From there, the attacker can reset the password of any account which uses that phone number for password reset links.īut the attacks Lucky225 has been demonstrating merely require customers of any number of firms to sign a sworn “letter of authorization” or LOA stating that they indeed do have the authority to act on behalf of the owner of the targeted number.Īllison Nixon is chief research officer at Unit221B, a New York City-based cyber investigations firm. In a SIM swap, the attackers redirect the target’s phone number to a device they control, and then can intercept the target’s incoming SMS messages and phone calls. The most common way thieves hijack SMS messages these days involves “sim swapping,” a crime that entails bribing or tricking employees at wireless phone companies into modifying customer account information. There are many of these ‘SMS enablement’ providers.” “It’s not a Sakari thing,” Lucky225 replied when first approached for more details. He said Sakari is just one part of a much larger, unregulated industry that can be used to hijack SMS messages for many phone numbers. Lucky225, who is chief information officer for Okey Systems, told KrebsOnSecurity that Sakari has since taken steps to block its service for being used with mobile telephone numbers.
Sakari’s LOA says that the user should not conduct any unlawful, harassing, or inappropriate behavior with the text messaging service and phone number.īut as Lucky225 showed, a user can just sign up with someone else’s number and receive their text messages instead. While adding a number, Sakari provides the Letter of Authorization for the user to sign. Lucky225 provided Motherboard with screenshots of Sakari’s interface, which show a red “+” symbol where users can add a number. The cheapest plan, which allows customers to add a phone number they want to send and receive texts as, is where the $16 goes.
UNIVERSAL PUK CODE FOR SIM CARD HACK TRIAL
Sakari offers a free trial to anyone wishing to see what the company’s dashboard looks like. It cost just $16, and there was precious little to prevent someone from stealing your text messages without your knowledge. The “how they did it” was sickeningly simple. Lucky225 showed how anyone could do the same after creating an account at a service called Sakari, a company that helps celebrities and businesses do SMS marketing and mass messaging.
Security researcher “ Lucky225” worked with ’s Joseph Cox to intercept Cox’s incoming text messages with his permission. Now we’re learning about an entire ecosystem of companies that anyone could use to silently intercept text messages intended for other mobile users. SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else.
0 kommentar(er)
