so we're gonna keep discussing how to prevent a

simple attack but also what to do if you are a victim after this break but first a quick word from our sponsors when buying crypto price matters with the crypto comm app you can buy more than 40 coins at true cost our multi exchange trading engine ensures the lowest possible prices to buy crypto with no fees or markups not only is the app good for buying crypto it's also good for growing crypto you can earn up to 8% per year on BTC eth XRP and more when you make a deposit into the one month 3 month or flexible terms you just have to deposit your crypto to begin interests are paid out weekly and

immediately available for use star earning through the crypto comm app available on the App Store and Google Play will the world follow France and advocate banning privacy coins will government-backed stable coins become the new Fiat are distributed and peer to peer exchanges just a flash in the pan the answer is maybe virtual currencies can flourish and create a new private and more versatile economy but that grand vision can't happen without keeping crypto clean and that requires support of government and accountability for bad actors privacy enhanced compliance using cryptographic controls has the potential to preserve anonymity

without compromising legitimate investigations cipher trees is working on this vision of the future sign up to stay up to date on the privacy enhanced compliance initiative and receive authoritative crypto AML reports quarterly WW cipher trace calm / keep crypto clean today's episode is brought to you by Kraken Kraken is the best exchange in the world for buying and selling digital assets with all the recent exchange hacks and other troubles you want to trade on an exchange you can trust Krakens focus on security is utterly amazing their liquidity is deep and their fee structure is great with no

minimum or hidden fees they even reward you for trading so you can make more trades for less if you're a beginner you will find an easy on-ramp from five fiat currencies and if you're an advanced trader you'll love their 5x margin and Futures Trading to learn more please go to kraken calm that k ra ke n dot-com back to my conversation with rich and hairy so let's now then also talk about like why securing your Google accounts is so important why is that so in today today's world Google is like Big Brother it's not just providing email T providing location services cloud

storage maybe even web site hosting face hosting if a natural talents your game a Google account which is also your gmail account which is your email account so once they got your email account they pretty much have all of your online identity including which is most scary your location data well and then they can also break into anything you've got stored on Google Drive or I guess i'm google chrome as well that's the thing they could even log in and see your favorites any saved passwords well yeah okay so how should people secure their Google accounts they should have a very strong password generated randomly

where the password manager like one password or a LastPass and then these password manager backups should be stored offline away from your main machine in case your main machine gets a virus or a rat or something then your gmail account should have only that strong password you should monitor active sessions you shouldn't really authenticate apps with Gmail login especially apps that look great but I knew you have never heard of them but you give them read and write access to your email for example say this that way or say having a look at your Recovery

Options I think by default Google has recovery option of your phone number so you'd have to go back into the security settings and remedial phone number from there and any backup emails and two things to build off of that as well I mean that's all in either initial set up at the account or when you're doing a scrub of it so exactly what Harry is saying is that you should really limit what your recovery options are and there's a line between security and convenience so I'm not gonna sit here and tell you yeah completely remove everything except for Google Authenticator but if you're gonna have just Google Authenticator make sure that you're storing your backup code somewhere safe you know actually shot it down or printed out presuming that you're not on Wi-Fi and susceptible to a

man-in-the-middle attacks store it offline the other thing to kind of build off of that as well I see this with a lot of icos and a lot of blockchain companies the default within Google admin is that people actually can't use personal recovery email so that very attack vector has been used to compromise company emails that were believed to be secured by via a Google Authenticator and what Harry mentioned as far as you know doing a scrub of your active sessions security is not a one-time thing so you can't read at this same swapping Bible do everything in it check the block and say I'm done for good that's not just because the threat vector is changed but because you want to continue to moderate so the analogy I like to use is you want to think of security it's like brushing your teeth and I'm not saying that you have to do a

scrub every single day but yeah in the grand scheme of things what is 15 minutes a week just the jot down as a recurring calendar event for you and scrub your active sessions make sure everything looks good all right and let's just also define a few things for people so you keep talking about Google Authenticator that is basically an app on your phone that provides temporary codes I think they change every 30 seconds or something so that instead of receiving your second factor authentication code via text message or phone call what happens is you you know try to log in and you put in your password it asks for your code and instead of sending one to your phone you

