Bank robbers exploited SS7 weaknesses to drain 2SV-protected accounts

Attackers abused SS7 to redirect customers’ SMS text messages to phone numbers under their control.

Bank robbers exploited SS7 weaknesses to drain 2SV-protected accounts

A group of thieves exploited weaknesses in Signaling System 7 (SS7) to drain users' bank accounts, including those protected by two-step verification (2SV).

On 3 May, a representative with O2 Telefonica, a provider of mobile phones and broadband, told German newspaper Süddeutsche Zeitung that thieves managed to bypass security measures and make unauthorized withdrawals from customers' bank accounts:

"Criminals carried out an attack from a network of a foreign mobile network operator in the middle of January. The attack redirected incoming SMS messages for selected German customers to the attackers."

The thieves pulled off their heist by exploiting the weak underbelly of SS7. It's a protocol that specifies how public switched telephone networks (PSTN) exchange data over digital signaling network. In simpler terms, SS7 helps phone carriers around the world route your calls and text messages.

Useful! Unfortunately, it's also terribly insecure.

That's what researchers Tobias Engel and Karsten Nohl found back in 2014. Specifically, the duo discovered flaws in the protocol that allowed an attacker to intercept a victim's mobile phone calls as well as use a radio antenna to pick up all of a local user's phone calls and texts.

Cell tower

Along the researchers' observations, the January attackers first compromised users' computers with malware that stole their bank account numbers, login credentials, and mobile phone numbers. The Register reports that these criminals then waited until the middle of the night to spring into action.

For those accounts protected by SMS-based 2SV (not to be confused with 2FA), the attackers abused SS7 to redirect customers' SMS text messages to phone numbers under their control. This exploit allowed the thieves to steal users' mobile transaction authentication numbers (mTAN) and thereby withdraw money from their accounts.

In the aftermath of the attack, authorities blocked the unidentified foreign network exploited by the attackers. Bank officials also notified customers of the unauthorized withdrawals.

But that's not all. Some people are now calling on the FCC to fix the (finally!) fix the issues affecting SS7. One of them is U.S. Representative Ted Lieu, who made his position clear to Ars Technica:

"Everyone's accounts protected by text-based two-factor authentication, such as bank accounts, are potentially at risk until the FCC and telecom industry fix the devastating SS7 security flaw. Both the FCC and telecom industry have been aware that hackers can acquire our text messages and phone conversations just knowing our cell phone number. It is unacceptable the FCC and telecom industry have not acted sooner to protect our privacy and financial security. I urge the Republican-controlled Congress to hold immediate hearings on this issue."

Let's hope we finally get some movement on these security flaws. In the meantime, users might want to reconsider using SMS messages as a means of 2SV. They might want to go with an app like Google Authenticator or choose a solution like the U2F Security Key instead.

Tags: , , ,

Smashing Security podcast
Check out "Smashing Security", the new weekly audio podcast, with Graham Cluley, Carole Theriault, and special guests from the world of information security.

"Three people having fun in an industry often focused on bad news" • "It's brilliant!" • "The Top Gear of computer security"

Latest episode:

, , ,

2 Responses

  1. Neil

    May 5, 2017 at 7:22 am #

    This other article mentions 2FA in the headline but then 2SV throughout the rest of the article. You make a point of distinguishing between the two. What do you think was the purpose of this other article saying that it was an issue with 2FA when it was about 2SV? And as a separate matter, I'm wondering if you think 2FA still something you think's a good idea?

    https://arstechnica.com/security/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/

  2. Jim

    May 6, 2017 at 2:29 am #

    This is all rather puzzliing, the SS7 network is a tdm based network between telco, cellular switches and SS7 nodes (SSP, SCP, SRP or STP), not cell phones or WiFi or even IP Internet presence. The hackers would have to gain access to a registered telcom switch or SS7 node, in order to achieve this. From my telcom perspective, the weakness is not in the SS7 protocol, (which europe uses a different flavor of, known as CCS7) but rather some entities lack of security around their telco asset that allowed hackers to gain access to the SS7 signaling network, which is NOT connected to the Internet and is NOT IP based. Now there is an IP version know as SigTran, but this should only be deployed in an IPSec protected tunnel or an air-gaped private network, never directly over a public IP network in the clear. So if this is the attack vector, again I don't blame the SS7 network but rather the planners/builders of the Internet based IP tranport of the SigTran based version of the SS7 protocol. To directed attack the an signaling link whether IP based SigTran or TDM based SS7 would cause the link to drop on the intended terminating host. It would be interesting to read the objective details of the attack…

Leave a Reply