Real-World Ss7 Assault — Hackers Are Stealing Coin From Banking Concern Accounts

Security researchers accept been warning for years almost critical safety holes inwards the Signaling System vii (SS7) that could let hackers to nous inwards mortal telephone calls as well as read text messages on a potentially vast scale, despite the most advanced encryption used past times cellular networks.

Cellular networks, on the other hand, accept consistently been ignoring this serious issue, maxim that it is a rattling depression adventure for most people, every bit the exploitation of the SS7 flaws requires pregnant technical as well as fiscal investment.

But to a greater extent than or less unknown hackers accept but proved them incorrect past times of late exploiting the pattern flaws inwards the SS7 to drain victims' banking company accounts, according to a report published Midweek past times German-based paper Süddeutsche Zeitung.

SS7 is a telephony signaling protocol created inwards the 1980s past times telcos as well as powered to a greater extent than than 800 telecom operators across the world, including AT&T as well as Verizon, to interconnect as well as telephone substitution data, similar routing calls as well as texts alongside i another, enabling roaming, as well as other services.

Real-World SS7 Attack Scenarios

The global telecom network SS7 is vulnerable to several pattern flaws that could let hackers to nous to telephone calls as well as intercept text messages on a potentially massive scale, despite the most advanced encryption used past times cellular network operators.

The designing flaws inwards SS7 accept been inwards circulation since 2014 when a squad of researchers at High German Security Research Labs alerted the the world to it.

So, the privacy concerns regarding the SS7 protocol is non new.

Here's the real-world evidence that cyber-criminals are using long-known SS7 vulnerability to drain Bank accounts.

CLICK TO TWEET

Last year, Karsten Nohl of High German Security Research Labs demonstrated the SS7 develop on on the United States of America Congressman Ted Lieu's telephone number (with his permission) at TV plan lx Minutes as well as successfully intercepted his iPhone, recorded call, as well as tracked his precise place inwards real-time but past times using his jail cellular telephone phone number as well as access to an SS7 network.

In a split demonstration, the researchers from Positive Technologies in conclusion yr too gave a demonstration on the WhatsApp, Telegram, as well as Facebook hacks using the same designing flaws inwards SS7 to bypass two-factor authentication used past times the services.

Thieves Using SS7 Flaw to Steal Money From Bank Accounts

Now, Germany's O2 Telefonica has confirmed that the same SS7 weaknesses accept of late been exploited past times cybercriminals to bypass two-factor authentication (2FA) banks used to preclude unauthorized withdrawals from users banking company accounts.

"Criminals carried out an develop on from a network of a unusual mobile network operator inwards the middle of January," an O2 Telefonica instance told Süddeutsche Zeitung. "The develop on redirected incoming SMS messages for selected High German customers to the attackers."

In short, cyber criminals exploited SS7 flaws to intercept two-factor authentication codes (one-time passcode, or OTP) sent to online banking customers as well as drained their banking company accounts.

Here's How:

The attackers origin spammed out traditional bank-fraud trojans to infect trouble concern human relationship holders' computers as well as pocket passwords used to log into banking company accounts, stance accounts balance, along alongside their mobile number.

But what prevented the attackers from making coin transfers is the one-time password the banking company sent via a text message to its online banking customers inwards social club to authorize the transfer of funds betwixt accounts.

To overcome this issue, the cyber crooks therefore purchased the access to a simulated telecom provider as well as set-up a redirect for the victim's telephone number to a handset controlled past times them. Specifically, they used SS7 to redirect the SMSes containing OTPs sent past times the bank.

Next, the attackers logged into victims' online banking company accounts as well as transferred coin out, because every bit shortly every bit the ascendancy codes were sent past times the bank, instead of designated trouble concern human relationship holders, they were routed to numbers controlled past times the attackers, who finalized the transaction.

Can You Avoid this Hack?

This latest SS7 develop on i time over again shed lite on the insecurity past times pattern as well as lack of privacy inwards the global telephone network protocol, making it clear that real-world SS7 attacks are possible. And since the SS7 network is used worldwide, the number puts billions of users inwards danger.

The incident too underscores the risks of relying on SMS-based two-factor authentication.

Although the network operators are unable to spell the hole anytime soon, in that place is piffling the smartphone users tin do. Avoid using two-factor authentication via SMS texts for receiving OTP codes. Instead, rely on cryptographically-based safety keys every bit a instant authentication factor.

Share This :