H3h3 Weighs T-Mobile Lawsuit After Carrier Hands SIM Card to Hackers

h3h3Productions

Online accounts remain vulnerable to hijacking because carrier customer service protocols routinely hand over SIM cards to social engineers without basic verification.

AI-assisted summary of Your Privacy is at Risk — original source. Check the original for full context.

Source published: 2016-07-08

Key ideas

Ethan and Hila Klein were targeted by the same hacker group that hijacked prominent creators like LeafyIsHere, Boogie2988, and Linus Tech Tips via mobile SIM card hijacking. (1:04)
T-Mobile customer service released Ethan's SIM card to a social engineer posing as a company employee, coming within five minutes of taking over the h3h3Productions YouTube channel. (1:04)
A protective passcode added by a genuine T-Mobile agent actively facilitated the breach because carrier internal protocols treated passcodes and Social Security numbers as alternative, either/or authentication factors. (4:32)
Ethan revealed he is consulting attorneys to potentially sue T-Mobile over corporate negligence, arguing telecommunications companies will only fix security vulnerabilities when hit financially. (6:20)

Detailed notes

## Background Published on YouTube by h3h3Productions on July 8, 2016, this video documents how Ethan and Hila's privacy was severely compromised after a hacker acquired their SIM card. The description clarifies that an earlier call from a T-Mobile representative was legitimate rather than the hacker, and provides actionable security tips, such as using YubiKey USB passkeys and the Google Authenticator app.

## TL;DR Ethan Klein recounts how he and Hila fell victim to a coordinated SIM-swapping attack executed by the same group targeting creators like LeafyIsHere, Boogie2988, and Linus Tech Tips. Despite setting up a dedicated security passcode with T-Mobile, a carrier representative handed over Ethan's active SIM card to an impersonator within thirty minutes, almost costing them their YouTube channel and exposing their private data. Drawing parallels to an investigative New York Times report on streamer HayliNic being doxed and swatted through Cox Communications, Ethan exposes the reckless negligence of telecom customer support. He announces that he is consulting lawyers regarding potential legal action against T-Mobile, warning creators that digital security is broken by phone companies simply giving away personal information.

## Atmosphere & style The video carries an urgent, visibly rattled tone, departing sharply from Ethan's typical lighthearted comedy into genuine shock and vulnerability. His delivery alternates between disbelief, simmering outrage at corporate incompetence, and the visceral violation of having strangers sift through his private messages and contacts. Even as he inserts a brief satirical sketch at the end to mock the illusion of 'elite' hackers, the overarching atmosphere remains anxious, cautionary, and deeply frustrated by how powerless consumers are against negligent telecommunications providers.

## Bulletin - [01:04](https://www.youtube.com/watch?v=caVEiitI2vg&t=64s) Ethan and Hila Klein were targeted by the same hacker group that hijacked prominent creators like LeafyIsHere, Boogie2988, and Linus Tech Tips via mobile SIM card hijacking. - [01:04](https://www.youtube.com/watch?v=caVEiitI2vg&t=64s) T-Mobile customer service released Ethan's SIM card to a social engineer posing as a company employee, coming within five minutes of taking over the h3h3Productions YouTube channel. - [04:32](https://www.youtube.com/watch?v=caVEiitI2vg&t=272s) A protective passcode added by a genuine T-Mobile agent actively facilitated the breach because carrier internal protocols treated passcodes and Social Security numbers as alternative, either/or authentication factors. - [06:20](https://www.youtube.com/watch?v=caVEiitI2vg&t=380s) Ethan revealed he is consulting attorneys to potentially sue T-Mobile over corporate negligence, arguing telecommunications companies will only fix security vulnerabilities when hit financially.

## Key takeaways - [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) Corporate data leaks have reached epidemic scales, leaving personal information like Social Security numbers effectively public knowledge. - [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) Major institutions across diverse industries—including MySpace, eBay, JPMorgan Chase, and voter registries—have exposed hundreds of millions of user records. - [01:04](https://www.youtube.com/watch?v=caVEiitI2vg&t=64s) Prominent YouTube creators were systematically targeted using carrier social engineering rather than direct technical exploitation of their devices or platforms. - [01:04](https://www.youtube.com/watch?v=caVEiitI2vg&t=64s) Cloning a victim's SIM card allows attackers to bypass SMS-based two-factor authentication and access private communications directly. - [01:04](https://www.youtube.com/watch?v=caVEiitI2vg&t=64s) The attackers launched aggressive multi-target social engineering efforts, including calling Ethan's mother early in the morning while impersonating carrier staff. - [02:29](https://www.youtube.com/watch?v=caVEiitI2vg&t=149s) A genuine T-Mobile representative initiated contact to warn of fraudulent inquiries and set up a security passcode on Ethan's account. - [02:29](https://www.youtube.com/watch?v=caVEiitI2vg&t=149s) Ethan's cellular and data service abruptly disconnected thirty minutes after establishing the supposed security safeguard. - [02:29](https://www.youtube.com/watch?v=caVEiitI2vg&t=149s) During an emergency call regarding an ongoing hijack, T-Mobile customer service prioritized upselling their mobile billing app over addressing the breach. - [02:29](https://www.youtube.com/watch?v=caVEiitI2vg&t=149s) T-Mobile support admitted to surrendering the SIM card solely because the caller claimed to be an internal coworker. - [04:32](https://www.youtube.com/watch?v=caVEiitI2vg&t=272s) The carrier's either/or authentication policy enabled the attackers to exploit the newly created passcode instead of needing Ethan's Social Security number. - [04:32](https://www.youtube.com/watch?v=caVEiitI2vg&t=272s) Telecom customer service vulnerabilities mirror the HayliNic incident reported by The New York Times, where an impersonator obtained an address from Cox Communications, leading to a SWAT raid. - [06:20](https://www.youtube.com/watch?v=caVEiitI2vg&t=380s) User account security ultimately relies on whether individual, entry-level customer service representatives adhere to internal account notes and protocols. - [06:20](https://www.youtube.com/watch?v=caVEiitI2vg&t=380s) Legal action is being considered because telecommunications providers lack financial incentives to overhaul customer data security without litigation. - [06:20](https://www.youtube.com/watch?v=caVEiitI2vg&t=380s) The popular image of 'elite hackers' using sophisticated software is often a myth; many breaches rely entirely on phone companies handing over access upon request.

## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) Massive Data Breaches and Identity Exposure

Ethan opens the video shaken, stating that despite not intending to post again so quickly, something deeply disturbing and shocking occurred the day before that demanded immediate attention. He begins by examining the broader epidemic of corporate data leaks, browsing the site InformationIsBeautiful.net to highlight the sheer scale of recent security failures across major corporations. He points to staggering figures: MySpace exposing 164 million records, eBay leaking 145 million, JPMorgan Chase losing 76 million despite being a major financial institution that should possess elite security, alongside breaches at Home Depot, Target, Ubisoft, Tumblr, and a voter database leak of 191 million records. Ethan laments:

> “Literally. I feel like peoples social security number at this point is just a matter of public knowledge and if that's not terrible and scary enough it seems that companies now are just outright giving your information away to anybody that asks for it.”

- **Major Breaches Highlighted**: - Voter Database: 191 million - MySpace: 164 million - eBay: 145 million - JPMorgan Chase: 76 million - Other affected entities: Home Depot, Target, Ubisoft, Tumblr

---

[01:04](https://www.youtube.com/watch?v=caVEiitI2vg&t=64s) The Anatomy of a High-Profile SIM Swapping Campaign

Ethan reveals that he and Hila were targeted by the exact same group of hackers that had recently hijacked accounts belonging to prominent internet personalities like LeafyIsHere, Boogie2988, and Linus Tech Tips. While the public often wonders how malicious actors can penetrate YouTube accounts fortified with two-step verification and complex authentication, Ethan explains that the reality is entirely mundane yet terrifying. The perpetrators managed to acquire his SIM card directly from his mobile carrier, T-Mobile, by placing calls and impersonating company employees. With the cloned SIM activated in their device, the hackers intercepted his text messages, contacts, and personal data, coming within five minutes of taking over the h3h3Productions YouTube channel.

