Comcast assigned every mobile customer the same unchangeable PIN to protect against SIM hijack attacks: 0000

If someone wants to steal your phone number -- say, to intercept the two-factor authentication SMSes needed to break into your bank account or other vital service -- they hijack your SIM by impersonating you to your phone company (or by bribing someone at the company to reassign your phone number to them), and this has made the security of phone numbers into a top concern for security experts and telcoms companies, as there are millions of dollars at stake.

Enter Comcast, all-time champion "most-hated company in America," whose Xfinity Mobile cellular service assigns the same unchangeable PIN to every customer: 0000.

But don't worry, Comcast says that this only puts you at risk if you recycle user-names and passwords, and nobody does that.

Because of that 0000 PIN, getting a victim's Xfinity Mobile account number was the main obstacle for attackers. A Comcast spokesperson told Ars that this account number is available only by logging into the Xfinity Mobile Web portal and is therefore protected by a Comcast's user's password. Comcast told Ars that it does not send out paper bills for Xfinity Mobile and does not include that account number in emails to customers, cutting off two potential ways that attackers could get the account number.

Comcast indicated that the number-porting attack affected only customers who reused passwords across multiple sites.

Comcast set mobile pins to 0000, helping attackers steal phone numbers [Jon Brodkin/Ars Technica]

(Image: Specious, CC-BY-SA)

(via /.) Read the rest