Slashdot Mirror
Criminals Are Tapping Into the Phone Network Backbone to Empty Bank Accounts (vice.com)
Sophisticated hackers have long exploited flaws in SS7, a protocol used by telecom companies to coordinate how they route texts and calls around the world. Those who exploit SS7 can potentially track phones across the other side of the planet, and intercept text messages and phone calls without hacking the phone itself. From a report: This activity was typically only within reach of intelligence agencies or surveillance contractors, but now Motherboard has confirmed that this capability is much more widely available in the hands of financially-driven cybercriminal groups, who are using it to empty bank accounts. So-called SS7 attacks against banks are, although still relatively rare, much more prevalent than previously reported. Motherboard has identified a specific bank -- the UK's Metro Bank -- that fell victim to such an attack. The news highlights the gaping holes in the world's telecommunications infrastructure that the telco industry has known about for years despite ongoing attacks from criminals. The National Cyber Security Centre (NCSC), the defensive arm of the UK's signals intelligence agency GCHQ, confirmed that SS7 is being used to intercept codes used for banking.
"We are aware of a known telecommunications vulnerability being exploited to target bank accounts by intercepting SMS text messages used as 2-Factor Authentication (2FA)," The NCSC told Motherboard in a statement. "Some of our clients in the banking industry or other financial services; they see more and more SS7- based [requests],â Karsten Nohl, a researcher from Security Research Labs who has worked on SS7 for years, told Motherboard in a phone call. "All of a sudden you have someone's text messages."
"We are aware of a known telecommunications vulnerability being exploited to target bank accounts by intercepting SMS text messages used as 2-Factor Authentication (2FA)," The NCSC told Motherboard in a statement. "Some of our clients in the banking industry or other financial services; they see more and more SS7- based [requests],â Karsten Nohl, a researcher from Security Research Labs who has worked on SS7 for years, told Motherboard in a phone call. "All of a sudden you have someone's text messages."
They're not personally being held responsible for the losses and they're not going to lose business to the other phone company for providing crappy service.
Are you the same idiot who posted on the previous article that "apple was right to wait on 5g" without knowing what the fuck you're talking about in either case?
You're eating Kendall's lunch again. The product is the same bullshit. Keep it inside kiddo. iMessage is in no way "safe" you fuckwit nor is it even possibly related to this article's topic. You're a moron. STFU.
The fucking president of the United States shouldn't be using a fucking iPhone.
So, was this supposed to be a backdoor accessible only to "the good guys"? And now the bad guys are using it?
I'm shocked! Shocked, I tell you!
.
SMS should not be used for 2FA. Full stop.
Heh, except you're forced to say that about anything that isn't Faux News or retarded Breitbart lies, propaganda faggot traitor. Your head is so far up your ass you're eating yesterday's lunch backwards.
* * *
1. "In July 2010 the government said small businesses -- 60 percent -- will lose their health care, 45 percent of big business and a large percentage of individual health." Sean Hannity, Nov. 11, 2013 False
* * *
2. "And President Obama has offered to pay out of his own pocket for the museum of Muslim culture out of his own pocket, yet it's the Republican National Committee who's paying for this." Anna Kooiman, Oct. 5, 2013 https://bit.ly/2W1wHzv
* * *
3. Labor union president Andy Stern is "the most frequent visitor" at the White House. Glenn Beck, Dec. 3, 2009 False
* * *
4. "Far more children died last year drowning in their bathtubs than were killed accidentally by guns." Tucker Carlson, Aug. 9, 2014 Pants on Fire
* * *
5. White House Political Director Patrick Gaspard once served as the "right-hand man" for Bertha Lewis, who heads up ACORN. Steve Doocy, Sept. 29, 2009 False
* * *
6. "Look at the debt that has been accumulated in the last two years. It's more debt under this president than all those other presidents combined."