just open the app put in the temporary code the one you know that's active for that 30 seconds and and you would have need to have you know set this up before that you know it's that the way that you log in here is with your Google Authenticator and then the system will know okay the person logging in has this trusted device which is you know the phone that you previously set up with Google Authenticator and that's how it will identify you and not use your phone number to do so is that did I explain that correctly correct so Google Authenticator is using a time-based one-time password algorithm and the way you described it is correct and yeah the real tragic thing is that setting up Google Authenticator takes

all up a few minutes and when you look at a lot of these especially exchanges that offer both Google Authenticator and SMS based to FA the reason why they offer SMS based to FA is people don't want to take the few minutes it's kind of like I was talking about with the phone service providers right the overwhelming majority of people that want to change their sim would not want the deal with all of the hassle of making it extensively more difficult to appease people that were victimized by sim swapping and cryptocurrency and you have to look at exchanges in the same light a lot of people just want to quickly sign up for an exchange they don't want to take a couple of minutes so it boils down to business and conversion rates for the exchanges yeah and when I did the story on this previously I did ask coinbase

about why it is that they still at least at that time I'm actually not sure right now but at that time why they still offered to a favia text message and they said the reason is because for users who don't have smartphones it was still more secure than you know they're like fur for kind of lowest common denominator users like that was with a better form of security and obviously for you know for people who have higher security means that was not sufficient is it one other thing that Harry mentioned is about not storing your backup codes on a computer or anywhere digital so how should people store their backup codes

so you can print them and store them physically somewhere secure in either a nice place that you know like a maybe a bank vault or maybe your parents place or a safe or somewhere you can also store them on external hard drives things that are not always connected to the Internet and how do you protect against you know fire over or just like paper does not seem like a super safe way to store a backup code there's tons of solutions for this and it really just depends on how much time and money you want to put into it on the higher end there's things like crypto

steals which you can use for private keys or seed phrases and Harry correct me if I'm wrong but I think those run like 130 bucks alternatively what you can do is you can run over to your local hardware store grab a piece of scrap steel grab a die bunch kit it'll cost less than 20 bucks and take you about 15 minutes the chisel and an entire private key and that that's going to be offline fireproof and waterproof if you want to make it safe proof as well then simply split it in the - or memorize a portion of it all right okay well I feel like this is the same conversation I always have about securing crypto where every time I get to that part where you have to store

something offline I'm like I feel like I'm gonna lose that right away fine anyway okay so let's no talk so we've we talked about obviously you know two-factor authentication via text message or phone number or phone call is not a good option we talked about how Google Authenticator is another good option but there are a few other ways that people can use or a few other things people can use for their second factor one would be like a physical device like a UB key and then Google auth also offers something called advanced protection which appears to be physical you know physical token based but can you describe what those options are and who should opt for that as

opposed to something like Google Authenticator I think it was a recent update or maybe it's just super hidden and it was just made public to me a couple weeks ago Google came out has a an advanced security section where you can add a UB Katie your account for two-factor authentication the GB keys are not super expensive for the security that they get say really if they could be used for anyone depending on their paranoia on if they're a target or not although you could assume that you're always a target encrypted currency say all day Google Authenticator is a good default if you

are super paranoid or you assume that you're a target then upgrading to a UB key this is a good man okay and so then let's talk about some other accounts we've been focusing on Google quite a lot you also talked in your post about the importance of securing Apple accounts why is that important and how should people secure those so Apple like Google hello sir has cloud storage which I think when you set it up all of the pictures that you take on your eye devices are sent to a cloud storage I may be mistaken if that's not default but some people would take

pictures of maybe their IDs or their backup codes and not knowing to them is automatically sent to cloud storage so if your Apple account gets packed then then they buy access to it to these very taste as well or say your location data they could all say factory reset your phone so they could maybe exploited that way hey I've got access to your iCloud I can reset your phone or lock you out your phone and I believe that the iCloud account does require a phone number so in this case which phone number should people use that is the phone number that is with your iDevice i think i've i

