Manipulated Nokia phones intercept SMS

The Nokia 1100 mobile phone.
Source: Nokia Bids in underground forum auctions that range up to €25,000, roughly £22,000, for six year old Nokia 1100 mobile phones, manufactured in a factory in Bochum, Germany, have led to speculation that criminals have managed to use them to facilitate illegal online banking transfers. It seems the phones can be used to intercept mTANs (mobile Transaction Authentication Numbers) sent via SMS messages. The mTAN, a one-time password system, is used by banks, such as German Postbank, to confirm and authorise online transactions. The difficulty for fraudsters so far, was the fact that they would have to have possession of the victims mobile phone when a valid TAN arrived.

According to the Dutch company Ultrascan Advanced Global Investigations by manipulating the firmware on the Nokia 1100 phone it should, however, be possible to duplicate the victims telephone number. Investigating authorities were alerted to the possible problem through observing high resale prices for the phone and the investigators turned to Ultrascan for assistance. By using a modified phone, the SMS mTAN sent by the bank is received by the attacker. For an attack to be successful, the attacker must first break into the customers online bank account by obtaining their password – likely either through Phishing or a Trojan.

In principle, it is possible for mobile networks to assign a telephone number to multiple SIM (Subscriber Identity Module) cards. The allocation of the mobile number to the SIM card is the responsibility of the mobile network provider and SIM cards are separate from phone firmware and have their own security. For an attack to work, the fraudsters would need to first clone the victims telephone number to a SIM that could be fitted to the Nokia 1100. It seems unlikely that a possible hack of the firmware in the Nokia 1100 phone alone would be sufficient to take over the victims SMS messages so that they are redirected to the fraudsters.

(dab)

See also:

• Visa plans credit card with on-board TAN generation, a report from The H.

(crve)