Mobile

5/4/2017
12:40 PM
50%
50%

SS7 Flaws Exploited in Attacks Against Mobile Users' Bank Accounts

Cyberthieves exploited long-known vulnerabilities in the Signaling System 7 (SS7) protocol, attacking bank accounts in Germany by intercepting two-factor authentication codes sent to mobile phones.

Cyberthieves exploited long-known vulnerabilities in the Signaling System 7 (SS7) protocol, wiping out bank accounts in Germany after intercepting the two-factor authentication codes sent to mobile phones for online banking customers, according to a report in The Register.

The SS7 vulnerabilities, demonstrated by researchers back in 2014, could allow hackers to read or redirect text messages, listen to phone calls, and track the phone's location.

In this particular case, cybercriminals loaded malware onto victims' computers that allowed them to glean bank account logins and passwords, view account balances, and capture mobile phone numbers, according to the report. Access to an unscrupulous telecommunications provider was then purchased and the victims' mobile phone number was redirected to another phone that the cyberthieves controlled.

The attackers, according to the report, tended to access the victims' online bank accounts late at night. They intercepted the two-factor authentication codes and completed the money transfer transaction.

The Diameter protocol, the upcoming SS7 replacement for 5G networks, is apparently not any safer. It also has vulnerabilities, as well, notes the Federal Communications Commission's Legacy Systems Risk Reductions final report, produced by its Communications, Security, Reliability and Interoperability Council.

Read more about the SS7 exploit here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14981
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005.
CVE-2018-14982
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004.
CVE-2018-15482
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006.
CVE-2018-15473
PUBLISHED: 2018-08-17
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2018-15471
PUBLISHED: 2018-08-17
An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or c...