{"id":29780,"date":"2019-05-03T14:19:44","date_gmt":"2019-05-03T13:19:44","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/2019\/05\/03\/kaspershy-expert-on-the-enemy-in-your-pocket-large-scale-sim-swap-fraud\/"},"modified":"2019-05-08T15:32:34","modified_gmt":"2019-05-08T14:32:34","slug":"kaspershy-expert-on-the-enemy-in-your-pocket-large-scale-sim-swap-fraud","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/05\/03\/kaspershy-expert-on-the-enemy-in-your-pocket-large-scale-sim-swap-fraud\/","title":{"rendered":"Kaspersky expert on the enemy in your pocket: large-scale SIM swap fraud"},"content":{"rendered":"

With mobile phone payments now hugely popular, cybercriminals have been targeting the market in a wave of attacks. With SIM swap fraud nowadays conducted on a large scale, Fabio Assolini, Senior Security Researcher, Global Research and Analysis Team, Kaspersky Lab, tells Intelligent CIO how cybercriminals complete the fraud and the best ways to avoid being the next victim.<\/strong><\/em><\/p>\n

Mobile payment is huge worldwide. Mobile phone-based money transfers allow users to access financing and micro-financing services, to deposit, withdraw and pay for goods and services easily with a mobile device. In some cases, almost half the value of a country’s GDP goes through mobile phones.<\/p>\n

But nowadays these mobile payments are suffering a wave of attacks and people are losing their money \u2013 all powered by SIM swap fraud. Such attacks are nowadays conducted on a large scale.<\/p>\n

SIM swap fraud is a type of account takeover fraud that generally targets a weakness in two-factor authentication and two-step verification, where the second factor or step is a SMS or a call placed to a mobile telephone. The fraud centres around exploiting a mobile phone operator\u2019s ability to seamlessly port a telephone number to a new SIM.<\/p>\n

This feature is normally used when a customer has lost or had their phone stolen. Attacks like these are now widespread, with cybercriminals using them not only to steal credentials and capture OTPs (one-time passwords) sent via SMS but also to cause financial damage to victims.<\/p>\n

If someone steals your phone number, you\u2019ll face a lot of problems, especially because most of our modern two-factor authentication systems are based on SMSs that can be intercepted using this technique.<\/p>\n

Criminals can hijack your accounts one by one by having a password reset sent to your phone. They can trick automated systems – like your bank – into thinking they\u2019re you when they call customer service. And worse, they can use your hijacked number to break into your work email and documents. And these attacks are possible because our financial life revolves around mobile apps that we use to send money, pay bills, etc.<\/p>\n

\"\"
Fabio Assolini, Senior Security Researcher, Global Research and Analysis Team, Kaspersky Lab<\/strong><\/em><\/figcaption><\/figure>\n

 <\/p>\n

<\/a><\/a>How the cybercriminals do it<\/strong><\/p>\n

The scam begins with a fraudster gathering details about the victim by using phishing emails, by buying information from organised crime groups, via social engineering or by obtaining the information following data leaks.<\/p>\n

Once the fraudster has obtained the necessary details they will then contact the victim\u2019s mobile telephone provider. The fraudster uses social engineering techniques to convince the telephone company to port the victim\u2019s phone number to the fraudster\u2019s SIM, for example, by impersonating the victim and claiming they have lost their phone. They then ask for the number to be activated on a new SIM card.<\/p>\n

After that the victim\u2019s phone loses its connection to the network and the fraudster receives all the SMSs and voice calls intended for the victim. This allows the fraudster to intercept any one-time passwords sent via SMS or telephone calls made to the victim; all the services that rely on an SMS or telephone call authentication can then be used.<\/p>\n

We have found that some of the processes used by mobile operators are weak and leave customers open to SIM swap attacks. For example, in some markets in order to validate your identity the operator may ask for some basic information such as full name, date of birth, the amount of the last top-up voucher, the last five numbers called, etc.<\/p>\n

Fraudsters can find some of this information on social media or by using apps such as TrueCaller to get the caller name based on the number. With a bit of social engineering they also try to guess the voucher amount based on what\u2019s more popular in the local market. And what about the last five calls? One technique used by the fraudsters is to plant a few \u2018missed calls\u2019 or to send an SMS to the victim\u2019s number as bait so that they call back.<\/p>\n

Sometimes the target is the carrier and not the customer. This happens when a carrier\u2019s employees working in branches in small cities are sometimes unable to identify a fraudulent or adulterated document, especially branches located in kiosks or shopping malls, allowing a fraudster to activate a new SIM card.<\/p>\n

Another big problem is insiders, with some cybercriminals recruiting corrupt employees, paying them $10 to $15 per SIM card activated. The worst attacks occur when a fraudster sends a phishing email that aims to steal a carrier\u2019s system credentials.<\/p>\n

Ironically, most of these systems don\u2019t use two-factor authentication. Sometimes the goal of such emails is to install malware on the carrier\u2019s network \u2013 all a fraudster needs is just one credential, even from a small branch from a small city, to give them access to the carrier\u2019s system.<\/p>\n

The interest in such attacks is so great among cybercriminals that some of them decided to sell it as a service to others. Normally, a criminal can conduct an attack in two or three hours without much effort, because they already have access to the carrier\u2019s system or an insider.<\/p>\n

The fraudsters fire in all directions; sometimes their attacks are targeted, sometimes they\u2019re not. All a fraudster needs is your number, and it\u2019s very easy to find it by searching through leaked databases, buying that database from data brokers (some of them are legal), or using apps like\u00a0TrueCaller<\/a>\u00a0and other similar apps that offer caller ID and spam blocking, but which also have some\u00a0privacy issues<\/a>\u00a0and a name-based search for subscribers. Sometimes your number can be found by simply doing a Google search.<\/p>\n

The first sign that something is not quite right is when you lose your smartphone signal somewhere that normally has a strong signal.<\/p>\n

WhatsApp is the most popular instant messenger in a number of countries where the app is used by fraudsters to steal money in an attack known as \u2018WhatsApp cloning\u2019. After a SIM swap, the first thing the criminal does is to load WhatsApp and all the victim\u2019s chats and contacts.<\/p>\n

Then they begin messaging the contacts in the victim\u2019s name, citing an emergency and asking for money. In some cases, they feign a kidnapping situation, asking for an urgent payment \u2013 and some of the contacts will send money.<\/p>\n

The fraudsters performed a SIM swap, activating the victim\u2019s number on another SIM card. Then, on a smartphone with the pag! app installed, the fraudsters used the app\u2019s password recovery function and a code was sent via SMS, allowing the bad guys to gain total control of the user\u2019s account in the app.<\/p>\n

Once this access is obtained the fraudsters performed several illegal payments with the credit card issued in the app in the name of the victim. Some victims reported losses of US$3,300 in fraudulent transactions.<\/p>\n

<\/a><\/a>How not to be the next victim<\/strong><\/p>\n