T-Mobile: Breach Exposed SSN/DOB of 40M+ People

Damien Miller @damienmiller Looks like T-Mobile hasn't updated the OpenSSH installation (and thus probably neither OS) since 2014. SHA256 has been the default hostkey fingerprint since the openssh 6.8 release in 2015

Retweeted: https://twitter.com/Jeremy_Kirk/status/1427144723731402756 Jeremy Kirk @Jeremy_Kirk The person who claims to have compromised T-Mobile says the company misconfigured a gateway GPRS support node that was apparently used for testing. It was exposed to the internet. That allowed the person to eventually pivot to the LAN. Proof screenshot supplied.

Once on the LAN, the same person claims the data was "sitting in plaintext on an insecure backup server": https://twitter.com/und0xxed/status/1427639599636041742

No, they haven't. There are people who have speculated that it is illegal since the idea started being discussed (serious discussions are actually fairly new, mostly a burst in the late-1990s and another one shortly after 9/11, though speculative strawman negative arguments go back a bit further, at least to discussions around HIPAA in the mid-1990s.) Those speculations have extrapolated from cases that are quite distant from a national ID (e.g., weirdly, critics of the idea have suggested a national ID would violate the protection of the eight to anonymous political speech found in the first amendment under McIntyre v. Ohio Elections Commission (1995), which aside from the WTF of what a national ID even has to do with that right, is clearly false because the First Amendment applies to the states under the 14th Amendment, so if somehow the creation of a federal ID would violate a First Amendment right, the creation of a state ID would equally violate the application of that right under the 14th. In fact, we have federal (directly issued or state-issued under federal regulations) ID cards required for certain federally regulated purposes, notably:

(1) Passports (or, for certain cases, state-issued under federal rules Enhanced Driver's Licenses) for border crossing;

(2) Passports, state-issued ID’s meeting federal Real ID standards, or certain other federal or federally-regulated IDs for air travel and access to federal facilities.

There are usage or production requirements that government might adopt for ID that violate Constitutional protections that have been firmly articulated by the courts, but those generally apply to state and federal ID equally.

IDs are only required if you want a post-paid plan and/or monthly financing for your phone. It's a rotating line of credit.

> What if you lose your card?

Each country could keep a log of revoked publishable keys. Countries do more complex things to validate VAT IDs today, so this wouldn't be out of the blue.

> How do you prove your identity to get a replacement? How do you prevent someone from reporting your card as stolen, representing themselves as you, and getting a new card (with a new PIN) issued in your name?

Governments need to solve the same issue with lost passports today. In some cases you can have other people to vouch for you, putting their own identities on the line. In other cases, you use other forms of ID (including immutable things like biometrics). Society has generally made this not a problem, and a new form of ID won't make it worse.

> What if you forget your PIN, how do you reset it?

At the worst, it's treated as a lost card and get a replacement. There are probably ways to make this better but my point is: solveable.

The Baltic states have a private key that is actually usable to an end user. Open source, document signing format that works.

Plus a process that allows updating these keys in a safe fashion. None of that exists with the EU infrastructure.

Much of Revelation was the early Christian community talking shit about Emperor Nero using code so they don't get killed. It's not meant to be a prophecy of a future dystopia.

Is a credit agency illegally spreading false information about you? Not their problem, after all, they can't be expected to know they're spreading false information. Also, they advertise that they are in possession of credit monitoring systems capable of detecting this false information. How is this not libel?

But SSNs aren't even ONE factor.

It's time the US government entered the 21st century.

It is akin to “the process is the punishment” when you get tied up in the US legal/criminal justice system, even if you are innocent.

Which would include pretty much all consumer level/retail financial companies I think, but certainly is not limited to them.

When entity A defrauds entity B by pretending to be entity C, entity C should not be affected in any way, other than letting entity B know they were not party to the transaction.

In other words, it should be entity B’s responsibility to prove entity C engaged in a transaction with them before being able to affect entity C’s credit.

And that would solve all of this nonsense very quickly.

We really need to start attaching eye-watering financial penalties to companies that leak data so that we make the only sane decision be not storing that data in the first place. Collect it and shuttle it to where it needs to go...but under no circumstances commit it to at rest storage.

In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key.

A leak of a public key without the private key is harmless.

https://en.m.wikipedia.org/wiki/EIDAS

They became a defacto identifier for many institutions just because US citizens and permanent residents generally have one - but aside from convenience, they're pretty problematic compared even to something like a UUID/GUID.

If you were trying to design a true national ID number, you'd probably want to approach the problem more like a database designer would: you'd want something that had possible unique values far exceeding the reasonable number of people you expect to exist before the collapse of society, that was reasonably random and difficult to predict based on other known attributes about the person, that by spec was never shared with another person, etc.

We already have such a system, it’s called a passport, and it has complementary “cousins” like passport cards and nexus cards. That framework could easily be built upon, but there is a mountain of paranoia and stupid to climb first.

Instead we have the current system where fraud is endemic and where millions of people are marginalized by poor access to ID.

If anything it might encourage companies to smarten up if there was a law on the books that required companies that get compromised to pay for the re-issuing of the user tokens to every impacted individual.

Well at least they weren't lying.

Yep, here you go: "No Metro by T-Mobile, former Sprint prepaid, or Boost customers had their names or PINs exposed," T-Mobile said. "We have also confirmed that there was some additional information from inactive prepaid accounts accessed through prepaid billing files. No customer financial information, credit card information, debit or other payment information or SSN was in this inactive file."