Forest Global Training Partners

Cyber Risks · Krebs on Security

Recycle Your Phone, Sure, But Maybe Not Your Number

Summary: Princeton University computer science researchers sampled 259 phone numbers at two major wireless carriers and found 171 were tied to existing accounts at popular websites, with 100 of the 259 linked to leaked login credentials online. The team identified available recycled numbers by browsing prepaid sign-up interfaces at T-Mobile and Verizon, which allow unlimited inquiries, and noted the number pool is shared between prepaid and postpaid, leaving all subscribers exposed.

What you should know: An attacker who claims a recycled number can reset passwords and defeat SMS-based multi-factor authentication on accounts the previous owner still holds - and with the average user carrying roughly 150 online accounts, each abandoned digit is a potential entry point.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related