Thieves Exploited SS7 to Intercept Two-Factor Authentication and Steal From Bank Accounts

Forum Moderators: phranque

Message Too Old, No Replies

Thieves Exploited SS7 to Intercept Two-Factor Authentication and Steal From Bank Accounts

tangor

8:15 pm on May 3, 2017 (gmt 0)

Experts have been warning for years about security blunders in the Signaling System 7 protocol – the magic glue used by cellphone networks to communicate with each other.

These shortcomings can be potentially abused to, for example, redirect people's calls and text messages to miscreants' devices. Now we've seen the first case of crooks exploiting the design flaws to line their pockets with victims' cash.

[theregister.co.uk...]

This in Germany, but can happen anywhere. Here's hoping the security/code boffins get motivated PDQ!*

*those those unfamiliar: "Pretty Darn Quick!"

TorontoBoy

1:23 am on May 4, 2017 (gmt 0)

byline: O2 in Germany confirms online thefts from sour krauts

That is funny! Not so funny is that there are so many insecure apps on smartphones that defeat security, this is not surprising.

keyplyr

7:49 am on May 5, 2017 (gmt 0)

Not SS7 but related...

For some strange reason, (many) mobile phone users don't consider the necessity for anti-malware/spyware/virus protection. There's too much trust.

I've used Lookout for several years. So far it's detectec & removed 2 infected apps... and I never install 3rd party apps or those from outside the app store. Lookout can also locate a lost or stolen phone and lock-up the SIM remotely if needed.

engine

8:06 am on May 5, 2017 (gmt 0)

I believe that's one of the important keys to mobile security is to not add apps from the wild. Not only could users be downloading a malicious app, but the app could have been unknowingly hijacked by hackers.
As part of my desktop security I get a basic security app from a vendor, and it gives me confidence of some protection from malicious apps and, of course, from e-mail payloads.

I suspect there's much more mobile problems to come from miscreants and it's only just touched the surface.

tangor

4:15 am on May 6, 2017 (gmt 0)

The average user, sadly, has never been taught security caution, and no matter how many warnings are given, won't believe it until it happens to them. Unfortunately that full understanding comes at an extreme cost (cleaned out bank account).

That said, the critters running these networks, the app creators, and all the ballyhoo associated with that are ALSO to blame for either inertia, negligence, whimsy, or sheer stupidity.

Ingredients for a perfect storm.

I solved my cell phone problems about 12 years ago. I quit using them. :)