Prevent Over-the-Air attacks on your subscribers. It benefits your bottom-line.
Since the advent of telecoms, hackers have had an abundance of techniques to penetrate, phish, capture and fraud subscribers globally. Mobile Network Operators are – shall we say – always fighting off new, and constant attacks.
As of late, SIM attacks have made a resurface. As such, this attack is nothing more than a traditional OTA attack through a malicious message. The only difference rests on the actual target of the attack: SIM attack targets the SIM, whereas device-specific OTA would target the device.
Perpetrators, whether operating in large, organised groups or on their own, in a room somewhere, can set-up the equipment (read GSM modem) rather quickly and inexpensively, and acquire the necessary information through sending out an OMA CP binary SMS to affect changes to the subscriber’s SIM or device. This is particularly effective as the user has no manner to identify whether the ‘change request’ originated from the actual network or is the work of a nefarious actor further afield.
Kevin Panzavecchia, CTO at HAUD This scenario leaves potentially millions of subscribers exposed, and vulnerable to a plethora of exploits including: location-retrieval, unsolicited call initiation and sensitive subscriber data retrieval.
How can Operators mitigate this vulnerability?
SIM vulnerability can be a significantly distributed problem, and therefore, most operators are vulnerable to these attacks. Device-specific OTA attacks are also highly distributed and increasingly insidious. Should an operator fall victim to these kinds of exploits and hacks on their subscribers, there would be a significant impact on the business. Impacted operators would invariably suffer reputational dilution, business losses – through subscriber churn and potential fines if such attacks come to the surface.
These attacks, and others on the SS7 and Diameter protocols, require MNOs to reprioritise their procurement efforts to include a security solution and focus more on network security to ensure that at no point on their network, and under no guise, can a hacker penetrate, spoof, phish, fraud and ultimately pose subscribers’ data at risk.
The right partner matters
Karsten Nohl, a security researcher with SRLabs, stated on ZDNet, “In the context of mobile network hacks, (SIM attacks) would appear less attractive to criminals than SS7 attacks or social engineering such as SIM swapping’. In addition, he stated,” While SS7 hacks and SIM swaps are reported in large numbers, (SIM attacks)…seem to appear only anecdotally in comparison.”
Mobile Operators cannot go at this alone; having the right partner in place, with the right SMS and Signalling Firewall solutions to prevent SS7 and Diameter attacks, alongside SIM box activity and ultimately OTA exploits, constitutes the right starting point to protect your subscribers and your brand.
Get in touch with a member of the HAUD team today: