Smart Axiata blames rogue employee after regulator says company failed ‘to protect the rights and benefits of mobile pho

cirmedia · Post by **cirmedia** » Sun Jul 25, 2021 6:51 pm

Telecommunications service provider, Smart Axiata, has blamed an employee for swapping a customer’s phone number to another person without approval after it was called out by the Ministry of Post and Telecommunications (MPTC) yesterday for failing to protect the rights and benefits of mobile phone service users.

Read more: https://cambodiainvestmentreview.com/20 ... e-service/

YaTingPom · Post by **YaTingPom** » Sun Jul 25, 2021 8:02 pm

Love a nice pho.
Used to be a place in Kampot.

It’s just soup though.

webmaster · Post by **webmaster (!RNbVdvcNNI)** » Sun Jul 25, 2021 9:27 pm

Keep this in mind if you use multi-factor authentication with a Smart sim. Sim-swapping by rogue employees in the West has resulted in financial losses when the "hackers" were able to take over internet banking or crypto accounts.....

Sensitive functions like these should be dual control with good logging/auditing. To deter other staff it might be a good idea if Smart terminated the contract....

bargain basement · Post by **bargain basement (!xxQURVmXvU)** » Mon Jul 26, 2021 9:01 am

YaTingPom wrote: ↑
Sun Jul 25, 2021 8:02 pm
Love a nice pho.
Used to be a place in Kampot.

It’s just soup though.

You're just trying to be Smart.

YaTingPom · Post by **YaTingPom** » Mon Jul 26, 2021 2:22 pm

bargain basement wrote: ↑
Mon Jul 26, 2021 9:01 am

YaTingPom wrote: ↑
Sun Jul 25, 2021 8:02 pm
Love a nice pho.
Used to be a place in Kampot.

It’s just soup though.
You're just trying to be Smart.

I don’t have one smart cell in my body.

v12 · Post by **v12** » Mon Jul 26, 2021 2:25 pm

2FA using anything related to a mobile number is completely broken, for anybody. It does not provide additional protection against somebody with malicious intends.

Why: The easy sim-swap and effectively "open" mobile phone communications.

What to do: Get separate 2FA devices and/or things like pregenerated OTP.

2FA using a mobile phone is broken for everything related to government and/or commercial trust/security.

Why: Mobile phones do have the options to receive "hidden/silent" sims, with configuration instructions. The interface for that with the rest of the phone is leaky, with the consequence, anybody with access to the phone uplink connection, is able to sent those instructions. Read about Pegasus.

What to do: Don't use mobile phones for anything serious.