AlphaAtlas
[H]ard|Gawd
- Joined
- Mar 3, 2018
- Messages
- 1,713
Back in 2017, we posted several articles on how SS7 cellular network vulnerabilities are being exploited around the world. Back then, they were using exploits to intercept 2 factor authentication requests and location data. Now, according to a recent Motherboard report, hackers are commonly using similar security holes to empty bank accounts. TechDirt notes that a U.S. Senator wrote to the FCC last year asking for them to do something about the issue, but they say not much has changed since then. Thanks to cageymaru for the tip.
The fundamental issue with the SS7 network is that it does not authenticate who sent a request. So if someone gains access to the network - a government agency, a surveillance company, or a criminal - SS7 will treat their commands to reroute text messages or calls just as legitimately as anyone else’s. There are protections that can be put in place, such as SS7 firewalls, and ways to detect certain attacks, but room for exploitation remains. n the case of stealing money from bank accounts, a hacker would typically first need a target’s online banking username and password. Perhaps they could obtain this by phishing the target. Then, once logged in, the bank may ask for confirmation of the transfer by sending the account owner a verification code in a text message. With SS7, the hackers can intercept this text and enter it themselves. Exploiting SS7 in this way is a way to circumvent the protections of two-factor authentication, where a system not only requires a password, but something else too, such as an extra code.
The fundamental issue with the SS7 network is that it does not authenticate who sent a request. So if someone gains access to the network - a government agency, a surveillance company, or a criminal - SS7 will treat their commands to reroute text messages or calls just as legitimately as anyone else’s. There are protections that can be put in place, such as SS7 firewalls, and ways to detect certain attacks, but room for exploitation remains. n the case of stealing money from bank accounts, a hacker would typically first need a target’s online banking username and password. Perhaps they could obtain this by phishing the target. Then, once logged in, the bank may ask for confirmation of the transfer by sending the account owner a verification code in a text message. With SS7, the hackers can intercept this text and enter it themselves. Exploiting SS7 in this way is a way to circumvent the protections of two-factor authentication, where a system not only requires a password, but something else too, such as an extra code.