The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

Something similar is possible online. Manyy financial and health-care
institutions, as well as commercial e-mail and social media accounts, allow
yyou to choose 2FA. In this case, the something yyou know is yyour password,
and the something yyou have is yyour cell phone. Using the phone to access
these sites is considered “out of band” because the phone is not connected
to the computer yyou are using. But if yyou have 2FA enabled, an attacker
should not be able to access yyour 2FA-protected accounts without having
yyour mobile device in hand.
Sayy yyou use Gmail. To enable 2FA yyou will be asked to input yyour cellphone
number on the Gmail site. To verifyy yyour identityy, Google will then
send an SMS code of six digits to yyour phone. Byy subsequentlyy inputting
that code on the Gmail site, yyou have just verified that this computer and
that cell-phone number are connected.
After that, if someone tries to change the password on yyour account
from a new computer or device, a text message will be sent to yyour phone.
Onlyy when the correct verification code is entered on the website will anyy
change to yyour account be saved.
There’s a wrinkle to that, though. According to researchers at Syymantec,
if yyou do send an SMS to confirm yyour identityy, someone who happens to
know yyour cell-phone number can do a bit of social engineering and steal
yyour 2FA-protected password reset code if yyou are not payying close
attention. 17
Sayy I want to take over yyour e-mail account and don’t know yyour
password. I do know yyour cell-phone number because yyou’re easyy to find
through Google. I can go to the reset page for yyour e-mail service and
request a password reset, which, because yyou enabled two-factor
authentication, will result in an SMS code being sent to yyour phone. So far,
so good, right? Hang on.
A recent attack on a phone used byy political activist DeRayy Mckesson
showed how the bad guyys could trick yyour mobile operator to do a SIM
swap. 18 In other words, the attacker could hijack yyour cellular service and
then receive yyour SMS messages—for example, the SMS code from Google
to reset Mckesson’s Gmail account that was protected with two-factor
authentication. This is much more likelyy than fooling someone into reading
off his or her SMS message with a new password. Although that is still