The attack had been aggressive and multi-pronged; the hackers even called Ethan's mother at 6:30 AM impersonating T-Mobile staff to hunt for account vulnerabilities. Ethan only managed to recognize what was happening because he had recently spoken to a creator friend who had been victimized by the same scheme.

```mermaid flowchart TD accTitle: The SIM Swap Attack Vector accDescr: A diagram illustrating how social engineering leads to account compromise via SIM cloning. subgraph Impersonation["Social Engineering Attack"] H["Hacker"] -->|"Calls carrier pretending to be employee"| TM["T-Mobile Support"] H -->|"Calls victim's family at 6:30 AM"| M["Ethan's Mother"] end subgraph CarrierAction["Carrier Vulnerability"] TM -->|"Transfers / clones active SIM"| HS["Hacker's Device"] end subgraph Takeover["Account Hijacking"] HS -->|"Intercepts SMS 2-step verification"| GA["Google / YouTube Account"] HS -->|"Accesses personal texts and contacts"| PI["Personal Data"] end ```

---

[02:29](https://www.youtube.com/watch?v=caVEiitI2vg&t=149s) The Flawed Security Fix and the Panic Call to T-Mobile

On the morning of the attack, a genuine T-Mobile representative called Ethan to warn him that an individual had repeatedly contacted customer support claiming to be an in-store employee standing with Ethan to request his account data. Because the suspicious caller routinely hung up whenever challenged, the representative suggested establishing a unique account passcode and placing a security warning on Ethan's file prohibiting unauthorized SIM transfers. Relieved, Ethan and Hila believed the disaster was averted, but roughly thirty minutes later, Ethan's cellular service vanished and 4G connectivity cut out completely.

Realizing his SIM had just been hijacked, Ethan scrambled to call T-Mobile customer service. Instead of treating the situation as an emergency, the representative spoke in a relaxed tone, ignoring his distress to push account promotions. Ethan recounts her oblivious response:

> “She goes 'okay, definitely can take look into that for you- just wanna let you know that your bill is due in ten days and if you wanna go ahead and try our new T-Mobile app- you can pay it that way, it's a lot more convenient, and I think you're gonna enjoy it a lot, so- are you interested in downloading our new app?'”

When pressed, the agent confirmed that T-Mobile had indeed given out Ethan's SIM card earlier that morning simply because the caller claimed to be a T-Mobile coworker.

---

[04:32](https://www.youtube.com/watch?v=caVEiitI2vg&t=272s) The "Passcode" Loophole and the Case of HayliNic

After the representative deactivated the hacker's SIM and restored Ethan's service, Ethan demanded to know how the breach occurred after he had just set up security safeguards. The representative calmly informed him that the hackers used the brand-new passcode he had established with the previous agent just thirty minutes prior. Ethan realized in horror that T-Mobile's internal protocol treated account security as an "either/or" system: an agent required either a Social Security number *or* the passcode, making the newly minted PIN an easier vector for social engineers than brute-forcing personal identifiers. Ethan reacts:

> “So they called to set up an extra security measure to prevent me from getting hacked and it turns out their extra security measure made me more vulnerable because somehow, it seems that generating that pass code was part of their plan to get into my account because before they couldn't do it and thirty almost directly after we set up the pass code they were able to get in my account.”

Ethan connects his ordeal to an investigative *New York Times* article titled "The Serial Swatter." In that case, an obsessive stalker targeted a small Twitch streamer named HayliNic. The stalker phoned cable provider Cox Communications, claimed to be an internal employee, and was casually handed her residential address. The compromise resulted in an armed SWAT team raiding HayliNic's home, putting her life in extreme danger.

---

[06:20](https://www.youtube.com/watch?v=caVEiitI2vg&t=380s) Industry Negligence, Legal Threats, and the Myth of "Elite" Hackers

Ethan stresses that social media figures and creators must recognize that hackers target their cellular providers rather than hacking their devices directly. He urges everyone to contact their carriers to attach strict security instructions to their accounts, though he admits feeling powerless because safety ultimately hinges on whether an entry-level customer service employee bothers to read account notes. Describing the psychological toll of realizing strangers had full access to his private messages, emails, and contacts as feeling like a "digital rape," Ethan reveals he is consulting lawyers:

> “So we're considering to sue T-Mobile because the only language these companies understand is money - Money talks, and if they don't lose money, then they have no reason to change their policy at all.”

Ethan concludes by puncturing the popular myth of the hooded, elite cybercriminal operating with near-magical technical prowess. The reality, he explains, is humiliatingly simple: hackers succeed simply because phone companies give away customer identities upon request. To illustrate this absurdity, the video ends with a comedic parody sketch featuring lightning flashes, dramatic hacking music, and Ethan furiously clacking keys, only to reveal him phoning T-Mobile support to ask: “I'm here with PewDiePie, uh, we were here trying to get a SIM card he was having trouble with his phone could you please send me the SIM card for PewDiePie, please?”

## Notable quotes > [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) I feel like peoples social security number at this point is just a matter of public knowledge and if that's not terrible and scary enough it seems that companies now are just outright giving your information away to anybody that asks for it. — Ethan

> [06:20](https://www.youtube.com/watch?v=caVEiitI2vg&t=380s) So we're considering to sue T-Mobile because the only language these companies understand is money - Money talks, and if they don't lose money, then they have no reason to change their policy at all. — Ethan

