The hacker who took over the U.S. Security and Exchange Commission’s account on the X social media platform this month did it by fooling a cellphone carrier into giving it control over an employee’s cellphone in a SIM card swap.
Access to the account, the regulator, added, wasn’t protected by multifactor authentication at the time. It had been, the SEC said, “but was disabled at [the SEC] staff’s request.”
There was no explanation in the statement of why that happened.
“Once in control of the phone number, the unauthorized party reset the password for the @SECGov account,” the SEC said in a statement. “Among other things, law enforcement is currently investigating how the unauthorized party got the carrier to change the SIM for the account, and how the party knew which phone number was associated with the account.”
A smartphone needs a SIM card, which registers a wireless device to a carrier, to operate. When a phone owner changes carriers or devices, the card is physically shifted from one device to another. However, customers can ask a carrier’s support staff — or, an enterprise’s support team — in person or over the phone to change the device a SIM card is registered to, because they have lost their device or forgotten its password.
Control over a victim’s smartphone is vital to hacking an account that uses the mobile device as part of multifactor authentication.
Threat actors rely on the gullibility of support staff for SIM swapping. The result is the threat actor can receive voice and SMS communications associated with the number.
Access to the SEC employee’s phone number occurred this way, the regulator emphasized in its statement, and not via SEC systems.
Once the attacker got control of the SEC X account, they made one post purporting to announce the Commission had approved spot bitcoin exchange-traded funds. That wasn’t true at the time, but a few days later the SEC announced certain financial platforms could carry bitcoin ETFs.
Among those investigating the incident are the SEC’s Office of Inspector General, the FBI. and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.
Threat actors have used SIM card swap attacks for years as a way to get around multifactor authentication, sometimes to break into an organization’s IT network — the work of the Lapsus$ gang is a prime example — and other times — as in this case — to take over social media accounts to promote cryptocurrency scams.
This month, an individual or individuals has been able to take temporary control of several prominent X accounts, including ones belonging to Mandiant, the city of Peterborough, Ont., and a Canadian Senator, to pump crypto junk. SIM card swaps may not always have been the tactic in every case. An attacker could take over a social media account not protected with MFA by guessing or brute-forcing a password. In the case of Mandiant, the company admitted MFA had been turned off during a staff transition.
In 2022, the FBI issued a warning on the risks of SIM card swaps. It urged carriers to:
- educate employees and conduct training sessions on SIM swapping.
- carefully inspect incoming email addresses containing official correspondence for slight changes that can make fraudulent addresses appear legitimate and resemble actual clients’ names.
- set strict security protocols enabling employees to effectively verify customer credentials before changing their numbers to a new device.
- authenticate calls from third-party authorized retailers requesting customer information.
