As SIM swapping has become more prevalent, those holding bitcoin are increasingly susceptible to attack. So how should you protect yourself?

robots

The Rise of Bitcoin SIM Swapping - Bitcoin Magazine

https://bitcoinmagazine.com/articles/the-rise-of-sim-swapping-how-and-why-bitcoiners-need-to-protect-themselves/how_to_avoid_getting_sim_swapped

https://admin.bitcoinmagazine.com/wp-content/uploads/2019/11/Bitcoin-Magazine.png

twitter:card

twitter:description

twitter:title

https://admin.bitcoinmagazine.com/wp-content/uploads/2020/02/How_to_Avoid_Getting_SIM_Swapped.jpeg

twitter:image

Privacy &amp; security

Scams

michael terpin

Sim swapping

Wireless

yubico

bitcoin

control of a victim's wireless

hardware wallet

password manager

phone number

security

security with your phone carrier

sim swap

sim swap attacks

Bitcoin Magazine provides news, analysis, information, commentary and price data about Bitcoin.

Bitcoin Magazine

David Hollerith works in editorial for BTC Inc. He covers topics in healthcare, technology, travel and culture. He holds bitcoin and ether.

David Hollerith

The Rise of Bitcoin SIM Swapping

Using a phone number for identity authentication is a bad operational security practice. Handing over bitcoin to a third party like a cryptocurrency exchange or lending service also reduces security &mdash; &ldquo;not your keys, not your coins&rdquo; is a security recommendation often shared over Twitter and the Bitcoin podosphere.&nbsp; Case in point: For the better part of the last decade, the combination of these two practices has given rise to an increasing number of SIM swap attacks ending in the theft of bitcoin and other cryptocurrencies.&nbsp; A SIM swap is a low-cost, nontechnical way for attackers to gain control of a victim&rsquo;s wireless phone account. To pull off an attack, a hacker needs to know how mobile wireless carriers authenticate identity and some portion of information about their victim. Often, this only requires a victim&rsquo;s phone number. Now, there is unequivocal evidence that the majority of people in the United States who have phone number accounts with wireless carriers are vulnerable to SIM swaps. If you hold bitcoin that you don&rsquo;t want to lose, this fact can be all the more harrowing. The Rise of SIM Swapping. This increased potential for SIM swapping was proven in an empirical study published in January 2020 by a joint group of professors and Ph.D. students at Harvard University&rsquo;s Department of Computer Science and Princeton University&rsquo;s Center for Information Technology Policy.&nbsp; &ldquo;The attacker calls your carrier, pretends to be you, and asks to transfer service to a new SIM &mdash; one that the attacker controls,&rdquo; wrote Arvind Narayanan, an associate professor at Princeton and one of the paper&rsquo;s authors, in a summation via Twitter. &ldquo;That&rsquo;s bad enough but hundreds of websites use SMS for 2-factor authentication, putting your accounts at risk.&rdquo; The study tested the authentication protocol of five major U.S. wireless carriers &mdash; AT&amp;T, T-Mobile, Tracfone, US Mobile and Verizon. After attempting a SIM swap on 10 different prepaid accounts for each carrier, the authors found that all five carriers used authentication methods which were deemed insecure.&nbsp; &ldquo;Taken together, these findings help explain why SIM swaps have been such a persistent problem,&rdquo; stated Narayanan.&nbsp; Even more troubling, SIM swaps are such a problem that Narayanan admitted that his phone&rsquo;s SIM card was swapped during the research. When he called to report the fraud, his carrier&rsquo;s customer service department was not able to verify him even after verifying his attacker. Narayanan ended up regaining control of his wireless account by applying his research to take advantage of his carrier&rsquo;s protocol vulnerability. It was fortunate that Narayanan did this quickly. Once an attacker takes control of a victim&rsquo;s wireless account, they have copious options for wreaking havoc. As stated in the study, this is due in large part to the insecure authentication methods users set for accessing digital assets online such as SMS- or call-based 2FA (these are insecure once an attacker has access to your wireless account) and security questions involving easily retrievable public information such as a mother&rsquo;s maiden name. In addition, the study also found 17 websites on which user accounts can be compromised based on a SIM swap alone (the basis for this method came from the twofactorauth.org dataset). Shortly after the study&rsquo;s release, T-Mobile informed the authors that after reviewing it, it had discontinued the use of &ldquo;recent numbers&rdquo; for customer authentication. Targeting Bitcoin Through SIM Swaps. SIM swaps have been happening for years. Many SIM swap targets fall into one if not both of the following categories: a celebrity with a prized social media account such as CEO of Twitter, Jack Dorsey, or someone who owns a reasonable amount of cryptocurrency. Several cryptocurrency owners were SIM swapped last year during the height of bitcoin&rsquo;s bull run. In December 2019, cryptocurrency journalist and podcaster Laura Shin released a podcast episode about her own experience as a recent SIM swap victim. Shin was not robbed, but her experience is noteworthy in that she revealed that, despite previously covering the topic in 2016 and actively securing her accounts years before, she was still vulnerable.