Microsoft PC hacked with just victims phone number

[ZacoAttaco]

I think there's some misconception here. After reading the article it doesn't say a Microsoft PC was hacked. His Microsoft account was compromised. If the actor has access to the victims hardware or was using a RAT he could have controlled his machine but that simply isn't the case here.

[strajk-]

3 hours ago, ZacoAttaco said:

Right on the money. 

I don't get why people keep calling Social Engineering "hack" or "hacking"...

Next thing I know, impersonating someone else's voice to wire me money is a hack too...

[linkboy]

T-Mobile and AT&T were getting hit by things like this hard a while back.

 

I know T-Mobile added the ability to add a pin number to your account that's supposed to help prevent it from being ported out.

[mr moose]

7 hours ago, strajk- said:

I don't get why people keep calling Social Engineering "hack" or "hacking"...

Next thing I know, impersonating someone else's voice to wire me money is a hack too...

Because the word hack has multiple definitions.   One of which is to gain unauthorized access to a system.

 

 

[amdorintel]

....another is clickbait ^^

 

i think linus got hacked, pardon the pun and he publicly made money off it by making a video of his ordeal, but kept a lot secret.

 

[MichaelWd]

I don't understand how a phone number can be used. Did they have the actual PHONE or just the number?

[suicidalfranco]

yeah this is a nothing burger and nothing to actually do with Windows

[mr moose]

7 minutes ago, MichaelWd said:

I don't understand how a phone number can be used. Did they have the actual PHONE or just the number?

Just the number.  By getting the telephone company to transfer the number to your new sim (even a prepaid) you suddenly gain access to the targets entire mobile 2fa secured services. Hence why people have pointed out it has nothing to do with MS.

 

[dalekphalm]

On 11/10/2019 at 12:51 PM, Twilight said:

microsoft made this impossible in the latest versions of 1903. if you fresh install it the option to log in with a local account no longer appears. you need to disconnect from the internet in order to get the option back.

The Pro version still allows local accounts during initial setup. We don't use Microsoft accounts at all at work and always set up new systems with a local admin account before joining them to the domain.

On 11/10/2019 at 1:38 PM, Sauron said:

Really? I just did a fresh install a couple of months ago and I could still choose a local account... I think it was 1903 but I'm not sure. Seems pretty dumb. Regardless I guess I can just disconnect the internet next time...

As Goodbytes said, Pro still allows this.

On 11/10/2019 at 2:52 PM, GoodBytes said:

Home edition only, and you need internet access. But yes.

 

[kelvinhall05]

Literally 9/10 "hacking" is just basic social engineering.

 

 

Hell I've gotten a password out of a kid on GTA V because I told him I would give him free in-game money and items. I didn't use it because I'm not a piece of shit, but it's not hard at all.

[Roswell]

This is a failure of the phone carrier (not verifying account number or social), not Microsoft.

 

You don't need to freak out or disable online services, just call your carrier and put a port lock on the account. Easy peasy. Even if someone manages to social engineer a new carrier to port to,  your original carrier won't release the number.

[amdorintel]

back in the day you actually had to talk to people on the phone

i know i know its very rare