Hackers compromised the Telegram messenger and email accounts of multiple cryptocurrency executives last month by exploiting a vulnerability in a decades old protocol.
The fraudsters are believed to have been trying to intercept two-factor authentication codes of victims in an attack on Israel-based telecommunications provider Partner Communications Company, formerly known as Orange Israel.
The attacks are currently being investigated by Israel’s National Cyber Security Authority, and national intelligence agency Mossad.
According to cybersecurity publication Bleeping Computer, the devices of at least 20 Partner clients were compromised.
Israel-based cybersecurity firm Pandora Security’s analysis of the event suggests the devices were likely breached via a Signaling System 7 (SS7) attack. SS7 comprises a set of protocols that are used to facilitate the exchange of information within public switched telephone networks (PSTNs) interacting over digital signaling networks.
Hackers can exploit SS7 to intercept text messages and calls by using a roaming feature and “updating the location of their device as if it registered to a different network.”
Despite first being developed in 1975, the SS7 protocol is currently in widespread use globally.
Pandora co-founder Tsashi Ganot warned that national governments must update their telecommunications infrastructure to protect against modern security threats.
He said the hackers had also impersonated their victims on Telegram in unsuccessful attempts to lure close acquaintances into making crypto trades:
“In some cases, the hackers posed as the victims in their [Telegram] accounts and wrote to some of their acquaintances, asking to exchange BTC for ETC and the like […] as far as we’re aware no one fell for the bait.”
The SS7 attacks are reminiscent of SIM-swapping that reassigns the phone number associated with a victim’s SIM-card to a device under the hackers’ control.
U.S.-based telecom providers have faced multiple lawsuits from crypto executive clients that have been targeted by SIM-swap attacks.
