SIM card swap led to takeover of SEC’s X account

Share post:

The hacker who took over the U.S. Security and Exchange Commission’s account on the X social media platform this month did it by fooling a cellphone carrier into giving it control over an employee’s cellphone in a SIM card swap.

Access to the account, the regulator, added, wasn’t protected by multifactor authentication at the time. It had been, the SEC said, “but was disabled at [the SEC] staff’s request.”

There was no explanation in the statement of why that happened.

“Once in control of the phone number, the unauthorized party reset the password for the @SECGov account,” the SEC said in a statement. “Among other things, law enforcement is currently investigating how the unauthorized party got the carrier to change the SIM for the account, and how the party knew which phone number was associated with the account.”

A smartphone needs a SIM card, which registers a wireless device to a carrier, to operate.  When a phone owner changes carriers or devices, the card is physically shifted from one device to another. However, customers can ask a carrier’s support staff — or, an enterprise’s support team — in person or over the phone to change the device a SIM card is registered to, because they have lost their device or forgotten its password.

Control over a victim’s smartphone is vital to hacking an account that uses the mobile device as part of multifactor authentication.

Threat actors rely on the gullibility of support staff for SIM swapping. The result is the threat actor can receive voice and SMS communications associated with the number.

Access to the SEC employee’s phone number occurred this way, the regulator emphasized in its statement, and not via SEC systems.

Once the attacker got control of the SEC X account, they made one post purporting to announce the Commission had approved spot bitcoin exchange-traded funds. That wasn’t true at the time, but a few days later the SEC announced certain financial platforms could carry bitcoin ETFs.

Among those investigating the incident are the SEC’s Office of Inspector General, the FBI. and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.

Threat actors have used SIM card swap attacks for years as a way to get around multifactor authentication, sometimes to break into an organization’s IT network — the work of the Lapsus$ gang is a prime example — and other times — as in this case — to take over social media accounts to promote cryptocurrency scams.

This month, an individual or individuals has been able to take temporary control of several prominent X accounts, including ones belonging to Mandiant, the city of Peterborough, Ont., and a Canadian Senator, to pump crypto junk. SIM card swaps may not always have been the tactic in every case. An attacker could take over a social media account not protected with MFA by guessing or brute-forcing a password. In the case of Mandiant, the company admitted MFA had been turned off during a staff transition.

In 2022, the FBI issued a warning on the risks of SIM card swaps. It urged carriers to:

  • educate employees and conduct training sessions on SIM swapping.
  • carefully inspect incoming email addresses containing official correspondence for slight changes that can make fraudulent addresses appear legitimate and resemble actual clients’ names.
  • set strict security protocols enabling employees to effectively verify customer credentials before changing their numbers to a new device.
  • authenticate calls from third-party authorized retailers requesting customer information.
The post SIM card swap led to takeover of SEC’s X account first appeared on IT World Canada.
Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.


Related articles

Costs from Global CrowdStrike Outage Could Exceed $1 Billion

The global tech outage caused by a faulty CrowdStrike update on Friday could result in damages exceeding $1...

CrowdStrike update: Warnings from national cyber agencies, repair options from Microsoft

National cybersecurity agencies in the U.S., Canada, the U.K. and Australia issued security warnings about the faulty CrowdStrike...

CrowdStrike update causes global IT outages, fix is available

Some airlines, banks and government services around the world have been affected by a faulty software update for...

Charges dismissed in SolarWinds hacking case

A judge has dismissed most of the Securities and Exchange Commission's (SEC) fraud charges against SolarWinds related to...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways