An excellent article in Dark Reading has Nicole Sette, Director of Kroll’s Cyber Risk practice, walking through the security vulnerabilities of several different cryptocurrency accounts. Unlike the usual propaganda that every problem can be solved by making it hard to replace SIM cards, Sette identifies how crypto accounts significantly differ in the controls that surround user authentication and password resets, with the result that some are much less liable to be hacked by a SIM swapper than others. Furthermore, Sette discusses how insecure email services continue to be a gateway to obtain access to other user accounts.
It’s clear that the true vulnerability at the heart of SIM-swap attacks on crypto accounts lies in crypto exchanges’ and email providers’ variable implementation of 2FA. Until all crypto exchanges force the implementation of more secure application-based 2FA, these vulnerabilities will continue to allow for SIM-swapping attacks against crypto accounts.
Will politicians and consumer champions start moaning about poor security for email and cryptocurrency accounts? That seems unlikely, because telcos make a much more appealing target. But Sette shows conclusively that SIM swaps can only be used to take over cryptocurrency accounts when the hacker can also exploit other security weaknesses that lie outside of the control of telcos. It is a shame that few of the big mouths who claim to be raising awareness of SIM swap fraud are demanding those security gaps be closed too.
You will find Nicole Sette’s article for Dark Reading by looking here.
