Recently, a hacker known as PeteRepete leaked over 533 million Facebook users’ personal information online. There were no passwords in the database, but it did contain full names, phone numbers, email addresses, employer information, and a few other pieces of information from Facebook users’ profiles. GroupSense confirmed only a small portion of the records contained email addresses, but almost all of the records contained a phone number.
Many news outlets mentioned threat actors can use mobile numbers to perform something known as a SIM swap. SIM swapping, also known as SIM jacking or porting, is a technique used by cybercriminals to steal victims’ phone numbers.1 A successful SIM swap enables a threat actor to intercept phone calls and text messages and exploit the login and multi-factor authentication procedures of websites such as Venmo and PayPal.
SIM swapping is surprisingly not that difficult. Depending on your phone carrier, when you get a new phone you typically have to call a number and provide some identifying information to authenticate your identity before the carrier activates your SIM. A threat actor can do the same thing, with the only difference being they impersonate their victims and convince the cell phone carriers to activate a SIM within a phone they have in their possession. To do this, the threat actor needs to perform some reconnaissance to gather victim identity information; they will often use open source research, social engineering, or phishing attacks to gather the information.1
Once a threat actor has access to a victim’s phone number, they can target the victim’s accounts using weak multi-factor authentication. Since many services allow password resets with only access to a recovery phone number, a threat actor is able to gain access to almost any account tied to the victim’s phone number. As a result, threat actors could potentially directly transfer funds from a bank account or cryptocurrency wallet, extort the rightful owner, or sell accounts on the dark web.
Figure 1: An example of how a SIM swap attack could take place; Source: Privacy Pros
In early February 2021, the UK’s National Crime Agency (NCA) arrested eight people in connection to a series of SIM swapping attacks targeting US celebrities. The arrests took place in England and Scotland as part of an ongoing investigation which included the US Secret Service, Europol and other international agencies. The threat actors involved used social engineering on US cell phone providers to assign celebrities’ phone numbers on a SIM card the threat actors had in their possession.
Once they gained access to each victim’s phone number, they were able to access accounts and reset passwords while bypassing multi-factor authentication.
Europol said the gang stole more than $100 million worth of cryptocurrency using these methodologies.2
On 30 August 2019, threat actors known as The Chuckle Squad successfully hijacked the account of Twitter’s top executive Jack Dorsey through a SIM swap. The Chuckle Squad posted several offensive tweets from the executive’s Twitter, including racial slurs and anti-Semitic content.3 The offensive tweets were up for about 10 minutes before Twitter stepped in and removed them.
For threat actors there are low barriers to entry to carry out their attacks due to a handful of key factors:
Figure 3: A threat on a popular hacking forum offering SIM swapping services; Source: RaidForums
In the end, it is about awareness and training on both sides of the activation call to help authenticate the identity of callers. Princeton academics carried out a study testing five major cell phone providers to see if they could socially engineer call center employees into swapping a victim’s phone number onto a new SIM without providing the proper credentials. According to their report, “AT&T, T-Mobile, Tracfone, US Mobile, and Verizon Wireless were found to be using vulnerable procedures with their customer support centers, procedures that attackers could use to conduct SIM swapping attacks.”4
In order to intelligently measure the risk of a SIM swap attack, you have to determine the likelihood of exploitation as well as the potential impact. In the event that a threat actor targets you, what is the likelihood the attack would be successful? To start, you need to identify what security controls are in place to stop a threat actor in their tracks, such as a PIN or passphrase on your account with your cell phone provider.
A SIM swap attack could potentially be a high-impact attack because it can result in:
Having the proper security controls in place will lower the likelihood of exploitation thus reducing the overall risk. Here are some prevention tips:
These are basic security tips you can take to better protect your accounts. You can also reach out to the organizations you receive services from to learn other ways you can secure your accounts. It will benefit you in the long run to have the proper security measures in place.
References
1https://attack.mitre.org/techniques/T1451/
2https://www.zdnet.com/article/authorities-arrest-sim-swapping-gang-that-targeted-celebrities/