Von Ralf Keuper

In letz­ter Zeit haben die Fäl­le von Iden­ti­täts­dieb­stäh­len, bei denen Bit­co­in-Eig­ner hohe Ver­lus­te erlit­ten, deut­lich zuge­nom­men, wie u.a. in Iden­ti­ty Thie­ves Hijack Cell­pho­ne Accounts to Go After Vir­tu­al Cur­ren­cy berich­tet wird.

Als Schwach­stel­le erwies sich dabei die Authen­ti­fi­zie­rung mit­tels Telefonnumer:

Once they get con­trol of the pho­ne num­ber, they can reset the pass­words on every account that uses the pho­ne num­ber as a secu­ri­ty backup—as ser­vices like Goog­le, Twit­ter and Face­book suggest.

Ein Bei­spiel:

Within minu­tes of get­ting con­trol of Mr. Burniske’s pho­ne, his atta­ckers had chan­ged the pass­word on his vir­tu­al cur­ren­cy wal­let and drai­ned the contents—some $150,000 at today’s values.

Wich­ti­ge Hin­wei­se lie­fer­ten die Opfer – wenn­gleich unfrei­wil­lig – selbst:

The atta­ckers appear to be focu­sing on anyo­ne who talks on social media about owning vir­tu­al cur­ren­ci­es or anyo­ne who is known to invest in vir­tu­al cur­ren­cy com­pa­nies, such as ven­ture capi­ta­lists. And vir­tu­al cur­ren­cy tran­sac­tions are desi­gned to be irreversible.

Das Haupt­pro­blem dabei:

Many email pro­vi­ders and finan­cial firms requi­re cus­to­mers to tie their online accounts to pho­ne num­bers, to veri­fy their iden­ti­ty. But this sys­tem also gene­ral­ly allows someone with the pho­ne num­ber to reset the pass­words on the­se accounts wit­hout kno­wing the ori­gi­nal pass­words. A hacker just hits “for­got pass­word?” and has a new code sent to the com­man­de­ered phone.

Das Pro­blem ist in der Bit­co­in-Sze­ne weit verbreitet:

“Ever­y­bo­dy I know in the cryp­to­cur­ren­cy space has got­ten their pho­ne num­ber sto­len,” said Joby Weeks, a Bit­co­in entrepreneur.

Ein klas­si­scher Fall von Social Engi­nee­ring.

Wei­te­re Informationen:

Hacker kapern Tele­fon­num­mern von Bitcoin-Reichen