- Table of contents
The author
Itai Dahari is a cybersecurity professional residing in Tel Aviv. Itai's journey with various roles and positions has led him to launch a career in the cybersecurity realm. Alongside his role as a CTI Analyst on Anastasia Plotkin’s Americas Team at Cyberint, he finds joy in music and sports.
Table of contents
Related Articles
SIM Swapping Attacks Unmasked: Stay One Step Ahead
A threat that’s gained prominence in recent years is SIM swapping attacks. SIM swapping attacks involve a threat actor fraudulently gaining control over an individual’s mobile phone number. This ultimately allows the attacker to hijack their digital identity.
What is SIM Swapping?
SIM swapping, also known as SIM card hijacking or SIM jacking, is a technique employed by cybercriminals to gain unauthorized access to a victim’s mobile phone number. The process typically begins with the attacker gathering personal information about the victim through various means, such as social engineering, phishing, or data breaches. Once armed with this information, the attacker contacts the victim’s mobile service provider, posing as the victim or using a convincing pretext, to request a SIM card replacement or transfer.
The Mechanics of a SIM Swapping Attack
To execute a SIM swap attack, the attacker exploits the vulnerability in the mobile service provider’s authentication process. By convincing the provider that they are the legitimate account holder, the attacker can obtain a new SIM card that is associated with the victim’s phone number.
Once the SIM card is activated, the victim’s phone loses connectivity, and all incoming calls and messages are redirected to the attacker’s device; it’s popular for Threat Actors to use SMS receiver sites and virtual sims instead of purchasing a burner phone or one random anonymous sim.
Motivations Behind SIM Swapping Attacks:
SIM swapping attacks are primarily motivated by financial gain. Once the attacker gains control over the victim’s phone number, they can bypass two-factor authentication (2FA) measures commonly used for online banking, cryptocurrency wallets, email accounts, and social media platforms.
By gaining access to these accounts, the attacker can carry out unauthorized transactions, drain bank accounts, steal valuable digital assets, and perpetrate identity theft. The emotional toll of having one’s digital identity violated can lead to anxiety, stress, and a loss of trust in online platforms. The financial and psychological consequences can take months or even years to rectify fully.
Red Flags and Indicators of a SIM Swapping Attack:
Recognizing the warning signs of a SIM swap attack is crucial in mitigating its impact. Some common indicators include sudden loss of mobile network connectivity, unexplained inability to receive calls or messages, unexpected changes to account settings, and unauthorized transactions or account access. If any of these signs are observed, immediate action must be taken to secure your account and contact your mobile service provider.
Lapsus$ and SIM Swapping
CISA just released a report tracking how Lapsus$ are utilizing SIM swapping in recent campaigns. Bleeping Computer have reported that victims include Microsoft, Cisco, Okta, Nvidia, T-Mobile, Samsung, Uber, Vodafone, Ubisoft, and Globant.
CISA stated that“After executing the fraudulent SIM swaps, Lapsus$ took over online accounts via sign-in and account recovery workflows that sent one-time links or MFA passcodes via SMS or voice calls.
Lapsus$, sometimes attempted SIM swapping straight from the telecommunications provider’s customer management tools, following the ATO of employee and contractor accounts. They even used fraudulent EDRs. They also employed malicious insiders at targeted companies to achieve their goals.
The Kroll Example
In a recent security incident at Kroll, a threat actor executed a SIM swapping attack by contacting T-Mobile to transfer an employee’s phone number without their or Kroll’s knowledge. This attack granted access to three accounts containing sensitive personal information of bankruptcy claimants associated with cryptocurrency industry companies like BlockFi, FTX, and Genesis, as per Kroll’s statement on August 19th 2023. Kroll promptly notified affected individuals and secured the compromised accounts.
Recommendations to Protect Yourself From SIM Swapping
While it is challenging to safeguard against SIM swapping attacks completely, several proactive measures can significantly reduce the risk and increase your overall security posture:
- Secure your personal information: Be cautious about sharing sensitive data online and avoid oversharing on social media platforms. Regularly review your privacy settings to ensure they are appropriately configured.
- Implement strong and unique passwords: Use complex passwords that include a combination of letters, numbers, and symbols. Consider employing a password manager to generate and store unique passwords for each of your accounts.
- Utilize alternative forms of 2FA: Consider using authenticator apps or hardware keys instead of SMS-based 2FA for enhanced security. These methods are less susceptible to SIM-swapping attacks.
- Regularly monitor financial accounts: Keep a close eye on your bank statements, credit reports, and any suspicious activity. Set up alerts and notifications for unusual transactions or account changes. Report any discrepancies immediately to your financial institution.
- Maintain up-to-date software and security patches: Ensure your devices, apps, and operating systems are regularly updated to mitigate vulnerabilities. Outdated software may contain security flaws that attackers can exploit.
- Be cautious of suspicious communication requests: Exercise caution when receiving unsolicited calls, texts, or emails asking for personal information or login credentials. Avoid clicking on suspicious links or downloading attachments from unknown sources.
Mobile Service Provider and Regulatory Actions to Combat SIM Swapping Attacks
Recognizing the severity of SIM swapping attacks, mobile service providers are increasingly implementing enhanced security measures to combat this threat. These measures include:
- Stricter identity verification protocols
- Additional security layers for SIM card activations
- Improved customer education regarding SIM swapping risks
Additionally, regulatory bodies are working to establish stronger guidelines and regulations to better protect consumers from SIM swapping attacks.
Safeguarding Against SIM Swapping Attacks: A Multi-Layered Approach
Protecting against SIM swapping attacks necessitates a comprehensive and multi-layered strategy blending personal vigilance, technological safeguards, and collaboration among individuals, mobile service providers, and regulatory authorities. Remaining vigilant, staying informed, and implementing robust security practices empowers individuals to take an active role in mitigating the risks posed by SIM swapping attacks while upholding a secure online presence. Safeguarding your digital identity is an ongoing process that requires continuous attention and adaptation to counter emerging threats.
Cyberint’s Phishing Protection
Cyberint is constantly on the lookout for new malware threats, monitoring forums, marketplaces, and code repositories to detect and intercept them before they can be used by cybercriminals. We help our customers defend against these threats and take them down in time. We drastically reduce response time and number of attacks and detect malicious website clones before they go live. Companies can request take down of phishing pages in a click of a button.