event my only experience with Apple devices is iPhone so I'm unsure if you can have and I kind of device without and I think any well I I think so I think the phone number that they should use is the one that is probably the one that can't be ported right the Google Voice or Google fine number yeah so if you have an iPhone then it's by default your iframe number I think I may be wrong yeah I because that's through your carrier right the other thing to do when it comes to anything with Apple ID is that it's going to notify you on a signing request on a new

device so that's an additional layer of protection that actually is a default within that oh that's true right but yeah I don't I don't think that's related through your phone number um anyway so let's also now talk about you guys did mention password managers and how people should use those our password managers in the browsers such as but like you know Chrome or Safari or whatever will manage your passwords are those not secure enough they are assuming your Google account doesn't get hacked as they as the password to say to your profile if you sync your storage across devices so if they log into your Google account on a new device and sync the storage

they'll get access to your safe passwords so what do you recommend people do have a dedicated part manager separate application such as one password or end pass or LastPass something like that that they can generate independently from Chrome generate passwords independently from crane and then how should they set up the security on their password manager because it feels like if that's compromised then yeah say the good thing about passive managers is you any needs for you have really one master super secure password which you can store

offline maybe with engraving it in Metro or something but then you can also have backups and store those offline as well say if your main machine that is connected to the Internet gets a rat then there is near zero chance that someone could extract your backups that are stored on your main machine because you've stored them offline and doing offline attack and pre post the login there and to build off what Harry is saying - one thing that's definitely worth bearing in mind is that since Wapping is just one of several vectors that anyone in this industry should be cognizant of and while you're going through all these steps to secure yourself through sim swapping you could be secured in the sense that you've told

your phone carrier what to do you've set up your Gmail but looking at Oh G users is kind of a case study if anyone's familiar with Ian's ballina the cryptocurrency influencer that was hacked for about it was two and a quarter million dollars worth of aerion crypto currencies last year that was perpetrated by a group of sim swampers but the vector there actually wasn't a sim swap it was a database dump that you know how are you looted to those earlier old college email old password that was used so it is worth bearing in mind that there are a lot of low-hanging fruits for these individuals that are not by any means super sophisticated hackers yeah as far as I understand a number of them aren't even like really they're not like a real crypto it's not like they even really

understand crypto they're really just criminals right well they understand crypto within the context of how to use it how to get it to exchanges I wouldn't say they have the knowledge of the technology and or the industry that the folks in this podcast do obviously however I also wouldn't say for the most part most of them are career criminals there are obviously criminals in the sense that during the sim swapping and they're criminals in the sense that they almost always have some swapped more than one individual so they're repeat offenders but it's not like most of these folks have a long track record that being said if you look at the folks with og users they are criminals with a track record in a sense that a lot of

them as kids did stuff that was like a lot of script kiddies do back then they were into ddossing and it's like I was talking about earlier they were into stealing accounts just to have the OG accounts so they have a lot of a track record with that was swatting the the head of that ring was actually arrested and extradited to the US years and years ago when he was a minor so they have criminal history in that sense but these aren't folks that are you know super sophisticated blackhat hackers that have been going at this for a decade yeah yeah that was I think a line I had in my article which was that you know they you might call them hackers but it's not like they're doing any fancy computer

work they're they're just calling up a customer service rep repeatedly until they find one who will send them the phone number so all right so we kind of touched briefly on telegram you know you mentioned that the default was that people's phone numbers should be exposed so how do people secure their telegram account so since one of the latest updates being your privacy settings is that your phone number attached to your telegram account is made public you should go and make that private and also configure the invite privacy say not anybody could invite you to a new group

and maybe expose some details that way to say for example if you have all of the default settings on someone find your telegram handle invites you to a group and then and then a bad actor is in that group sees you got invited booked so you pray for oh this guy I know this guy because he's big and cryptic can't see this is his mobile number thanks telegram say step one to securing a telegram account is to configure your privacy settings from non default all right and then so we're not gonna get to like every single place where people should lock down their security but your

post does kind of go through a lot of the main honey pots that these perpetrators go for and you know some that come to the top of my mind or you know like Dropbox or Evernote what are some of the other types of sites or apps that people should be sure to lock down and make secure their social media such as Facebook and Twitter maybe LinkedIn they could either pivot from your social media and pretend to be you and message your friends to get some more information about you or you have

