SIM card swap led to takeover of SEC’s X account

The hacker who took over the U.S. Security and Exchange Commission’s account on the X social media platform this month did it by fooling a cellphone carrier into giving it control over an employee’s cellphone in a SIM card swap.

Access to the account, the regulator, added, wasn’t protected by multifactor authentication at the time. It had been, the SEC said, “but was disabled at [the SEC] staff’s request.”

There was no explanation in the statement of why that happened.

“Once in control of the phone number, the unauthorized party reset the password for the @SECGov account,” the SEC said in a statement. “Among other things, law enforcement is currently investigating how the unauthorized party got the carrier to change the SIM for the account, and how the party knew which phone number was associated with the account.”

A smartphone needs a SIM card, which registers a wireless device to a carrier, to operate.  When a phone owner changes carriers or devices, the card is physically shifted from one device to another. However, customers can ask a carrier’s support staff — or, an enterprise’s support team — in person or over the phone to change the device a SIM card is registered to, because they have lost their device or forgotten its password.

Control over a victim’s smartphone is vital to hacking an account that uses the mobile device as part of multifactor authentication.

Threat actors rely on the gullibility of support staff for SIM swapping. The result is the threat actor can receive voice and SMS communications associated with the number.

Access to the SEC employee’s phone number occurred this way, the regulator emphasized in its statement, and not via SEC systems.

Once the attacker got control of the SEC X account, they made one post purporting to announce the Commission had approved spot bitcoin exchange-traded funds. That wasn’t true at the time, but a few days later the SEC announced certain financial platforms could carry bitcoin ETFs.

Among those investigating the incident are the SEC’s Office of Inspector General, the FBI. and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.

Threat actors have used SIM card swap attacks for years as a way to get around multifactor authentication, sometimes to break into an organization’s IT network — the work of the Lapsus$ gang is a prime example — and other times — as in this case — to take over social media accounts to promote cryptocurrency scams.

This month, an individual or individuals has been able to take temporary control of several prominent X accounts, including ones belonging to Mandiant, the city of Peterborough, Ont., and a Canadian Senator, to pump crypto junk. SIM card swaps may not always have been the tactic in every case. An attacker could take over a social media account not protected with MFA by guessing or brute-forcing a password. In the case of Mandiant, the company admitted MFA had been turned off during a staff transition.

In 2022, the FBI issued a warning on the risks of SIM card swaps. It urged carriers to:

  • educate employees and conduct training sessions on SIM swapping.
  • carefully inspect incoming email addresses containing official correspondence for slight changes that can make fraudulent addresses appear legitimate and resemble actual clients’ names.
  • set strict security protocols enabling employees to effectively verify customer credentials before changing their numbers to a new device.
  • authenticate calls from third-party authorized retailers requesting customer information.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer. Former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, Howard has written for several of ITWC's sister publications, including ITBusiness.ca. Before arriving at ITWC he served as a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

Featured Story

How the CTO can Maintain Cloud Momentum Across the Enterprise

Embracing cloud is easy for some individuals. But embedding widespread cloud adoption at the enterprise level is...

Related Tech News

Get ITBusiness Delivered

Our experienced team of journalists brings you engaging content targeted to IT professionals and line-of-business executives delivered directly to your inbox.

Featured Tech Jobs