Click to copy
The smartphones they have reached the point of being an extension of our bodies. We need them to wake up, to check the temperature, to do chores, and even to keep up with the news of the day. In addition, it has become a work tool for many, facilitating contact and information exchange even away from the desk. However, as Check Point Research, Check Point Software Technologies' information security research division reports, hackers and cybercriminals take advantage of excessive use of smartphones to perform dedicated mobile device attacks.
This is the case with SIM Swap or SIM Swapping, which is a technique used to duplicate a Subscriber Identity Module (SIM) card. With a duplicate card, an attacker can retrieve passwords and gain access credentials for many of a victim's personal systems, such as social networks, email, bank account, instant messaging applications, and more.
Chech Point Research explains that the SIM Swap technique clones all information contained on a SIM card. However, to be successful, it is necessary to have in hand, data such as full name, mobile number, identification document, among other personal data of the victim. Because you need basic personal information, famous personalities may be more vulnerable to this type of attack, as their data can easily be found on the Internet.
How it works
After getting the necessary data, an attacker contacts the SIM operator and impersonates the victim in order to get the operator to transfer the victim's SIM information to a new SIM. In this case, the attacker must use social engineering and create a compelling story for the employee to send a new SIM to the "customer." With a new SIM chip loaded with victim information, the attacker can perform several attacks.
Check Point indicates the main risks associated with SIM Swap.
Data Theft: Theft of sensitive user information is another major threat associated with SIM Swap. In addition to all contacts that are stored on the card, the cybercriminal can also use the SIM to access WhatsApp and other social networks. Just load the remember password option and expect to receive an SMS with the data, and then use it to log into different platforms and access user images and conversations. The security option, 2-factor authentication (2FA) is also vulnerable with a cloned SIM.
Identity theft: As a result of having access to all information of a user, the cybercriminal can impersonate the real owner of the SIM card and, for example, even make payments on behalf of the victim. Similarly, you could try to hold conversations with the victim's contacts to gain access to more information.
Submit malware: By having control of the SIM card and being able to override the user's identity, it is possible to use social networks or other platforms to connect with the user's calendar and simply and without suspicion spread malware through messaging. This way you could share malicious links by trying to gain control over other user accounts and at the same time access private information.
Increase in invoice value: Increasing the amount of invoices that are sent by your service provider is also one of the possible risks related to SIM Swap. This is because cybercriminals, having control over the card, can make international calls or even subscribe to premium paid services. Therefore, seeing that consumption has soared suddenly, it is important to take all possible measures to prevent financial fraud.
Access to bank details: In addition to the increase in invoice value, another high risk, in economic terms, refers to banking operations. In fact, more and more people are using banking applications in smartphones to conduct transactions or other operations and a cybercriminal can access the victim's bank details. Although many financial institutions authenticate, a cybercriminal can circumvent this security measure as he has control of the SIM card.
The company explains that the SIM is the gateway to everything stored on the smartphone and is associated with a mobile number, so an attack on the SIM can be very critical to data security and privacy.