Cybersecurity experts warned of a possible attack on Russian accounts in May

DeviceLock, a company engaged in the fight against data leaks, warned of the preparation of an attack on the accounts of Russians during the May holidays due to the sale of access to the switch of one of the mobile operators on the Darknet. 

In particular, it is reported that in early March a proposal appeared on the Darknet to sell access to the switch of one of the mobile operators, the connection to which allows to intercept control over the SS7 signaling system, which controls the traffic of mobile operators.

The experts said that they were asking $30,000 for access to the switch, so the purchase only makes sense if the hacker attack is being prepared on a large scale, capable of recouping the expense.

“Since attackers usually need from two weeks to a month to prepare an attack of this type, it can be timed to May holidays, when most Russians will loosen control over their accounts and other financial assets,” summarized Olesya Yarmolenko, general director of Smart Line Inc (DeviceLock systems manufacturer).

According to her, this operator most likely has a cooperation agreement with one or more Russian cellular service providers. At the same time, according to DeviceLock data, in early April access to the switch could have reached the buyer from the CIS countries, and due to the active spread of online banking and relatively high account balances, Russia has always been the most desirable target for fraudsters on the Internet.

Sergey Nenakhov, head of the information security audit department at Infosecurity a Softline company, explained that the clients should switch the two-factor protection of critical services to push notifications instead of SMS, and also use special authenticator applications which generate one-time codes directly on the device itself.

It is also specified that VTB is aware of the risks of attacks on citizens through interception of messages, but the bank assured that the adopted set of technical measures does not allow attackers to use the technology to gain access to the clients’ funds.

At the same time, representatives of mobile operators did not respond to inquiries about the risks of attacks through the SS7 standard.