maybe on social media media maybe your Facebook account you lost your phone maybe three years ago and you made a post saying hey lost my phone is my new number takes me your numbers or something like that which I see quite often in my circle of friends and by default maybe Facebook privacy settings has made that post public so someone goes to your Facebook account and looks back at your page maybe three or five years ago there's your frame number in plain sight say go to pretty much all of your social media ones active and now not active ones you didn't use anymore and configure the privacy settings there on each one it may take a while but the

benefits you get our way the time it takes and are there any others it doesn't hurt to secure bank accounts this fall so I don't see a lot of since whopping that involves liquidation of bank accounts but I have seen it and it really boils down to you so here's kind of an interesting thing I mentioned the overwhelming majority if not all major exchanges do Google Authenticator in addition to SMS whereas banks I haven't seen a majority of banks have a Google Authenticator other option a lot of them are stuck on SMS is the two fa so considering you know it is still less likely that a sim swapper is going to go for that instead of an exchange account

it is worth making sure that you lock down bank accounts as well use a secure password use a Google Voice number alright so now let's talk about what people should do if their phone number is ported so they you know they start to notice they don't have any signal maybe they're starting to see these notifications and their emails about other accounts they're supposedly trying to lock in login to so at that point what do they do well it starts off with a race against time so immediately they need to be getting on the phone with the mobile service provider the sooner they're doing that the center they're cutting the problem off of the source as they're on the phone with a mobile service provider they want to be if at

all possible you know if the SIM swappers didn't change the password they want to be regaining access to their Gmail or email provider they want to be killing any active sessions on telegram they want to be locking down to exchange accounts as much as they can that might not be possible until they get their front number back but they should be making an effort while they're on the phone with a service provider and when they talk to the service provider you wrote about how they should be logging information as well what what do they need to record so at a bare minimum what the service providers are going to have is an IMEI the person that's getting some swab doesn't necessarily need to get that right away but they will need to get that at a point for the law enforcement

work thing is this is that I mentioned earlier the majority of these go unreported especially the ones that do not result in financial loss they almost never go report it and they should anyway but even the ones that do results and financial loss the majority of these reports which I mentioned earlier they don't have adequate data and one of those data points is the IMEI and what is the IMEI it's a unique identifier for each mobile phone okay and then and why is that important exactly because based upon that IMEI law enforcement might be able to determine where that device was purchased who it was purchased by and there's actually some mobile carriers for example I know t-mobile will actually send you an email whenever your phone is poured it'll tell you the old

IMEI of the new one okay you also mentioned in your post that people should take notes on everything and obsessively screenshot so what should they be notating and what should they screenshot well they should absolutely annotate who the person they're talking to the service provider is right because they want to say I spoke to this person their employee ID number they switched my phone back the phone carrier should have logs of who made the actual symport for the sim Swamper they may or may not they usually won't provide this to the actual victim but mentioning hey you know make sure this is retained right that's a huge huge step law enforcement should be able to contact this mobile service provider and get that data going

on to you yeah this is really where the law enforcement reports fall short on Gmail your access history you're gonna see ip's in there on exchanges same thing you're gonna have access to story those are all things that you're going to want to include and a law enforcement report any device information that you could possibly get you want to include in their withdrawal transactions you want to include those too it's absolutely baffling yeah and one sense you want to feel bad for these victims but you have to look at this from the law enforcement perspective if law enforcement can't tell you know what the device was or where it was or can't do anything on chain looking at transactions for finding out what the funds went they're simply not going to be equipped

for success and who in law enforcement should victims call just the police or or who so in the u.s. what you would file is called an IC 3 report which is at IC 3 gov and again this is another unfortunate thing just because Crypt is so new to most people most people don't know that answer and they're gonna default either call the local police or go to the local police even most local police don't know where to report this stuff but this would always fall under IC three of your US citizen if you're abroad that answer changes it typically that answer is it still handled at the federal level our website actually has a list by country of where to report cyber crime of this nature okay so I guess

