July 13th, 2024

Who Owns Your Wireless Service? Crooks Do. (2019)

Cybercriminals exploit wireless carriers' vulnerabilities, compromising security. Incidents include data breaches and SIM-swapping attacks. Industry lacks control, regulators struggle. Efforts like SHAKEN/STIR in place, but challenges persist. AT&T developing solutions. Lack of privacy laws leaves consumers vulnerable.

Read original articleLink Icon
Who Owns Your Wireless Service? Crooks Do. (2019)

The wireless industry is facing a crisis as cybercriminals exploit loopholes and vulnerabilities within major carriers, compromising customer security and privacy. Incidents include employees taking bribes to unlock phones, selling customer location data, and facilitating SIM-swapping attacks leading to significant financial losses. Recent court cases have exposed the industry's lack of control over these issues, with regulators seemingly unable to address the situation effectively. Efforts like SHAKEN/STIR authentication to combat robocalls are underway, but challenges persist, such as carriers charging for anti-robocall services. AT&T is working on solutions like AAVS to mitigate unauthorized SIM swaps. However, the broader landscape lacks robust privacy laws and regulatory oversight, leaving consumers vulnerable to data breaches and exploitation. Despite calls for federal privacy legislation, progress is slow due to political gridlock and corporate interests. The industry's response to these threats remains a work in progress, with ongoing debates on how best to protect consumer data and privacy in the digital age.

Related

AT&T says hacker stole some data from 'nearly all' wireless customers

AT&T says hacker stole some data from 'nearly all' wireless customers

AT&T reports a data breach involving call and text records of wireless customers. Stolen data excludes personal details. Additional cybersecurity measures are in place. Collaboration with law enforcement and agencies ongoing.

AT&T says hacker stole data on 'nearly all' of its wireless customers

AT&T says hacker stole data on 'nearly all' of its wireless customers

AT&T suffered a security breach where a hacker accessed call and text data of wireless customers. The breach occurred between May and October 2022. Personal info was not compromised. Snowflake denied involvement.

AT&T says hackers stole records of nearly all cellular customers calls and texts

AT&T says hackers stole records of nearly all cellular customers calls and texts

Hackers accessed AT&T's system, obtaining call and text records from May to Oct. 2022 and Jan. 2023. The breach did not expose content or personal data but included sensitive phone numbers. AT&T is collaborating with law enforcement to investigate and enhance security measures. Senator Wyden highlighted the need for accountability in data breaches.

Hackers Steal Phone, SMS Records for Nearly All AT&T Customers

Hackers Steal Phone, SMS Records for Nearly All AT&T Customers

Hackers accessed AT&T's systems, compromising phone call and text records for 110 million customers. The breach revealed tower locations but not personal data. AT&T delayed disclosure due to security concerns.

What the AT&T phone records data breach means for you

What the AT&T phone records data breach means for you

AT&T discloses a data breach affecting 110 million customers, compromising phone records and cell site identification numbers. Stolen metadata poses social engineering risks, urging caution and cybersecurity enhancements in telecom.

Link Icon 5 comments
By @Brybry - 3 months
It'd be interesting to see Krebs follow up to comment if changes at the FCC since 2019 have been effective or not.

There's the privacy and data protection task force[1] doing things like amended rules to combat sim swap fraud[2] (which I think only came into force this month?)

There's the robocall task force[3] with what seems like a mostly successful push for STIR/SHAKEN implementation[4] though maybe some small providers are still given extensions[5].

Granted, the Supreme Court has been poking hard at executive rulemaking capability so some stuff may not survive. Net Neutrality just had a temporary stay in the 6th Circuit.[6]

[1] https://www.fcc.gov/privacy-and-data-protection-task-force

[2] https://docs.fcc.gov/public/attachments/FCC-23-95A1.pdf

[3] https://www.fcc.gov/spoofed-robocalls

[4] https://fccprod.servicenowservices.com/rmd?id=rmd_listings

[5] https://docs.fcc.gov/public/attachments/DA-23-1157A1.pdf

[6] https://www.yahoo.com/tech/us-court-temporarily-puts-net-191...

By @ChrisArchitect - 3 months
By @reboot81 - 3 months
SIM-swapping issues don’t exist here in Sweden. Banks here haven’t used SMS as authentication in decades.
By @webwielder2 - 3 months
I’m going to go out on a limb and assume that a comparison between the Trump and Biden administrations in efforts to police the telecom industry would show a marked difference in both effort and effectiveness.