## Mentioned Ethan, Hila, T-Mobile, InformationIsBeautiful.net, MySpace, eBay, JPMorgan Chase, Home Depot, Target, Ubisoft, Tumblr, LeafyIsHere, Boogie2988, Linus Tech Tips, Google, YouTube, h3h3Productions, The New York Times, The Serial Swatter, Cox Communications, HayliNic, PewDiePie, Yubikey

## Video description Our privacy was compromised when a hacker got our sim card

Note: The t-mobile rep that originally called us was NOT the hacker, he called to set up the passcode as confirmed by t-mobile. I also asked the guy to confirm his ID before we set up the passcode. Also the passcode did not exist before the call, so if it was the hacker, he would also have to set up the code. Anyway, t-mobile confirmed the call was real.

HOW TO PROTECT YOURSELF:

1. BUY A USB PASS KEY (Look up Yubikey)

2. SET UP GOOGLE AUTHENTICATION APP https://support.google.com/accounts/answer/1066447?hl=en

Watch the Reaction Video Playlist -- https://goo.gl/QUHWA6

NYT article: http://www.nytimes.com/2015/11/29/magazine/the-serial-swatter.html

Go check out HayliNic https://www.twitch.tv/haylinic https://www.youtube.com/user/haylinicTV

Facebook................ https://facebook.com/H3h3productions Twitter...................... https://twitter.com/h3h3productions Instagram................ http://instagram.com/h3h3productions 2nd channel............. https://youtube.com/user/h2h2productions Spreadshirt.............. http://h3h3productions.spreadshirt.com Hila's Art................... http://hilaklein.com Subreddit.................. http://reddit.com/r/h3h3productions

-------------------------------------------------------------------------- ***ULTIMATE DUNNIE GIVEAWAY RULES*** Every month, we give away one unique, beautiful and luscious dunnie. Here is how to win:

We post our new videos on Facebook and Twitter, all you need to do is LIKE AND SHARE/RETWEET each video to be eligible to win. At the end of the month we will randomly select one post from either Facebook or Twitter and then choose one random person who liked and shared that chosen post to win. The more you like/share, the higher chance you have of winning.

At the end of every month we will announce the winner on the "Ethan and Hila" channel.

https://www.youtube.com/user/h2h2productions -------------------------------------------------

Theme Song by MajorLeagueWobs: https://www.youtube.com/user/strangeholder

Music Used:

At The Shore - The Dark Contenent by Kevin MacLeod is licensed under a Creative Commons Attribution license (https://creativecommons.org/licenses/by/4.0/) Source: http://incompetech.com/music/royalty-free/index.html?isrc=USUAN1100770 Artist: http://incompetech.com/

"Night Music" by Kevin MacLeod from YouTube free music library.

"The Drive" by Kevin MacLeod from YouTube free music library.

[Source](https://www.youtube.com/watch?v=caVEiitI2vg)

中文简报

因运营商将SIM卡交给黑客，H3h3考虑起诉T-Mobile 由于运营商客服规程在缺乏基本核验的情况下屡次将SIM卡交给社工攻击者，在线账户依然极易遭到劫持。 Ethan Klein讲述了他和Hila如何成为一起协同SIM卡劫持攻击的受害者，该攻击由曾针对LeafyIsHere、Boogie2988和Linus Tech Tips等创作者的同一团伙实施。尽管在T-Mobile设置了专门的安全密码，但运营商代表仍在三十分钟内将Ethan的有效SIM卡交给了冒充者，险些导致他们的YouTube频道被夺走并泄露了隐私数据。Ethan援引《纽约时报》关于主播HayliNic因Cox Communications被开盒和报假警遭特警突袭（swatted）的调查报道，揭露了电信客服的严重失职。他宣布正就可能对T-Mobile采取的法律行动咨询律师，并提醒创作者注意，由于电话公司轻易泄露个人信息，数字安全机制已被打破。 Ethan和Hila Klein遭到了同一个黑客团伙的攻击，该团伙曾通过手机SIM卡劫持手段对LeafyIsHere、Boogie2988和Linus Tech Tips等知名创作者实施劫持。 (1:04) T-Mobile客服将Ethan的SIM卡交给了一名冒充公司员工的社工攻击者，险些在五分钟内夺走h3h3Productions的YouTube频道控制权。 (1:04) 由真正的T-Mobile业务员添加的保护密码实际上促成了此次入侵，因为运营商内部规程将密码和社保号视作二选一的替代性身份验证手段。 (4:32) Ethan透露他正在咨询律师以考虑就企业过失起诉T-Mobile，认为电信公司只有在遭受经济打击时才会修复安全漏洞。 (6:20)

Reading summary

Ethan Klein of h3h3Productions argues that personal digital privacy is fundamentally compromised not by elite technical exploits, but by systemic corporate negligence and telecom customer support vulnerabilities that hand account access to social engineers. The Epidemic of Corporate Data Breaches (0:00) Klein frames identity theft as an inevitable consequence of repeated, massive corporate security failures. Citing breach data, he highlights catastrophic leaks across diverse sectors, including a 191 million-record voter database, MySpace (164 million), eBay (145 million), and JPMorgan Chase (76 million), alongside intrusions at Target, Home Depot, Ubisoft, and Tumblr. He contends that because basic identifiers like Social Security numbers have effectively entered the public domain, everyday consumers are exposed whenever external service providers fail to rigorously authenticate callers. The Mechanics of SIM-Swapping Attacks (1:04) Examining a breach targeting h3h3Productions—part of a wider campaign affecting creators like LeafyIsHere, Boogie2988, and Linus Tech Tips—Klein explains that attackers bypass multi-factor authentication by compromising mobile carriers rather than individual devices. By calling T-Mobile and impersonating company employees, the perpetrators convinced support staff to clone Klein's SIM card to an external device. This granted the attackers immediate access to his cellular data, personal contacts, and SMS-based two-step verification codes, bringing them within five minutes of seizing the h3h3Productions YouTube channel. Telecom Operational Failures and Security Loopholes (2:29) Klein recounts how internal telecom safeguards actively accelerated the breach. After an initial warning from T-Mobile regarding suspicious inquiries, Klein set up a unique security passcode and transfer restriction. Roughly thirty minutes later, his service went dark because the hackers utilized the brand-new passcode to finalize the SIM transfer. Klein discovered that carrier verification operated as an "either/or" system, where having the newly minted passcode bypassed other personal identifiers, creating an easier path for social engineering than finding an SSN. Institutional Indifference and the Danger of Doxxing (4:32) During the active compromise, Klein encountered profound carrier indifference: customer service representatives responded casually and attempted to upsell him on bill-pay applications rather