Posted on October 28, 2017 at 5:29 PM
T-Mobile Issues Warning to Users Over Potential Threat
The communications company confirmed that they warned a few hundred users about hackers hijacking SIM cards. T-Mobile has confirmed that hundreds of their users had been targeted by hackers recently where hackers tried to hijack the users’ SIM cards.
According to the company, they took steps to alert targeted users during the course of the last two weeks. This followed after reports discovered a bug on T-Mobile’s website which enabled the attackers to gain access to several sensitive data about their users, including email address, account number, and even the user’s phone IMSI.
Before T-Mobile addressed the security issue by patching the vulnerability, hackers exploited it by using the users’ information in order to impersonate them. However, a spokesperson from T-Mobile has confirmed that no social security numbers, financial information, or passwords, were accessed in this time.
The initial goal of the hackers was ostensible to hijack victims’ SIM cards. By doing so, hackers would be able to use their phone number, which would, in turn, allow them access to all of the victims’ online accounts that are linked to the number, such as social media accounts, email accounts, as well banking accounts. The process was proved possible by a blackhat hacker, who demonstrated the possibility of the attack.
While an attack of this nature is rare, it can be very dangerous. It can especially dangerous as it will also allow hackers to steal two-factor authentication codes that are generally sent out via SMS. If a hacker has access to your phone number, they can easily steal this code and hack into your account.
The spokesperson from T-Mobile confirmed that all affected users were notified.
In a statement issued later, the spokesperson confirmed that a few hundred users in total were targeted. The statement emphasized the company’s prioritization of their users’ privacy and highlighted the steps they took to ensure that the compromising thereof was minimized. Since T-Mobile became aware of the threat, they notified all users and offered to work with them to ensure that their information remains secure in the future.
The spokesperson failed to specify how many users were affected.
The bug was first noticed and reported earlier this month, by the security researcher, Karan Saini. However, according to reports, hackers have known about this security flaw and how to exploit it, since at least August this year. On August 6, a video was made available on YouTube which gives detailed instructions on how to exploit the bug.
According to T-Mobile, there was no reason to suspect that the vulnerability was shared broadly. In addition, during mid-October, another T-Mobile spokesperson stated that the company did not find any evidence that user accounts were impacted because of the security flaw.
However, these claims were since proven false. Since the bug was discovered, T-Mobile has come under fire for their lack of security protocols to detect threats of this nature.
According to affected users, the representative who contacted them to notify about the security breach suggested changing their T-Mobile online account password and to implement a “SIM lock” feature. According to T-Mobile, this lock makes it significantly more difficult for hackers to hijack a user’s phone number.
T-Mobile has confirmed that they came into contact with all impacted users. However, if you are suspicious that your SIM card could have been affected, or simply want to prevent future security breaches, T-Mobile recommended creating a password or passphrase which would be requested when you contact the T-Mobile support team. This security measure, in addition to the SIM lock, will diminish your chances of being affected by a data breach.
