Cyber Expert Analyzes How to Steal Cryptocurrency with SIM Swaps

An excellent article in Dark Reading has Nicole Sette, Director of Kroll’s Cyber Risk practice, walking through the security vulnerabilities of several different cryptocurrency accounts. Unlike the usual propaganda that every problem can be solved by making it hard to replace SIM cards, Sette identifies how crypto accounts significantly differ in the controls that surround user authentication and password resets, with the result that some are much less liable to be hacked by a SIM swapper than others. Furthermore, Sette discusses how insecure email services continue to be a gateway to obtain access to other user accounts.

It’s clear that the true vulnerability at the heart of SIM-swap attacks on crypto accounts lies in crypto exchanges’ and email providers’ variable implementation of 2FA. Until all crypto exchanges force the implementation of more secure application-based 2FA, these vulnerabilities will continue to allow for SIM-swapping attacks against crypto accounts.

Will politicians and consumer champions start moaning about poor security for email and cryptocurrency accounts? That seems unlikely, because telcos make a much more appealing target. But Sette shows conclusively that SIM swaps can only be used to take over cryptocurrency accounts when the hacker can also exploit other security weaknesses that lie outside of the control of telcos. It is a shame that few of the big mouths who claim to be raising awareness of SIM swap fraud are demanding those security gaps be closed too.

You will find Nicole Sette’s article for Dark Reading by looking here.

Eric Priezkalns
Eric Priezkalns
Eric is the Editor of Commsrisk. Look here for more about the history of Commsrisk and the role played by Eric.

Eric is also the Chief Executive of the Risk & Assurance Group (RAG), a global association of professionals working in risk management and business assurance for communications providers.

Previously Eric was Director of Risk Management for Qatar Telecom and he has worked with Cable & Wireless, T‑Mobile, Sky, Worldcom and other telcos. He was lead author of Revenue Assurance: Expert Opinions for Communications Providers, published by CRC Press. He is a qualified chartered accountant, with degrees in information systems, and in mathematics and philosophy.