than treating the account hijacking as an emergency. He compares this corporate carelessness to a reported case involving Twitch streamer HayliNic, where an impostor obtained her home address from Cox Communications by posing as an internal worker, resulting in a dangerous armed SWAT raid on her residence. Dispelling Hacker Myths and Demanding Corporate Accountability (6:20) Klein rejects the cultural myth of the hooded, elite cybercriminal operating with complex software, asserting that most hijackings succeed simply because telecom staff hand over sensitive records upon request. Because personal security ultimately rests on whether frontline customer service workers adhere to account flags, Klein described the intrusion as a severe violation and announced he is consulting lawyers regarding potential legal action against T-Mobile, arguing that financial repercussions are the only incentive that compels telecommunications companies to revise negligent internal practices. Klein illustrates that while users can adopt strong credentials and two-step verification, consumer privacy remains fundamentally insecure as long as mobile carriers rely on porous customer service protocols that can be circumvented with basic social engineering.

精炼阅读摘要

h3h3Productions的Ethan指出，所谓的“高超黑客技术”往往只是利用电信运营商内部管理漏洞实施的低技术社会工程学欺诈；由于运营商客服轻信冒充员工的攻击者并泄露SIM卡与个人数据，公众与创作者的隐私及两步验证体系正面临严重的系统性威胁。大规模数据泄露泛滥与隐私防线瓦解 (0:00) Ethan结合InformationIsBeautiful.net网站的数据指出，主流机构与大型企业的数据外泄已成为常态，这使得公众的个人敏感信息近乎公开。相关公开事件包括选民数据库泄露的1.91亿条记录、MySpace的1.64亿条、eBay的1450万条，甚至连作为主要金融机构、理应拥有顶级安保的JPMorgan Chase也泄露了7600万条记录，此外还涉及Home Depot、Target、Ubisoft和Tumblr等企业。在他看来，社会安全号码等核心隐私在当前环境下几乎人人皆可获取，而企业更倾向于在未经严格核实的情况下将用户资料轻易交付给外部询问者。针对头部创作者的SIM卡劫持攻击 (1:04) Ethan与Hila近期遭遇了针对知名互联网博主的连环攻击，同一黑客团伙此前曾对LeafyIsHere、Boogie2988和Linus Tech Tips的账号实施过入侵。尽管受害者普遍启用了复杂的两步验证机制，黑客却避开了技术层面的正面对抗，而是通过冒充T-Mobile内部员工直接致电客服调取并克隆SIM卡。攻击者借此拦截短信验证码、通讯录和私人数据，一度在五分钟内逼近完全接管h3h3Productions的YouTube官方频道。不仅如此，攻击者还采取多方施压的手段，于清晨6点30分致电Ethan的母亲冒充客服探寻账户弱点；Ethan仅仅是因为此前与一位经历过类似骗局的创作者朋友交流过，才得以迅速识破该手段。安全补丁漏洞与客服流程的荒谬脱节 (2:29) 在事发当天早晨，一名真正的T-Mobile代表曾主动联系Ethan，提醒有人频繁自称店内员工并声称与Ethan站在一起要求获取账户数据。为防范风险，该代表建议在账户上设置专属通行密码（passcode）并添加防篡改安全警示，然而约三十分钟后Ethan的手机信号与4G网络却彻底中断。在紧急致电客服核实期间，接线代表不仅对危机漠不关心，甚至在紧急状态下向其推销账单缴费应用与促销服务，随后才证实此前已有员工仅凭对方自称是“T-Mobile同事”便将SIM卡发放出去。验证机制缺陷与实体危害的现实案例 (4:32) 恢复网络后，Ethan发现黑客用于接管账户的凭证，竟然是自己刚刚在客服建议下设置的新通行密码。T-Mobile的内部安全协议采用了“二选一”的核验逻辑，即客服只需验证社会安全号码或通行密码其中之一即可放行操作，这一新设的PIN码反而为社会工程学攻击提供了比暴力破解更简单的捷径。Ethan将此现象与《纽约时报》关于连环报假警者（The Serial Swatter）的报道相联系：在该案中，一名跟踪者同样冒充内部员工致电有线电视运营商Cox Communications，轻松套取了Twitch小主播HayliNic的家庭住址，最终导致全副武装的特警队（SWAT）突袭其住所，造成极大的生命安全隐患。去神话化黑客与追究运营商法律责任 (6:20) Ethan打破了外界对黑客具备高深代码技术、身着连帽衫的神话形象，直言其得手核心在于电信运营商对于身份审核的极度怠忽。面对个人私密信息被完全窥探所带来的精神创伤，Ethan表示正在咨询律师并考虑起诉T-Mobile，认为唯有承受经济损失才能迫使大型企业修正内部安全流程。他提醒所有创作者与用户，即便致电运营商追加严密的安全备注，防御的实际效果仍完全受制于底层客服人员是否愿意阅读这些指示，个人在现行体制下面临着巨大的无力感。 Ethan强调，目前公众数字身份的安全完全依赖于电信运营商基层人员的审核防线，而现行流程存在严重的人为与机制漏洞。他正通过法律咨询探索向运营商施责的途径，但如何从根本上迫使大企业修改身份验证机制，仍是一个悬而未决的现实困境。

Detailed notes — zh

## Background 该视频由 YouTube 知名创作者 h3h3Productions 于 2016 年 7 月 8 日发布。视频简介说明了由于黑客通过电信运营商获取了他们的 SIM 卡，导致个人隐私严重泄露，同时附上了运营商客服电话的真实性说明以及使用 Yubikey 和 Google Authenticator 进行账户自我保护的建议指南。 ## TL;DR Ethan Klein 讲述了自己遭遇的一起惊心动魄的 SIM 卡劫持（SIM Swapping）黑客攻击事件。此前 LeafyIsHere、Boogie 和 LinusTechTips 等多位知名创作者相继被黑，而 Ethan 在刚与 T-Mobile 设置完账户安全密码仅半小时后手机便断网失联，起因竟是客服误将新 SIM 卡直接发放给了冒充内部员工的黑客。危急关头客服不仅毫无紧迫感地推销手机应用，还暴露了验证流程中只要提供社保号或密码即可绕过安全备注的巨大漏洞。Ethan 借此痛斥大型通信巨头对用户隐私的漠视与失职，提醒所有内容创作者警惕社会工程学攻击，并严正表示正在考虑对 T-Mobile 发起法律诉讼。 ## Atmosphere & style 视频开篇笼罩在普遍数据泄露与账户接连沦陷的警惕与不安之中，随着手机突遭断网、黑客近在咫尺的危机爆发，情绪迅速转为极度的惊恐与抓狂。面对客服人员漫不经心的推销与荒唐的解释，Ethan 的愤怒彻底爆发，拍桌怒斥通信巨头的渎职，言辞激烈且直戳痛处。整期视频在严肃警示、无力感与荒诞讽刺之间拉扯，结尾处通过模仿黑客诈骗 PewDiePie 的恶搞短剧，将对运营商安全漏洞的嘲弄推向高潮。 ## Bulletin - [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) 近期 LeafyIsHere、Boogie 及 LinusTechTips 等知名 YouTube 创作者接连遭遇黑客攻击，核心入侵路径并非破解高难度代码，而是通过运营商内部流程实施的 SIM 卡交换攻击。 - [02:08](https://www.youtube.com/watch?v=caVEiitI2vg&t=128s) 黑客仅凭冒充 T-Mobile 员工并声称在店内协助客户，便成功让运营商客服将 Ethan Klein 的 SIM 卡转交，导致其原手机信号瞬间中断且验证码被全面截获。 - [03:28](https://www.youtube.com/watch?v=caVEiitI2vg&t=208s) 运营商的身份验证体系存在严重结构性缺陷，访问权限往往只需安全密码或社会安全号码其一，反使匆忙设立的安全防线沦为黑客攻击的跳板。 - [05:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=300s) Ethan Klein 宣布正严肃考虑对 T-Mobile 提起诉讼，直言大企业只有在承受实际经济损失时才会真正改革其毫无保障的用户隐私与安全政策。 ## Key takeaways - [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) 全球大型企业频繁发生严重数据泄露，大众的社会安全号码等核心敏感信息在事实上已近乎沦为公开信息。 - [01:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=60s) 近期多位顶尖 YouTube 创作者账号连续沦陷，外界困惑的双重验证被破之谜实则是电信服务端的漏洞所致。 - [01:30](https://www.youtube.com/watch?v=caVEiitI2vg&t=90s) 所谓的黑客高超技术背后，往往只是利用社会工程学直接从电信运营商处骗取目标用户的 SIM 卡。 - [02:08](https://www.youtube.com/watch?v=caVEiitI2vg&t=128s) 黑客清晨便冒充 T-Mobile 员工致电 Ethan 的母亲，展开全方位的社会工程学背景调查与漏洞试探。 - [02:30](https://www.youtube.com/watch?v=caVEiitI2vg&t=150s) 虽然官方客服曾致电提醒存在异常并建议添加安全密码，但这一加固举措并未能阻止后续的卡片移交。 - [03:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=180s) 设置密码仅 30 分钟后 Ethan 的手机信号便彻底中断，意味着 SIM 卡已被攻击者成功劫持并激活。 - [03:30](https://www.youtube.com/watch?v=caVEiitI2vg&t=210s) 在用户面临身份盗用和重大网络资产沦陷的紧急时刻，运营商一线客服仍在机械推销移动应用及账单服务，表现出对危机的极端冷漠。 - [04:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=240s) T-Mobile 客服直接向 Ethan 承认，仅因对方在电话中声称是内部员工，系统便未经充分核实将 SIM 卡交出。 - [04:30](https://www.youtube.com/watch?v=caVEiitI2vg&t=270s) 运营商身份验证逻辑存在致命缺陷，安全密码与社会安全号码呈‘或’关系，使得安全机制反被黑客反向利用。 - [05:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=300s) 《纽约时报》关于假警报（Swatting）的调查表明，通信企业员工随意泄露客户家庭住址曾导致无辜主播面临致命武力威胁。 - [05:30](https://www.youtube.com/watch?v=caVEiitI2vg&t=330s) 公众人物与视频创作者极度依赖短信两步验证，这导致电信运营商的一线客服成为了整条数字资产安全链上最薄弱的单点。 - [06:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=360s) 即便用户在账户内添加最高级别的安全备注，安全保障最终依然完全取决于接线客服是否认真阅读并遵守指示。 - [06:30](https://www.youtube.com/watch?v=caVEiitI2vg&t=390s) 黑客控制 SIM 卡后几乎能在几分钟内彻底接管 Google 与 YouTube 核心资产，给受害者带来极强的隐私侵犯感。 - [07:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=420s) 只有通过法律诉讼造成切实经济损失，才能迫使大型通信企业真正改进其形同虚设的隐私保护政策。 - [07:30](https://www.youtube.com/watch?v=caVEiitI2vg&t=450s) 大众对于黑客技术的神秘想象在现实中被彻底戳破，许多安全灾难本质上是电信巨头主动将客户权限拱手送给了骗子。 ## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) 泛滥的数据泄露与神秘的创作者黑客攻击视频开头，Ethan Klein 表示自己本没打算在上一期视频发布后这么快就再次更新，但昨天发生的一起极其令人不安且震惊的事件，迫使他必须站出来录制视频。