Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

1/2/2020
10:30 AM
Nicole Sette
Nicole Sette
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Mechanics of a Crypto Heist: How SIM Swappers Can Steal Cryptocurrency

The true vulnerability at the heart of SIM-swap attacks on crypto accounts lies in crypto exchanges' and email providers' variable implementation of 2FA.

Recently, I shared with you how alarmingly simple it was to not only "hack" my own email account but then to use that compromised account to hack my other online accounts. Given how SIM-swap attacks on cryptocurrency exchanges escalated in 2019, I wanted to better understand these modern-day bank heists as we go into the new year. My hunch was that SIM swappers were using hijacked phone numbers like a set of keys to open locked doors into a world of online crypto accounts. Would I (or a hacker) have the same success hacking my crypto exchange accounts using just my phone number?

The first step in hacking my cryptocurrency accounts was gaining access to my personal email account with just a phone number. As I did in my first "hacking" experiment, I chose the "forgot password" option on my Yahoo account and was able to reset the password using only my publicly available username (my email address) and an SMS code sent to my mobile phone.

The fact that I only needed to type in the SMS code sent to my mobile phone indicates that single-factor authentication was in place here, not two-factor authentication (2FA). 2FA is the practice of authenticating to an account using (1) something you know, (2) something you have, or (3) something you are (biometrics). In the case of the SMS code, I simply had to type in "something I had" without a second factor proving my identity. This means a hacker who SIM-swapped my phone number would be able to reset my email account within a matter of minutes, even though I added my number to these accounts for added security. (You can read more about how SIM swapping works in my earlier experiment.)

After resetting my email password with an SMS code sent to my phone number (which could have been swapped to a hacker), the next step involved using that email access to identify and reset passwords on my cryptocurrency accounts. For a cybercriminal, the end goal is transferring bitcoin or other crypto assets to the attacker's crypto wallet.

I navigated to my first cryptocurrency account (let's call it Account #1), entered my publicly available email address as my username, and chose the "forgot password" option. Account #1 sent an email message to my now "hacked" Yahoo account. I was able to click the password reset link, enter an SMS code from my (SIM-swapped) mobile phone, and change the password on Account #1.

I tried the same technique with my second crypto exchange account (Account #2). This account did offer the option for application-based 2FA (such as Google Authenticator), but I had disabled that in favor of traditional password authentication. Given these settings, when I clicked "forgot password," I received a simple password reset link to my (hacked) Yahoo account that allowed me to set a new password and gain full access to Account #2.

At this point, I had gained access to an email account and two cryptocurrency accounts in about 10 minutes or less. These steps demonstrate how an attacker receiving text messages to a compromised mobile number could take over email accounts and easily gain access to crypto funds. Had I been an attacker, I could have quickly transferred crypto assets from my exchange accounts to a series of other crypto wallets and laundering sites that would funnel the money through various untraceable paths. This would leave the victim with little recourse to recoup the stolen assets.

Some cryptocurrency platforms have built-in mechanisms to prevent a SIM swapper from facilitating such a quick compromise of accounts. For example, one exchange where I opened an account (Account #3) allows single-factor authentication but implements a 24-hour lockout period before the password reset will take place. This effectively times out SIM swappers who have a short window in which to empty accounts before the stolen number is retrieved by its rightful owner.

This table highlights the variability in SMS authentication security options offered by crypto exchanges:

Crypto Exchange

Authentication

Password Reset

Account #1

App-based 2FA/optional

Email link + SMS code

Account #2

App-based 2FA/optional

Email link

Account #3

Single-factor (creds)/IP check

24-hour wait period

As I learned firsthand, several exchanges still allow for password resets via a link sent to an email account, which could easily be hacked by a SIM swapper in control of a phone number. Most exchanges offer stronger application-based 2FA for resetting passwords, but many still allow users to default to weaker single-factor authentication. For example, my Account #2 defaulted to application-based 2FA during registration, but users can log in before enabling this setting.

Similarly, while Account #1 offers more secure forms of 2FA such as application-based options, it also allows users to opt for SMS-based authentication settings that created the vulnerability in this experiment. Traditional bank accounts generally require more in-depth authentication to reset a password, such as Social Security number or security questions. Until cryptocurrency accounts implement similar password reset requirements, SIM swappers will continue to target these exchange accounts using the techniques outlined above.

It's clear that the true vulnerability at the heart of SIM-swap attacks on crypto accounts lies in crypto exchanges' and email providers' variable implementation of 2FA. Until all crypto exchanges force the implementation of more secure application-based 2FA, these vulnerabilities will continue to allow for SIM-swapping attacks against crypto accounts.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "5 Pieces of GDPR Advice for Teams Without Privacy Compliance Staff."

Nicole Sette is a Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps. Nicole is a Certified Information Systems Security Professional (CISSP) with 15 years of experience conducting cyber intelligence investigations and technical analysis. Nicole served ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15001
PUBLISHED: 2020-07-09
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when u...
CVE-2020-15092
PUBLISHED: 2020-07-09
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most T...
CVE-2020-15093
PUBLISHED: 2020-07-09
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A ...
CVE-2020-15299
PUBLISHED: 2020-07-09
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is execu...
CVE-2020-4173
PUBLISHED: 2020-07-09
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure l...