Sarah Palin, May 31, 2011 False
* * *
7. "There is no good data showing secondhand smoke kills people." John Stossel, Dec. 4, 2014 False
* * *
8. "Democrats are poised now to cause this largest tax increase in U.S. history." Sarah Palin, Aug. 1, 2010 Pants on Fire
* * *
9. "The insurance industry is actually run by mostly Democrats." Dana Perino, Oct. 31, 2013 False
* * *
10. The Obama administration "manipulated deportation data to make it appear that the Border Patrol was deporting more illegal immigrants than the Bush administration." Lou Dobbs, July 1, 2014 False
* * *
11. Some doctors say Ebola can be transmitted through the air by "a sneeze or some cough." George Will, Oct. 19, 2014 False
* * *
12. Says the Texas State Board of Education is considering eliminating references to Christmas and the Constitution in textbooks. Gretchen Carlson, March 10, 2010 Pants on Fire
* * *
13. Because of President Barack Obama’s failure to "push job creation," the black unemployment rate in Ferguson, Mo., is three times higher than the white unemployment rate. Lou Dobbs, Aug. 19, 2014 False
* * *
14. When White House communications director Anita Dunn said that Mao Tse-tung was "one of her favorite philosophers, only Fox News picked that up."
Bill O’Reilly, Oct. 23, 2009 False
* * *
15. "The president of the United States will be taking a trip over to India that is expected to cost the taxpayers $200 million a day." Michele Bachmann, Nov. 3, 2010 False (Note: Bachmann’s claim was made on CNN, not Fox News but Glenn Beck made a similar claim on Fox)
* * *
16. "We researched to find out if anybody on Fox News had ever said you're going to jail if you don't buy health insurance. Nobody's ever said it." Bill O’Reilly, Oct. 27, 2010 Pants on Fire
* * *
17. "If you make more than $250,000 a year you only really take home about $125,000." Steve Doocy, July 11, 2012 False
* * *
18. A Census Bureau worker says he was told to skew information to bring the unemployment rate down "as we headed into an election season." Elisabeth Hasselbeck, Nov. 19, 2013 False
* * *
19. "Health care mandate will require imprisonment and fines for Americans who can’t afford to purchase insurance or pay hefty government penalties." Patients First, Sept. 21, 2009 Mostly False (Note: Fox hosts have said closely similar statements because of our research into Bill O’Reilly’s Pants on Fire claim -- No. 16 -- that no one on Fox News ever said it.)
* * *
20. "And finally tonight, although it pains me to say this, Jon Stewart? Comedy Central? He was right. Now on his program last night, he mentioned that we had played some incorrect video on this program last we
...for the stories today: https://ask.slashdot.org/story...
"Don't meddle in the affairs of a patent dragon, for thou art tasty and good with ketchup." ~ohcrapitssteve
That is the only logical conclusion.
The bastards who set up the online systems have only partially thought out security.
I find the NY Times credible, yes.
For example, I often watch alot of primary source material (watch the actual press briefing live) and when I read the account in the times, it matches what I observed - this leads me to believe that they are engaging in real journalism.
Comment removed based on user account deletion
For a bank to implement any system costs $100s millions. Let alone the annoyance to their customers.
If they lose $1million to fraud then that is just a cost of doing business. And most money lost to fraud is eventually recovered.
What we need is phones with more features. Like every time they visit a web site they execute code on that website that can potentially take over the phone. Wait...
nt
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
Why does my twitter account have better security than my BANK?! Bank of America only supports SMS authentication, and that is only to a long list of every phone number associated with my account. I cannot restrict it to just one phone number such as a Google Voice phone set up just for security. I asked a rep about Two-Factor-Authentication and she said "I never heard of that, what is it?"
It is mind boggling. My money has less protection that my throw away forum accounts.
Also, shout out to Vanguard, who has a "I FORGOT MY AUTHENTICATION DEVICE" link on the login page that allows me to skip using Google Authenticator if it's 'inconvenient'.
- For the complete works of Shakespeare: cat
No. This went like SMTP. "Only other telephone companies who are allowed to tweak settings and know what they are doing can connect to the signaling network anyway, so we don't need any security here" (Signaling protocols are around since the firts phone call wasn't routed by an operator on a switchboard but routed digitally)
But then at one point every country was switching to digital call routing and now every small Lampukistanian telco is allowed to send routing commands that have world wide effects.
But even that wasn't THAT bad....
The shit really hit the fan when said Lampukistatian phone operator connected their internal (office) network to the Internet.
bickerdyke