他指出，如今大型企业似乎随处都在泄露用户的数据。在浏览网站 InformationIsBeautiful.net 上关于“全球最大规模数据泄露事件”的可视化图表时，各种触目惊心的数字历历在目：MySpace 泄露了 1.64 亿条数据，eBay 泄露了 1.45 亿条，作为大型金融机构本应拥有极高安全防护的摩根大通（JPMorgan Chase）竟泄露了 7600 万条；此外，Home Depot、Target、Ubisoft、Tumblr 乃至选民数据库（Voter Database，泄露 1.91 亿条）都赫然在列。Ethan 感慨道：“Literally. I feel like peoples social security number at this point is just a matter of public knowledge.”（毫不夸张地说，我觉得现在人们的社会安全号码简直已经成了公开信息。）更可怕的是，现在很多公司甚至会直接把客户的信息拱手送给任何开口索要的人。紧接着，Ethan 谈到了近期席卷 YouTube 圈的一系列黑客入侵事件：LeafyIsHere、Boogie 以及 LinusTechTips 等知名创作者的账号接连沦陷。外人往往难以理解，在拥有两步验证（2-Step Verification）和重重安全机制的情况下，黑客到底是如何攻破 YouTube 账号的？直到昨天，Ethan 和 Hila 亲身经历了这场攻击，才彻底看清了其中的恐怖真相——黑客并非凭借高超的代码技术，而是直接从他们的电信运营商 T-Mobile 手中拿到了 Ethan 的 SIM 卡。 ```mermaid flowchart LR accTitle: SIM Swapping Attack Vector accDescr: 攻击者伪装成内部员工向运营商索取SIM卡并劫持两步验证的流程图 subgraph ATTACKER["攻击者"] A["黑客伪装成 T-Mobile 员工"] end subgraph CARRIER["电信运营商"] B["T-Mobile 客服 验证机制形同虚设"] C["签发/激活 攻击者的新 SIM 卡"] end subgraph VICTIM["受害者受害流程"] D["Ethan 手机信号中断 SIM 卡被注销"] E["黑客接收验证码 攻破 Google/YouTube 账号"] end A -->|"致电声称在门店内协助"| B B -->|"未经严密核验"| C C -->|"原卡失效"| D C -->|"控制短信/来电"| E ``` ### [02:08](https://www.youtube.com/watch?v=caVEiitI2vg&t=128s) 致命的“安全加固”陷阱与毫无紧迫感的客服这起攻击其实早有预兆。黑客曾于清晨 6:30 假冒 T-Mobile 员工致电 Ethan 的母亲，试图从各个角度试探安全漏洞。随后，一名真正的 T-Mobile 客服代表给 Ethan 打来电话，提醒称有人多次冒充 T-Mobile 员工并声称“正与 Ethan 在门店内”，试图获取其账户信息；每次被拒后对方都会立刻挂断。为了保护账户，该客服建议立即为账户设置一个安全密码（Passcode），并在系统内添加安全备注，严禁将 SIM 卡提供给他人。Ethan 和 Hila 以为危机已经解除，长舒了一口气。然而仅仅过了大约 30 分钟，Ethan 的手机信号突然全无，4G 图标消失，连电话也无法拨出。由于此前与被黑的朋友交流过经验，Ethan 瞬间意识到大事不妙：“they've got the SIM, they've got the SIM, I'm shut off, I'm being hacked right fucking now.”（他们拿到 SIM 卡了，我的信号断了，我他妈的正在被黑！）他立刻使用其他方式惊慌失措地打给 T-Mobile 客服求救，大喊自己是知名 YouTuber、情况十万火急。不料电话那头的女客服却态度极其悠闲，甚至在背景放着轻柔音乐的氛围中慢条斯理地推销起账单业务，询问他是否想下载全新的 T-Mobile App 来支付 10 天后到期的账单。面对 Ethan 的抓狂，客服才轻描淡写地承认：“Well, it appears that somebody did call earlier this morning and, we did give them your SIM card because they said they work with T-Mobile.”（看起来今天早些时候确实有人打电话过来，我们把你的 SIM 卡给他们了，因为他们说自己是 T-Mobile 的员工。） - **黑客攻势全方位铺开**：清晨 6:30 冒充员工致电 Ethan 的母亲，并在系统内反复尝试社会工程学攻击。 - **客服人员荒唐推销**：在受害者面临重大网络身份盗窃的紧急关头，T-Mobile 客服仍在推销手机应用程序及促销活动。 - **致命安全漏洞**：客服最终为 Ethan 恢复了 SIM 卡，并解释称黑客是用他们刚刚设置的密码登录了账户。原来在 T-Mobile 的验证体系中，访问账户只需社会安全号码“或者”安全密码二选一即可；黑客通过伪装成内部员工套取或绕过验证，使得这道所谓的“安全防线”反而成了他们攻入系统的跳板。 ### [05:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=300s) 社会工程学危机与诉讼警告面对客服轻飘飘的一句“我已经帮您解决了问题吗？”，Ethan 愤怒地猛拍桌子。他痛斥 T-Mobile 的所谓“额外安全措施”不仅没有起到保护作用，反而让客户更加脆弱。这暴露出公用事业和通信巨头在保护客户身份信息方面的根本性溃败。为了说明此类安全漏洞有多么危险，Ethan 引用了《纽约时报》题为《连环假警报制造者》（The Serial Swatter）的长篇报道：一名患有偏执妄想的狂热粉丝盯上了一位名为 HayliNic 的小型 Twitch 主播，该粉丝仅仅致电有线电视公司 Cox Communications 自称是内部员工，对方就不假思索地交出了 HayliNic 的家庭住址，导致全副武装的特警队（SWAT）持枪破门闯入其住所，受害人几乎因此丧命。 Ethan 警告所有视频创作者和具有公众知名度的人士：黑客获取双重验证码的核心手段就是向通信公司骗取 SIM 卡。他敦促观众立刻给运营商打电话要求在账户上添加严苛的防范备注。但他同时也无奈地承认，即使做了所有防范，客户依然命悬一线，完全受制于接电话的普通客服是否认真阅读了那行“不要将 SIM 卡给陌生人”的备注。Ethan 直言，黑客手里拿到了他的 SIM 卡，能截获所有的短信、邮件和联系人，距离彻底夺取他的 Google 和 YouTube 账号只差五分钟，这感觉就像是一场“数字强奸”（digital rape）。Ethan 明确表示他们正严肃考虑起诉 T-Mobile：“So we're considering to sue T-Mobile because the only language these companies understand is money - Money talks, and if they don't lose money, then they have no reason to change their policy at all.”（我们正在考虑起诉 T-Mobile，因为这些公司唯一听得懂的语言就是钱——金钱万能，如果他们不赔钱，就绝不会有任何动力去改变他们的政策。）在视频末尾，Ethan 感叹大众总以为黑客掌握着神乎其技的高超计算机技术，但当剥开真相时，现实却显得丑陋而可笑：所谓的“黑客攻击”，本质上不过是你的电话运营商亲手把你出卖给了骗子。为了讽刺这一荒谬现状，视频最后插入了一段滑稽的恶搞短剧：Ethan 假装正在给 T-Mobile 客服打电话，声称自己是店内员工，正和知名 YouTuber PewDiePie（Felix）站在一起，请求客服把 PewDiePie 的 SIM 卡直接交出来，伴随着雷声与 PewDiePie 的惨叫，讽刺效果拉满。 ## Notable quotes > [05:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=300s) So we're considering to sue T-Mobile because the only language these companies understand is money - Money talks, and if they don't lose money, then they have no reason to change their policy at all. — Ethan Klein > [00:00](https://www.youtube.com/watch?v=caVEiitI2vg&t=0s) Literally. I feel like peoples social security number at this point is just a matter of public knowledge. — Ethan Klein ## Mentioned Ethan Klein, Hila Klein, T-Mobile, Google, YouTube, MySpace, eBay, JPMorgan Chase, Home Depot, Target, Ubisoft, Tumblr, LeafyIsHere, Boogie, LinusTechTips, HayliNic, Cox Communications, PewDiePie, The New York Times, YubiKey, Google Authenticator ## Video description Our privacy was compromised when a hacker got our sim card Note: The t-mobile rep that originally called us was NOT the hacker, he called to set up the passcode as confirmed by t-mobile. I also asked the guy to confirm his ID before we set up the passcode. Also the passcode did not exist before the call, so if it was the hacker, he would also have to set up the code. Anyway, t-mobile confirmed the call was real. HOW TO PROTECT YOURSELF: 1. BUY A USB PASS KEY (Look up Yubikey) 2. SET UP GOOGLE AUTHENTICATION APP https://support.google.com/accounts/answer/1066447?hl=en Watch the Reaction Video Playlist -- https://goo.gl/QUHWA6 NYT article: http://www.nytimes.com/2015/11/29/magazine/the-serial-swatter.html Go check out HayliNic https://www.twitch.tv/haylinic https://www.youtube.com/user/haylinicTV Facebook................ https://facebook.com/H3h3productions Twitter...................... https://twitter.com/h3h3productions Instagram................ http://instagram.com/h3h3productions 2nd channel............. https://youtube.com/user/h2h2productions Spreadshirt.............. http://h3h3productions.spreadshirt.com Hila's Art................... http://hilaklein.com Subreddit.................. http://reddit.com/r/h3h3productions -------------------------------------------------------------------------- ***ULTIMATE DUNNIE GIVEAWAY RULES*** Every month, we give away one unique, beautiful and luscious dunnie. Here is how to win: We post our new videos on Facebook and Twitter, all you need to do is LIKE AND SHARE/RETWEET each video to be eligible to win. At the end of the month we will randomly select one post from either Facebook or Twitter and then choose one random person who liked and shared that chosen post to win. The more you like/share, the higher chance you have of winning. At the end of every month we will announce the winner on the "Ethan and Hila" channel. https://www.youtube.com/user/h2h2productions ------------------------------------------------- Theme Song by MajorLeagueWobs: https://www.youtube.com/user/strangeholder Music Used: At The Shore - The Dark Contenent by Kevin MacLeod is licensed under a Creative Commons Attribution license (https://creativecommons.org/licenses/by/4.0/) Source: http://incompetech.com/music/royalty-free/index.html?isrc=USUAN1100770 Artist: http://incompetech.com/ "Night Music" by Kevin MacLeod from YouTube free music library. "The Drive" by Kevin MacLeod from YouTube free music library. [Source](https://www.youtube.com/watch?v=caVEiitI2vg)

Source quotes

