19 January 2018
visit www.ebaday.com

Hackers exploit SS7 telco flaw to raid German bank accounts

05 May 2017  |  15121 views  |  1 mobile keypad

02 has confirmed that hackers exploited long-known weaknesses in a protocol that connects back-end telco networks to intercept and re-route two-factor verification codes sent by German banks to customer mobiles to authorise online funds transfers.

Weaknesses in the Signaling System 7 (SS7) protocol - which is used for data communications between different telco networks - have been known about since 2014.

Researchers demonstrated that anyone with internal access to a telco can easily log in to third party networks, enabling them to track phones and redirect messages.

O2 in Germany has now confirmed that some customers in Germany have had their accounts drained by hackers after initially falling victim to phishing scams which harvested user names, passwords, phone numbers and bank account details.

The attackers then used SS7 to intercept and redirect mTANs - mobile transaction authentication numbers sent by banks in Germany to authorise transfers out of accounts - to their own phones.

"Criminals carried out an attack from a network of a foreign mobile network operator in the middle of January," 02 told German newspaper Süddeutsche Zeitung. "The attack redirected incoming SMS messages for selected German customers to the attackers."

The news is likely to send a chill down other banks and organisations currently using SMS codes as a customer verification mechanism.

Comments: (1)

A Finextra member
A Finextra member | 31 May, 2017, 19:11

SEVERAL BIG AND IMPORTANT BANKS in BRAZIL use extensive SMS messages as 2nd authetication factor.

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
Comment on this story (membership required)

Finextra news in your inbox

For Finextra's free daily newsletter, breaking news flashes and weekly jobs board: sign up now

Related stories

Financial sector breaches skyrocket in 2016

Financial sector breaches skyrocket in 2016

28 April 2017  |  11126 views  |  0 comments | 20 tweets | 33 linkedin
How hackers took complete control of a legit Brazilian bank

How hackers took complete control of a legit Brazilian bank

05 April 2017  |  13055 views  |  1 comments | 20 tweets | 36 linkedin
Kaspersky records uptick in financial phishing and banking malware

Kaspersky records uptick in financial phishing and banking malware

24 February 2017  |  9226 views  |  0 comments | 6 tweets | 9 linkedin
Turkey's Akbank facing $4m liability after hack

Turkey's Akbank facing $4m liability after hack

16 December 2016  |  14247 views  |  0 comments
Journalists expose NatWest mobile security flaws

Journalists expose NatWest mobile security flaws

04 March 2016  |  15015 views  |  2 comments | 12 tweets | 10 linkedin

Related blogs

Create a blog about this story (membership required)
visit www.thomsonreuters.infovisit www.capgemini.comvisit www.vasco.com

Top topics

Most viewed Most shared
Europe begins Open Banking era in subdued styleEurope begins Open Banking era in subdued...
11072 views comments | 32 tweets | 37 linkedin
Crypto mining threatened by power capacity concernsCrypto mining threatened by power capacity...
10257 views comments | 17 tweets | 18 linkedin
Wells Fargo to close 900 branchesWells Fargo to close 900 branches
9867 views comments | 14 tweets | 16 linkedin
KFC introduces Bitcoin BucketKFC introduces Bitcoin Bucket
9349 views comments | 18 tweets | 16 linkedin
FinTech Scotland appoints new CEOFinTech Scotland appoints new CEO
8377 views comments | 8 tweets | 6 linkedin

Featured job

Competitive
Germany, Austria or Switzerland

Find your next job