The Growing Dangers of SIM-Swapping: Lessons from Kroll’s Crypto Breach

The Danger of SIM-Swapping Attacks: A Wake-Up Call for Organizations

The Kroll Supply Chain Breach

A recent supply chain breach at Kroll, the risk and financial advisory firm, has once again highlighted the ongoing danger organizations face from SIM-swapping attacks. In this incident, personal information on hundreds of claimants in bankruptcy proceedings related to crypto trading firms FTX, BlockFI, and Genesis was exposed. The breach occurred when an adversary transferred an employee’s phone number to an attacker-controlled device and used it to access sensitive information. SIM swapping, or SIM hijacking, is a type of account takeover attack in which an attacker gains unauthorized access to a target’s mobile phone functions by tricking the mobile carrier into transferring the victim’s phone number to a SIM card that the attacker controls.

The Scale and Techniques of SIM-Swapping Attacks

SIM-swapping attacks can take various forms and can be carried out by different threat groups. Some sophisticated threat groups, like China-based “Scattered Spider,” have pulled off SIM-swapping attacks at scale by infiltrating systems belonging to mobile carriers and porting numbers on their own. In the case of the Kroll breach, the attacker convinced T-Mobile to port a Kroll employee’s phone number to their own device. This gave them access to files containing bankruptcy details as Kroll was responsible for managing the filing and retention of proofs of claim in the proceedings for the three crypto firms.

The Impact of the Breach

The breach exposed personal information such as names, addresses, emails, and balances in FTX and Genesis accounts. Genesis has warned victims to be vigilant against phishing attempts aimed at gaining control of their cryptocurrency accounts, wallets, and other digital assets. SIM-swapping attacks primarily aim to gain control of a victim’s incoming text messages, particularly two-factor authentication codes sent via SMS, which are then used to access the victim’s bank and other accounts.

The Need to Move Away from SMS-Based Authentication

The prevalence of SIM-swapping attacks underscores the need to move away from SMS-based two-factor authentication. Research shows that 42% of businesses still rely on SMS for multifactor authentication. SIM swapping attacks can easily defeat SMS-based authentication, leading to account takeovers, data breaches, and cyberattacks. Businesses and individuals must consider alternatives such as biometrics and physical authentication keys, which provide a higher level of security.

Mitigating SIM-Swapping Risks

SIM-swapping attacks often start with social engineering, such as phishing emails and researching victims using social media and other sources. Attackers then impersonate the victim and convince the mobile carrier to transfer the phone number to a new device. Once the porting is complete, the attacker intercepts authentication codes and gains access to sensitive information or financial accounts.

To mitigate SIM-swapping risks, businesses can encourage employees to avoid posting personal data on social media platforms and online forums. This reduces the information available to attackers attempting to impersonate targets. Additionally, businesses should educate their employees about the dangers posed by SIM swapping and recommend adding a port freeze to their mobile accounts. Individuals can also take precautions by refraining from sharing sensitive information online and implementing steps to secure their mobile accounts.

Editorial: Strengthening Security Practices

SIM-swapping attacks are a serious threat to individuals and organizations, and the Kroll breach serves as a stark reminder. This incident highlights the need for organizations to prioritize cybersecurity and adopt more secure authentication methods. Relying solely on SMS-based authentication is no longer sufficient against increasingly sophisticated attacks.

It is essential for organizations to invest in more robust security measures such as biometrics and physical authentication keys. Biometrics, such as fingerprint or facial recognition, offer a higher level of security as they cannot be easily compromised or transferred. Physical authentication keys, such as USB tokens or smart cards, provide an added layer of protection by requiring a physical device to authenticate.

In addition, organizations should enhance employee training and awareness programs to educate staff about the risks of SIM swapping and the importance of securing personal information. Employees should be encouraged to report suspicious activities to the IT department and implement best practices for securing their mobile accounts, such as adding a port freeze.

Advice: Protecting Yourself from SIM-Swapping Attacks

Individuals can take steps to protect themselves from SIM-swapping attacks and safeguard their personal information:

1. Minimize sharing personal data online: Avoid posting personal information on social media platforms, as attackers often use this information to impersonate victims and convince mobile carriers to transfer their phone numbers to new devices.

2. Enable additional security features: Where available, enable additional security features offered by mobile carriers, such as PINs or passwords for SIM card changes.

3. Be cautious of suspicious emails and calls: Be wary of phishing emails and calls that attempt to gather personal information. Never give out sensitive information to unverified sources.

4. Implement stronger authentication methods: Consider using biometrics or physical authentication keys as an alternative to SMS-based authentication. These methods provide a higher level of security and are more resistant to SIM-swapping attacks.

5. Enable port freeze: Contact your mobile carrier and request a port freeze, which adds an extra layer of protection and prevents your phone number from being transferred without your consent.

By following these recommendations and staying vigilant, individuals can significantly reduce the risk of falling victim to SIM-swapping attacks and protect their personal information from unauthorized access. Organizations must also prioritize cybersecurity and implement robust security measures to defend against these evolving threats.