[5:00] Ethan Klein: So we're considering to sue T-Mobile because the only language these companies understand is money - Money talks, and if they don't lose money, then they have no reason to change their policy at all. [0:00] Ethan Klein: Literally. I feel like peoples social security number at this point is just a matter of public knowledge.

Source quotes

[0:00] Ethan: I feel like peoples social security number at this point is just a matter of public knowledge and if that's not terrible and scary enough it seems that companies now are just outright giving your information away to anybody that asks for it. [6:20] Ethan: So we're considering to sue T-Mobile because the only language these companies understand is money - Money talks, and if they don't lose money, then they have no reason to change their policy at all.

Original transcript

[0:00] I did not think that I would be back here [0:01] blasting ass so quickly after our last video, [0:04] but something happened yesterday that was so disturbing, and so shocking, [0:08] that I truly had to come back and make another video about it. [0:12] Now let me start by saying that lately [0:14] it seems like companies, huge companies, are leaking peoples data [0:18] all over the place. [0:20] I mean, I looked at this website here [0:22] InformationIsBeautiful.net [0:24] and visualized the worlds biggest data breaches. [0:27] Just take a look at this here. [0:29] MySpace: A hundred and sixty-four million. [0:32] Ebay: One hundred and forty-five million [0:35] JP Morgan and Chase - They're supposed to be a banking institution. [0:39] How do they not have better security? [0:40] Seventy-six million. [0:42] Home Depot. [0:43] Target. [0:43] Ubisoft. [0:44] Tumblr. [0:45] Voter Database! [0:46] A hundred and ninety-one million. [0:49] Literally. I feel like peoples social security number at this point [0:51] is just a matter of public knowledge [0:53] and if that's not terrible and scary enough [0:56] it seems that companies now are just outright [0:59] giving your information away to anybody that asks for it. [1:04] So yesterday, umm, [1:05] we were targeted by one of these hackers that's been going around [1:08] taking control of very popular people's pages. [1:11] LeafyIsHere got hacked. [1:13] Boogie got hacked recently. [1:15] LinusTechTips got hacked. [1:16] And you think to yourself "How the fuck do people get in a YouTube account?! [1:21] They have two-step verification and a bunch of security. [1:23] How is it possible?" [1:25] Well, we know. We figured it out because they tried it on us [1:28] and it is horrifying! [1:30] So these hackers were able to acquire my SIM card [1:33] from T-Mobile itself. From our carrier. [1:37] They called and impersonated a T-Mobile employee [1:40] and, you know, T-Mobile being the gracious host that they are [1:44] wanted to provide a great service to them [1:46] by giving them our fucking SIM card! [1:48] These guys had the card [1:49] in their phone [1:50] they had access to my text messages, [1:53] my contacts - everything in my fucking phone [1:55] we were five minutes away from them having [1:58] access to our YouTube channel [1:59] and basically completely fucking us. [2:01] And the only reason we were able to stop it [2:03] is because I had talked to one of my friends who was [2:05] hacked by them recently and I knew how [2:08] the attack was taking place. [2:09] That, you know, their technique now is that they get [2:12] your SIM card from your phone company [2:14] and that's how they do it [2:15] These fucking guys even called my mom yesterday morning at six-thirty [2:19] impersonating T-Mobile employees. [2:21] So they're definitely hitting this thing on all sides just looking for the weak points [2:25] and T-Mobile security and, hell, there's a lot of weak points [2:29] so yesterday morning somebody from T-Mobile calls me and he says "hey, just wanna let you know-" [2:33] "-that there's been somebody who's been requesting your information a lot-" [2:36] "-he claims that he works with T-Mobile and that he's in there with the store with you-" [2:41] "-now, a lot of people have - whenever we deny him the information, he just hangs up-" [2:45] "-so, we want to call and set up some extra securities, to secure your account." [2:50] And his suggestion was that we set up a pass code, so we set up the pass code [2:55] He makes a note in the system saying, you know... [2:57] don't give out their SIM card or that they're under threat, you know, from a security breach [3:02] and, uh [3:03] We're really relieved, we're like "man, dude, that was a close call." [3:08] Me and Hila were just about to go about our day [3:10] And about thirty minutes after that my cellphone, the service drops. Completely. [3:15] It just goes completely. Like the 4G just disappears. [3:19] And I try to make a call, surely, it's like... no activity. [3:22] And immediately I'm like "they've got the SIM, they've got the SIM, I'm shut off, I'm being hacked right fucking now." [3:28] So I'm panicking. I call up T-Mobile [3:31] I get them on the phone and I'm like "Yo! I talked to somebody thirty minutes ago-" [3:36] "-they said that somebody that somebody was trying to hack me and get my SIM card-" [3:39] "-I think they got it because my service got shut off-" [3:41] (frantic) "-my SIM card's hacked, I'm being attacked, I'm a popular YouTuber, this is very urgent!" [3:44] [relaxing music plays] She goes (calm voice) "okay, definitely can take look into