Thu, Sep 05, 2019 - Page 7 News List

Twitter CEO hack shines light on ‘SIM swap’ fraud


Even with considerable security precautions in place, Twitter CEO Jack Dorsey became the victim of an embarrassing compromise when attackers took control of his account on the platform by hijacking his telephone number.

Dorsey became the latest target of so-called “SIM swap” fraud, which enables a fraudster to trick a mobile carrier into transferring a number — potentially causing people to lose control not only of social media, but bank accounts and other sensitive information.

This type of attack targets a weakness in “two-factor authentication” via text message to validate access to an account, which has become a popular break-in method in the past few years.

Twitter on Friday last week said that the account was restored after a brief time in which the attackers posted a series of offensive tweets.

However, Ori Eisen, founder of Arizona-based security firm Trusona, which specializes in authentication without passwords, said that the rapid fix should not be seen as an answer to the broad problem of SIM card swap fraud.

“The problem is not over,” Eisen said, adding that these kinds of attacks have been used to take over other high-profile social media accounts and for various kinds of fraud schemes.

It was not clear how many people are attacked in this manner, Eisen said, but added that automated technology could create billions of calls that lure people into giving up information or passwords.

Some analysts have said that hackers have found ways to easily get enough information to get a telecom to transfer a number to a fraudster’s account, especially after hacks of large databases that result in personal data sold on the so-called “dark Web.”

“Mobile accounts’ text messages can be hijacked by sophisticated hardware techniques, but also by so-called ‘social engineering’ — convincing a mobile provider to migrate your account to another, unauthorized phone,” said R. David Edelman, a former White House adviser who heads a cybersecurity research center at the Massachusetts Institute of Technology. “It only takes a few minutes of confusion to make mischief like Dorsey experienced.”

Thousands of these attacks have been reported in countries where mobile payments are common, including in Brazil, Mozambique, India and Spain.

Researchers at security firm Kaspersky have said that security systems by many mobile operators “are weak and leave customers open to SIM swap attacks,” especially if the attackers are able to gather information such as birth dates.

In a blogpost, Kaspersky researchers Fabio Assolini and Andre Tenreiro said that some cases come from cybercriminals paying off corrupt employees of mobile carriers — for as little as US$10 to US$15 per victim.

“The interest in such attacks is so great among cybercriminals that some of them decided to sell it as a service to others,” they wrote.

In Brazil, some criminals have taken over victims’ WhatsApp accounts, using it to ask the person’s friends for “urgent payment,” they added.

This story has been viewed 2042 times.

Comments will be moderated. Keep comments relevant to the article. Remarks containing abusive and obscene language, personal attacks of any kind or promotion will be removed and the user banned. Final decision will be at the discretion of the Taipei Times.

TOP top