people need to prepare for a long a long road of of dealing with all this and gathering all this information to try to get their money back one other thing I wanted to ask was so if a victim loses access to their email account how did they get access back well presuming that they lost access because they did an SMS reset if the sim swapper added different details and this is by the way operating under the assumption that it's gmail gmail has a way to request access back and that might be different information they ask of you that you input when you first created the account and then they'll actually review it and that might take a few days that's the unfortunate thing which is why as we

were discussing earlier you want to as much as possible create these buffers in between yeah I've heard some people did not get access back to their Gmail for months so um yeah that's that's that's a huge I think headache if that happens all right so is there what would have we not covered that you think people should know about this topic I think once you've made once you've identified that you've been subject the exchanges an email cancer being accessed you should monitor for any foreign API keys especially on exchanges and any for an app's link to your Gmail say for

example you get access back to your Gmail your exchanges you think everything's dandy but maybe three months down the line is you see a withdrawal by an API request that because you forgot to check API keys on exchanges and the bad Act has made some API keys when they had access to the exchange account or you see later you see access to your email account from a strange app that was authorized when you didn't have access to your email and did bad actors have made a maybe like him an application that can read them write your email in bugs say they would still have access to be written there I think

one thing that's worth expanding on is that we are dealing with a decentralized assets here and the protections that society is used to in the past like chargebacks those are gone and yes law enforcement will try to handle these cases provided that they have adequate information dealing with cryptocurrency dealing with blockchain tech you're dealing with a general loss of the centralized protections and that places an inherent responsibility on the end user to bolster their security and these security steps I mean reading that entire thing you mentioned it takes 50 minutes but doing everything in there you can get that done and less than one full day and I see people that take all this time to discuss cryptocurrency and

telegram go to conferences monitor coin market cap every five minutes if people have the time to do that they can set aside one day to make sure the security is properly set we cannot continue to have a mentality that it's this carriers fault or it's this exchanges fault because it's simply not that their service providers and you know especially within the context of mobile carriers they were not the ones that asked to become custody solutions that's that's not what you're paying your mobile carrier to do and it's kind of almost hypocritical that there's a mentality of we want decentralization we want to move away from government controlling this but the same people spouting that belief are often the same

people that are saying we should sue the phone carrier we should sue the exchanges you have to be the one that's responsible for this and there's a big line between security and convenience yeah Harry and I really share this mentality which is we're not expecting people to summon the blood of a unicorn to login to every single one of their accounts so yeah it boils down to how are you used a really good example earlier which is you could put on steal something for like your password manager and that would be something that's not very convenient to get to but that is your master key everything else is can be neatly accessible and I would look at your cryptocurrency the same way right we're no longer in the days of centralized protections where it's in a bank you don't have to worry about it you're gonna want to keep the majority

of what you have and something that's very hard to access if you want to have funds that are accessible for you know day treating or investing in ICS or whatever the case might be that's fine yeah not everything has to be on a hardware key on steel separated in two different locations but it should be a small amount all right yeah I definitely would concur with that that the phone carriers do not see them selves as a linchpin in your security setup which they are but but they don't view their role that way and so for that reason you need to do everything you can to you know to I guess patched that the vulnerability right there all right well thank you both so much for coming on the

show where can people learn more about you and my crypto and cipher blade they can learn about my crypto a medium calm stash my crypto we do our publications about main crypto my crypto side projects and just security related things within the cryptocurrency ecosystem or say twitter.com slash my Krypton or my crypto comm and they can learn more about cypher played by gonna cipher play calm and we've also got social media channels and I encourage folks to check both of us out because there's an old saying that an ounce of prevention is worth a pound of cure but I would argue in this industry it's actually worth a ton occur yeah yeah and we can put a dollar sign on that too

all right well thanks both of you for coming on the show thanks for having us was pleasure thank you thanks so much for joining us today to learn more about rich and hairy and my crypto and cipher blade check out the show notes inside your podcast player if you're not yet subscribed to my other podcast unconfirmed which is shorter and a bit noisier be sure to check that out also find out what I think are the top crypto stories each week by signing up for my newsletter at Unchained podcast.com you can sign up right on the home page Unchained is produced by me Laura Shin with help from Fraxel recording anthony moon Daniel Ness and rich truffle ego thanks for listening [Music]