that for you-" [3:47] "-just wanna let you know that your bill is due in ten days and if you wanna go ahead and try our new T-Mobile app-" [3:52] "-you can pay it that way, it's a lot more convenient, and I think you're gonna enjoy it a lot, so-" [3:56] "-are you interested in downloading our new app?" [3:58] Did you not listen?! This is urgent! [4:00] Like the lady has no urgency at all. She's pitching her new fucking app. [4:05] (corporate music) She just goes (calm) "well it does appear that somebody did call earlier this morning and, uh-" [4:09] "-we did give them your SIM card because they said they work with T-Mobile." [4:14] And I'm like "oh, that's..." [4:16] "... yeah, that sounds reasonable, um..." [4:18] "... so, if you wanna go ahead, I mean, if you're interested, I don't wanna tell you how to do your job-" [4:23] "-but if you wanna go ahead and activate my SIM card and maybe just fucking blast their's into outer space-" [4:29] -"but first, can you tell me a little more about your special promotions?" [4:32] So, basically, she deactivates their SIM, reactivates our SIM [4:37] and, for now, I'm relieved 'cause at least I got my phone back but I'm completely panicking. [4:42] It's like "how the fuck did this happen, lady?! Can you explain how did this happen?" [4:47] [more relaxing music] "Well, it appears that after you set up your passcode with the rep that called you this morning-" [4:52] "-they were able to login to your account using the pass code that you set up..." [4:56] "-I that I've been helpful today. Have I resolved your issue?" [4:59] [bangs desk] [5:00] (in a high-pitched voice) WHAAT?! [5:02] What kind of extra security is that?! [5:04] Like, are you fucking kidding me? [5:06] So they called to set up an extra security measure to prevent me from getting hacked [5:11] and it turns out their extra security measure made me more vulnerable [5:14] because somehow, it seems that generating that pass code was part of their plan to get into my account [5:20] because before they couldn't do it and thirty almost directly after we set up the pass code [5:24] they were able to get in my account. [5:26] So it turns out you need either my social security number *or* the pass code to get in [5:30] You don't need both. [5:31] And, apparently, it's a lot easier to get the pass code impersonating a T-Mobile agent [5:36] than it is to get straight access to my SIM card [5:39] There's a fundamental failure here at T-Mobile to protect their customer's identity [5:45] And this isn't just a fluke, it's happened to SO many people! [5:49] [creepy music in background] An even more terrifying case of a utility company giving up their client's information and endangering them [5:54] came from this New York Times article entitled "The Serial Swatter" [5:58] HayliNic is a small Twitch streamer with a really creepy obsessive fan [6:03] When he wanted to obtain her address, he called up cable company COX communications [6:07] He called up COX telling them that he worked there and without batting an eye [6:11] they gave him her home address [6:13] What happened soon after was a SWAT team showed up at her door with guns drawn. [6:17] She was lucky not to be hurt or killed. [6:20] This is one story of many that has happened [6:22] And it's going to keep happening, and that's what's so scary [6:25] and that's why I wanted to make this video [6:27] to let YouTubers and other people, the social presence, know that this is how the hackers will attack you. [6:33] They are gonna get your SIM card. From your Communications company [6:36] and they are gonna get your 2-step verification from your SIM card. [6:40] This is how it's happening. [6:41] So what can you do to protect it? Call your phone company right now. [6:44] Don't wait. Call them and tell them. [6:46] "Don't give my SIM to any one but me no matter what." [6:50] Tell them to put an extra security note on your account and don't ever give up your SIM. [6:54] But this is the scary thing [6:56] is that even though we've done all that, I still feel like I'm just as vulnerable as I was [7:00] because I'm relying on someone at T-Mobile to read the notes and tell the hacker [7:05] "Oh, sorry, I'm not gonna give you this person's SIM card to a total stranger." [7:09] We got lucky because we understood how the attack happened. [7:13] I mean it is a terrifying feeling knowing that someone malicious out there has your SIM card in their phone, [7:19] they have access to your contacts, your e-mails, [7:22] your text messages. I don't know, they had everything they needed to get into my Gmail account. [7:27] It's horrifying! [7:29] It's like a digital rape. [7:31] So we're considering to sue T-Mobile because the only language these companies understand [7:36] is money - Money talks, [7:38] and if they don't lose money, then they have no reason to change their policy at all. [7:42] So I wanna light a fire under their ass. [7:44] And we're really thinking about suing them because the policy is not gonna change any other way. [7:48] The funniest thing for me is that you think about these hackers as like some seriously elite, like skilled people [7:54] it seems like magic. You have no idea how they're doing it - but when you find out [7:58] it's like, it's just ugly, it's disappointing, there's no magic there. [8:02] It's literally just your fucking own phone company giving you up. [8:06] That's the hack! [8:07] Your own phone company giving you up! [8:09] [exciting, fast-paced action music plays] [8:12] [frantic typing can be heard] [8:26] [loud thunder sound] [8:29] [music stops] [T-Mobile jingle] [8:30] [Pre-recorded voice] "T-Mobile" [8:31] Hi, um, I work for T-Mobile [8:34] and I'm here with, uh, Felix, also known as PewDiePie, a popular YouTuber. [8:38] [Pre-recorded voice] "Sorry, I still didn't hear you" Uhh... [8:40] "To continue..." [8:41] I'm here with PewDiePie, uh, we were here trying to get a SIM card [8:44] he was having trouble with his phone [8:46] could you please send me the SIM card for PewDiePie, please? [8:49] [thunder rolls] [PewDiePie screams] Oh! Oh! Oh no! Oh! [8:53] [H3H3 theme song plays as outro music]