Telecoms protocol from 1975 exploited to target 20 crypto executives

At least 20 crypto executives and customers of an Israeli telecommunications company were targeted in a sophisticated SS7 attack last month.

Hackers compromised the Telegram messenger and email accounts of multiple cryptocurrency executives last month by exploiting a vulnerability in a decades old protocol.

The fraudsters are believed to have been trying to intercept two-factor authentication codes of victims in an attack on Israel-based telecommunications provider Partner Communications Company, formerly known as Orange Israel.

The attacks are currently being investigated by Israel's National Cyber Security Authority, and national intelligence agency Mossad. According to cybersecurity publication Bleeping Computer, the devices of at least 20 Partner clients were compromised.

Israel-based cybersecurity firm Pandora Security's analysis of the event suggests the devices were likely breached via a Signaling System 7 attack.

SS7 comprises a set of protocols that are used to facilitate the exchange of information within public switched telephone networks interacting over digital signaling networks.

Hackers can exploit SS7 to intercept text messages and calls by using a roaming feature and "Updating the location of their device as if it registered to a different network."

Despite first being developed in 1975, the SS7 protocol is currently in widespread use globally.

The SS7 attacks are reminiscent of SIM-swapping that reassigns the phone number associated with a victim's SIM-card to a device under the hackers' control.

U.S.-based telecom providers have faced multiple lawsuits from crypto executive clients that have been targeted by SIM-swap attacks.