The word Hacking is not new to our ears, each day we hear a lot about it. It is rampant and the recent events are even more disturbing. They bring a thought, is there anything secure from the anonymous snooping eyes?
Before now, I used to think that I am very smart as I have 2 factor authentication enabled for my Gmail and other linked accounts, but today I know it’s all a myth.
Recently a group of researchers from Positive Technologies showed how Signalling System 7 (SS7) can be used to empty your bitcoin wallet. SS7 is used to establish telephone calls and text messages, it is been on hackers list from long. On various occasions, security experts have been warning users about the text messages vulnerability, but they were not taken seriously.
What is Signaling System (SS) 7 network?
It’s a 50-year-old global set of telephony protocol developed in 1975, with known flaws yet internationally used by telecom networks to direct calls and messages. Thus, making it prone to attacks, there’s no need for a third-party service to outbreak the network, when the system itself has loopholes.
The systematic flaw in SS7 is been known for long, in 2014 it was made public. But then also nothing has been done to rectify it. Using the vulnerability, the one time password sent to your mobile as 2 step verification code can be accessed by the hackers.
How hackers can take advantage of flaws in Signalling System No. 7 (SS7)
Researchers from Positive Technologies targeted bitcoin wallet made at Coinbase linked with 2 Factor Authentication enabled Gmail account. They used the flaw to intercept all text messages sent to a number for a definite period and used it to reset Gmail password. To make it work what was needed was the name, surname and phone number of the targeted Bitcoin user. As this was just a demonstration it didn’t harm anybody. But don’t be happy it can be a potential way to attack your Bitcoin wallet it no action is taken.
Bitcoin wallet is a soft target, as there is no reversal of Bitcoin transactions. There is no end to these attacks, till the time confirmation codes will be sent over SMS. Not only Bitcoin wallet is at risk but all the services linked with your emails are also a victim.
To explain how it can be done, a video is created you can watch it by visiting the link:
When you watch the video at first it might look like there is a gap in Coinbase, but in reality, it is in the cellular system itself.
How to protect yourself from being a victim?
To stay protected from these types of attack one must take some concrete steps like disable two-factor authentication and account recovery entirely via SMS. Use a secure method then this one.
As alternate, you can try setting up Authenticator or recovery code for your Gmail rather than using 2 factor authentication to receive message on phone.
Use tools like Google Authenticator, Google prompt, or security key for extra security.
Wrap Up
The innate security weakness exposed by the researchers is an alarm. This is just an example therefore no harm is done, but it can soon be a serious threat for all bitcoin wallet holders. So, whenever you use any method to secure your account or online wallet do lookout for the flaws and stay safe.
If you prefer, you can use Google Authenticator as it is more secure compared to SMS.
Meta: Coinbase at risk, cybercriminals can empty your accounts linked with emails with just numbers. The SS7 vulnerability can be easily exploited by hackers.