If your cell phone does not defend itself, fear: a new phone
trick known as "SIM swapping" is being used for a cyber attacker to
duplicate our phone number and use this system to usurp our identity,
authenticate with our bank and steal all U.S. money .
There are already victims of a scam that was used for other
purposes: Jack Dorsey, the co-founder of Twitter, had his account stolen from a
service with the same system, also revealing the weakness of mechanisms such as
the SMS mechanism. messages for two-step authentication systems. Initially they
were a good option, but as we said before, it is much more advisable to use
independent applications for authentication, instead of SMS, which are
increasingly vulnerable in this area.
Be careful, this horrible story can happen to you
El País recently spoke about a case in which a user was
suddenly out of reach of him. I turned off the mobile, turned it on again and
nothing. Upon returning home, she called his operator from another mobile
phone, and it turned out that someone impersonated him to request a duplicate
of his SIM card at the operator's store in another city.
This alerted the user, who quickly went to check his bank
account and discovered that it was blocked. His organization discovered strange
movements, thousands of euros disappeared, and in his name requested a loan of
50,000 euros. A real disaster that according to Civil Guard officials responds
well to this upward trend in SIM swaps.
A new and disturbing case of this type arose again
yesterday: Twitter user Otto Mas (@Otto_Mas) shared very similar events. He
stopped having a line on his mobile phone with a Vodafone contract and when he
got home he connected his mobile phone to Wi-Fi and realized that “my checking
account was empty” at Banco Santander.
Someone duplicated his mobile line and made several
transfers with the help of a confirmation SMS, "drawing money little by
little." He was able to cancel transfers and lock the account after
several hours of talking to them on the phone, although he complained about the
poor response of his operator, criticizing various security measures that they
required for those requesting a duplicate SIM.
There are two obvious problems here: First, ordering a
duplicate SIM card is relatively easy. Second, the use of SMS as a system for a
two-factor or two-factor authentication (2FA) approach has long been vulnerable
to various attacks, and this is only the last, but probably the most
disturbing, of all. ...
Replacing the SIM allows anyone to impersonate someone else,
including the CEO of Twitter.
This method allows us to bypass the security measures that
make the cell phone a tool to verify our identity, and this is dangerous, as we
have seen both in the economic sphere and in many other scenarios.
This was demonstrated these days when Twitter co-founder and
CEO Jack Dorsey was subjected to a similar attack, which suddenly resulted in
offensive and racist messages on his (@jack) Twitter account, which were later
deleted.
