26 May 2017
visit http://events.sap.com/gb/fsi-forum-2017/en/home

Hackers exploit SS7 telco flaw to raid German bank accounts

05 May 2017  |  12271 views  |  0 mobile keypad

02 has confirmed that hackers exploited long-known weaknesses in a protocol that connects back-end telco networks to intercept and re-route two-factor verification codes sent by German banks to customer mobiles to authorise online funds transfers.

Weaknesses in the Signaling System 7 (SS7) protocol - which is used for data communications between different telco networks - have been known about since 2014.

Researchers demonstrated that anyone with internal access to a telco can easily log in to third party networks, enabling them to track phones and redirect messages.

O2 in Germany has now confirmed that some customers in Germany have had their accounts drained by hackers after initially falling victim to phishing scams which harvested user names, passwords, phone numbers and bank account details.

The attackers then used SS7 to intercept and redirect mTANs - mobile transaction authentication numbers sent by banks in Germany to authorise transfers out of accounts - to their own phones.

"Criminals carried out an attack from a network of a foreign mobile network operator in the middle of January," 02 told German newspaper Süddeutsche Zeitung. "The attack redirected incoming SMS messages for selected German customers to the attackers."

The news is likely to send a chill down other banks and organisations currently using SMS codes as a customer verification mechanism.

Comments: (0)

Comment on this story (membership required)

Finextra news in your inbox

For Finextra's free daily newsletter, breaking news flashes and weekly jobs board: sign up now

Related stories

Financial sector breaches skyrocket in 2016

Financial sector breaches skyrocket in 2016

28 April 2017  |  9359 views  |  0 comments | 20 tweets | 33 linkedin
How hackers took complete control of a legit Brazilian bank

How hackers took complete control of a legit Brazilian bank

05 April 2017  |  11246 views  |  1 comments | 19 tweets | 36 linkedin
Kaspersky records uptick in financial phishing and banking malware

Kaspersky records uptick in financial phishing and banking malware

24 February 2017  |  8079 views  |  0 comments | 6 tweets | 9 linkedin
Turkey's Akbank facing $4m liability after hack

Turkey's Akbank facing $4m liability after hack

16 December 2016  |  13260 views  |  0 comments
Journalists expose NatWest mobile security flaws

Journalists expose NatWest mobile security flaws

04 March 2016  |  14200 views  |  2 comments | 12 tweets | 10 linkedin

Related blogs

Create a blog about this story (membership required)
visit vasco.com/news/PSD2-compliant-solutionsvisit www.events.sap.comvisit www.niceactimize.com

Top topics

Most viewed Most shared
BBVA launches Open API marketplaceBBVA launches Open API marketplace
11848 views comments | 49 tweets | 77 linkedin
Bank/fintech collaboration can take transaction banking to new heightsBank/fintech collaboration can take transa...
7297 views comments | 12 tweets | 24 linkedin
TransferWise launches multi-currency business bank accountsTransferWise launches multi-currency busin...
6083 views comments | 12 tweets | 20 linkedin
Enterprise Ethereum Alliance triples in sizeEnterprise Ethereum Alliance triples in si...
6004 views comments | 15 tweets | 17 linkedin

Featured job

Six Figure Base + Commission + Stock Options
London

Find your next job