SS7 Flaw Used by Hackers to Drain Bank Accounts Protected by Two Factor Authentication

Share on Facebook Tweet Snapchat Share Reddit Comment
SS7 Flaw Used by Hackers to Drain Bank Accounts Protected by Two Factor Authentication
  • SS7 flaw has been prevalent since many years now
  • Telecom operators have been complacent about it
  • Few users have lost all their money due to SS7 flaw exploit

German network provider O2 Telefonica has confirmed that few of its subscribers have been drained of their bank accounts, due to hackers exploiting a flaw in the Signaling System 7 (SS7) protocol, used by networks to communicate with each other for many years.

The German company O2 Telefonica has confirmed to Sddeutsche Zeitung that hackers have used an SS7 exploit to drain the bank accounts of few of its subscribers. The hackers intercepted two-factor authentication codes needed for online banking, and after gaining access, emptied their entire bank accounts. This has been occurring for a few months now, the report states.

For security reasons, German banks use a two-factor authentication system, and online customers need to punch a code that is sent to their phone to process transferring the funds from one account to the other. The attackers have exploited this 2FA system, the report ads, allowing them to empty the bank accounts of affected customers easily.

To do this, the hackers first got inside the users' PCs and got hold of sensitive information like login details, password, account balance, and mobile number. "Then they purchased access to a rogue telecommunications provider and set up a redirect for the victim's mobile phone number to a handset controlled by the attackers," The Register explains.

The attackers then logged into victims' bank accounts, preferably at a time when they are asleep, and then transfer out all the money. The code sent to the phone was routed to the criminals, making it easy for them to enter.

The report adds that the SS7 flaw has been an issue since many years, and while researchers have been making noise, and asking telcos to do something, network operators have been very complacent about it. Now, that one of the telcos has confirmed a hack due to the SS7 exploit, a solution may come to fruition. Also, the alternative method proposed to replace SS7, is equally flawed, and the dubbed Diameter protocol cannot be considered as a viable solution for now.


For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.

Tasneem Akolawala Tasneem Akolawala is a Senior Reporter for Gadgets 360. Her reporting expertise encompasses smartphones, wearables, apps, social media, and the overall tech industry. She reports out of Mumbai, and also writes about the ups and downs in the Indian telecom sector. Tasneem can be reached on Twitter at @MuteRiot, and leads, tips, and releases can be sent to More
Hubble Space Telescope Captures Galaxy Cluster 6 Billion Light Years Away

Related Stories




© Copyright Red Pixels Ventures Limited 2020. All rights reserved.
Listen to the latest songs, only on