&nbsp; Ultimately, what makes bitcoin owners more appealing SIM swap targets than other wireless carrier customers is the fact that bitcoin transactions are recorded on the blockchain so they cannot be reversed. Unlike wireless accounts, stolen bitcoin is much more difficult for authorities to seize (though it may be traceable through blockchain analysis). Furthermore, unlike most online banking accounts, only a handful of cryptocurrency exchanges such as Coinbase, Gemini, ItBit and Binance.US are secured by FDIC insurance, which insures deposits in member banks up to $250,000. When considering bitcoin&rsquo;s value as a decentralized and immutable asset, this makes perfect sense. But it also means security should never be taken for granted. Wheels of Justice. High-networth cryptocurrency owners like Michael Terpin, an entrepreneur and investor who co-founded the first angel fund for Bitcoin enthusiasts, the Bitangels fund, are all too aware of this tenet. &ldquo;The wheels of justice grind slowly,&rdquo; said Terpin in an interview with Bitcoin Magazine.&nbsp; Justice in Terpin&rsquo;s case is entangled in an ongoing $224 million lawsuit against AT&amp;T he filed in August 2018. Twice, an organized group of hackers swapped SIM cards connected to Terpin&rsquo;s T-Mobile and AT&amp;T accounts. According to him, the first time, a group of attackers &ldquo;tricked people in two stores in Boston within an hour of each other to give up my credentials for both accounts.&rdquo; Following these swaps, the hackers nabbed a little more than half of a bitcoin in an exchange account Terpin opened &ldquo;when bitcoin was around $100.&rdquo;&nbsp; After this first SIM swap, Terpin asked both of his carriers for more security. It turned out that AT&amp;T and T-Mobile each offered &ldquo;higher-profile protection options.&rdquo; But both T-Mobile&rsquo;s in-store verification &ldquo;no port&rdquo; option and AT&amp;T&rsquo;s addition of a six-digit account pin code proved useless when, as Terpin alleged, in January 2018, a 19-year-old employee at a New Jersey AT&amp;T retail store gave up Terpin&rsquo;s account password in exchange for a $100 bribe.&nbsp; In return, the group of attackers made off with $24 million in altcoins.&nbsp; &ldquo;That&rsquo;s right,&rdquo; said Terpin, &ldquo;the only thing they could get were &lsquo;shitcoins,&rsquo; but they happened to be very high value that day.&rdquo;&nbsp; Unlike bitcoin, Terpin&rsquo;s stolen altcoins (TRIG, SKY and STEEM) had no hardware wallet private key backup options available. Even though Terpin&rsquo;s last SIM swap happened more than two years ago, he said that he&rsquo;s contacted each week by a new SIM swap victim seeking help. If they&rsquo;re in state, he points them to his legal team and California&rsquo;s REACT Task Force.&nbsp; Lil&rsquo; Swappers. Terpin is also involved in a civil lawsuit against Nicholas Truglia, a 21-year-old New York City resident accused of stealing $24 million through SIM swaps. Truglia was initially accused of stealing $1 million in cryptocurrency from a Silicon Valley executive and creator of StopSIMCrime.org, Ross White.&nbsp; Terpin alleged that evidence at Truglia&rsquo;s other SIM fraud bail hearing &mdash; an iCloud backup file &mdash; indicated that Truglia might also be the SIM swapper behind his $24 million attack. On the same day of Terpin&rsquo;s attack, Truglia sent messages to family and friends indicating that he had stolen more than $20 million dollars worth of cryptocurrency from a wallet, had converted it to bitcoin and that his life had changed forever. Though investigations have remained quiet, Terpin alleged that Truglia was one member of a decentralized SIM swapping group of 26. Piecing together Truglia&rsquo;s case with several other arrests, charges and sentences for cryptocurrency-stealing SIM swappers, the investigative journalist Brian Krebs has laid out detailed depictions of these characters. According to Krebs, they are all male and below the age of 25.&nbsp; In January 2020, a report emerged accusing 18-year-old Canadian resident Samy Bensaci of unsuccessfully SIM swapping Don Tapscott, head of the Blockchain Research Group. This story linked many SIM swap targets in the cryptocurrency community to their attendance of the annual Consensus conference held in New York City. It also corroborated the Krebs report, connecting SIM swap cryptocurrency theft to users of an online forum known as OGUsers.com.&nbsp; &ldquo;I think everyone&rsquo;s always caught off guard by the younger generation&rsquo;s adoption of new technology,&rdquo; said Matt Odell, a Bitcoin and privacy expert contributing to multiple projects such as co-hosting the &ldquo;Tales From the Crypt&rdquo; podcast.&nbsp; As with mass adoption itself, it appears that Bitcoin and related SIM swap theft is a phenomenon initiated by a younger generation to exploit victims of a more primitive system. Choosing Security Over Convenience. &ldquo;Laws being created around this technology are always way behind,&rdquo; said Tyler Moffitt, a security analyst with Webroot, referring to the uniquely hazardous scenario bitcoin owners find themselves in thanks to their wireless carriers. &ldquo;I can&rsquo;t see [tighter carrier consumer protection laws] happening within the next five years, and by that time hackers will have made a pretty penny from SIM swap-based cryptocurrency theft.&rdquo;&nbsp; Moffitt is among the many who believe that when it comes to weighing convenience and security, people will always lean toward convenience. This is exactly how wireless carrier accounts and American society, at large, have been designed. But louder voices are beginning to speak out. On January 9, 2020, a letter signed by six U.S. lawmakers was sent to Ajit Pai, the Federal Communications Commission (FCC) chairman who previously served as general counsel to Verizon. Advocating for increased protection against SIM swap fraud for wireless customers, the letter pointed to a statement from investigators with the REACT Task Force on total SIM swap damage: &ldquo;They know of more than 3,000 SIM...

description

max-snippet:-1, max-image-preview:large, max-video-preview:-1

https://bitcoinmagazine.com/articles/the-rise-of-sim-swapping-how-and-why-bitcoiners-need-to-protect-themselves

Tags

yubico

The Rise of SIM Swapping: How and Why Bitcoiners Need to Protect Themselves