Technology

69946 readers

4615 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

L4s@hackingne.ws

Here’s how SIM swap in alleged bitcoin pump-and-dump scheme worked (arstechnica.com)

submitted 6 months ago by Xatolos@reddthat.com to c/technology@lemmy.world

8 comments fedilink hide all child comments

all 10 comments

sorted by: hot top controversial new old

[–] shortwavesurfer@lemmy.zip 8 points 6 months ago* (last edited 6 months ago) (2 children)

Idiot. Why did they not run those searches over the tor network to anonymize themselves? That is quite frankly stupid. And the fact that the SEC was using SMS-based two-factor authentication is also stupid. One time pads or bust motherfuckers.

[+] cacheson@piefed.social 6 points 6 months ago (1 children)

[deleted]

[–] shortwavesurfer@lemmy.zip 4 points 6 months ago (2 children)

OTP 2FA Codes are one time pads

[–] InverseParallax@lemmy.world 9 points 6 months ago (1 children)

They're actually not, they're algorithmically derived state machines, most are public key hashes of secrets concatenated to the current time in seconds from the epoch.

Ideally they would be otp, but that would also be obnoxious.

[–] shortwavesurfer@lemmy.zip 4 points 6 months ago (1 children)

Oh, interesting. Okay. In that case, they are totally misusing the term.

[–] InverseParallax@lemmy.world 4 points 6 months ago* (last edited 6 months ago)

Yeah, I think it's because that's where the model originated, and that's basically what it's supposed to be, but having almost everyone synchronized on time gives us a new trick because we can just generate 'keys' and have them expire, so even if you manage to get one by force, it's only valid a short window. Instead of one time pad they often call them one time passwords.

You need extended access to a generator over time to be able to use it, which gives the user a chance to report it for invalidation.

Not perfect, but it does its job fine especially compared to passwords or sms (where you're at the mercy of the minimum wage kid down at the mall's Verizon kiosk).

[–] dhork@lemmy.world 1 points 6 months ago (1 children)

More like the insecurity exchange commission

[–] shortwavesurfer@lemmy.zip 0 points 6 months ago

Well then again, you expect government agencies to be secure? Yeah, not hardly.

[–] pandapoo@sh.itjust.works 8 points 6 months ago* (last edited 6 months ago)

Oh my god, someone please tell me about understanding of the following facts are wrong:

They did all of that, compromised a SEC employee and the official SEC Twitter account, to move the price of Bitcoin only around 2.2%.

They could have just put sell orders in, and waited a month.

Here's the hourly BTC high and low prices for the day in question, Jan. 9th., 2024

All that risk, just to bump the price up $1,000, when it was already trading between $45-47k.

That is so dumb, so painfully dumb, that I almost feel bad about laughing my ass off about this. JFC.

Just over a month later, it was back trading around 50k....