Defeating Multi-Factor Authentication with SIM Swapping

Abstract

Multi-Factor Authentication (MFA) is a practice websites or applications can use to add an extra layer of protection to authenticate a user. These factors are usually categorized as something you know, something you are, and something you have. MFA is rightfully becoming a common security practice on websites and mobile apps to reduce the risk of compromise. With MFA enabled, an attacker would not only need your password but also the other piece to the puzzle. One common method of providing MFA is Short Message Service (SMS), better known as text messaging. When SMS MFA is used, the user is sent a one-time password to their mobile device to use in authentication. SMS can be exploited by attackers using a method called SIM swapping. SIM swapping occurs when an attacker uses social engineering or a corrupt phone store employee to clone (swap) the requested phone number to a blank SIM card for the attacker. The attacker can now send and receive calls as well as messages using your phone number. This enables the attacker to perform password resets, verify accounts, and more. SIM swapping has been credited for many high value attacks over the past few years. One example is in early 2018, when over $20 million in cryptocurrency was stolen from Michael Terpin. This research examines SIM swapping and its use as a method to exploit MFA using SMS messaging.