Defend SIM Swapping Attacks on Microsoft 365 Users With Strong MFA Methods

As the digital world evolves rapidly, security standards don’t appear to fit well. Why do I say this? Are we that weak when it comes to security compliance?

Yes, of course! We’re developing a technology that can transfer zettabytes of data in a minute, and the whole metaverse is waving at us right now. But do you believe if I say – In this modernized world, a single mobile number can drastically turn everything upside down?

The bitter truth is obviously, yes! 😕 Since mobile numbers are the source of every person’s identity, hackers have found a way to exploit them through SIM Swapping method.

SIM Swapping lets an attacker steal the user’s phone number and conduct multiple exploits, such as bypassing MFA, stealing bank accounts, and gaining access to social media and other accounts.

The majority of attacks are caused by clicking on a suspicious link or installing a malicious app, but with SIM swapping/SIM hijacking, the plot is completely different! Because this happens without the victim’s input, making them a lot more dangerous.

Perhaps you might be the next victim, too. 🚨So, let’s focus on the suspiciously rising SIM hijacking, and look at ways to identify the attack and prevent users from being victimized without further delay.

What is SIM – Swapping?

In SIM swapping, also known as SIM hijacking, the hacker collects the victim’s personal information (email address, date of birth) and impersonates the victim, then contact the mobile provider and convinces them to activate the victim’s number on the fraudster’s phone.

🚀SIM swap attacks started spiking in 2015 and are still going strong!

A report by the UK states that the count of sim swap attacks scaled up by 400% between 2015 and 2020. As well, Princeton University reports that 80% of SIM swap attempts are successful.

In 2019 – Twitter CEO Jack Dorsey’s Twitter account was hacked via a sim-swap method.

In 2021 – The FBI says that victims lost $68 million to this SIM-card-based scam in 2021, compared to just $12 million in the past three years, i.e., between 2018 and 2020.

In 2022 – Two Massachusetts men were sentenced to more than two years in prison for stealing cryptocurrency in SIM-swapping attacks and hijacking their victims’ social media accounts.

The list hasn’t stopped yet! Every day, organizations are draining millions of dollars due to such suspicious attacks.

Since password compromises have been widely reported, Microsoft developed the multi-factor authentication to increase Office 365 security. As organizations required MFA, users began implementing the easiest and most common method, SMS-based 2-factor authentication.

This traditional and common technique became a prominent target for attackers, paving the way for the SIM swapping attack – A simple method to compromise second-factor authentication.

Password spray attacks, phishing, and other methods are normally used by attackers to obtain passwords. Secondly, we need to break the barrier of two-factor authentication to open the security gate. Thus, cybercriminals are increasingly using SIM porting attacks as it is an easy way to obtain the 2-step verification code (SMS-based MFA).

Normally, SIM swapping exists for genuine reasons, such as when a SIM card is lost or damaged. But cybercriminals utilize this beneficial method and acquire a duplicate copy of the victim’s SIM card for their own convenience.

Next, we will look at how a hacker performs a SIM swap hack to their advantage.

Step 1: An attacker begins by collecting the victim’s personal data, such as name, phone number, e-mail, birthday, and other information. They use various techniques, such as standard phishing techniques, data collection via the dark web, or some social engineering techniques to collect the data.

Step 2: Now, the bad actors impersonate a victim, contact the mobile network provider and ask for the SIM card to be activated on a new device (To perform a SIM swap).

→ In order to transfer old SIM details to a new SIM card, they pretend like the current SIM card has been lost, stolen, or damaged. SIM changes are likely to happen soon with these above claims!

Step 3: Lastly, the telecom provider switches the SIM card and gives access to the hacker. Therefore, the hacker controls the SIM card, and the victim will not receive text messages or phone calls further in the future The connection will be completely lost to the victim). Thus, the hacker can perform limitless damage with the victim’s mobile number!

→ The attackers can get their hands on the two-factor authentication verification codes (bypass MFA methods), reset passwords, and hack the victim’s bank account.

→ They can reset your personal account password and access all the saved passwords, payment transactions, etc.

From the list, bypassing MFA is the most vulnerable and dangerous attack. And most importantly, Microsoft 365 users who have SMS as their second-factor authentication method are the most affected! 🚨

Feeling trapped? No worries! Here are a few warning signs that can help you know if your SIM has been hijacked.

1. Service cutdown: After a successful sim port, the victim will lose communication with their mobile number. They will not be able to contact anyone anymore.

2. Suspicious synchronization: You may receive notifications or email alerts regarding changes in passwords, PINs, etc.

3. Strange activities: You will notice unusual behaviors, like automatic logging out from online accounts and services that use your mobile phone number.

By observing any of the above warning signs, you can determine whether a SIM swap has taken place. It’s crucial to catch the thieves faster! So, take the necessary steps to secure your workspace from such fraudulent attacks because the earlier you catch them, the less harm they can do.

What to do if your SIM has swapped? Got confused? Without no further, let’s look at some essential preventive measures to protect against SIM swap attacks.

The most effective step to prevent SIM-swapping attacks is to remove phone-based MFA for Microsoft 365 users. Currently, the FIDO2 security key is acknowledged as one of the most reliable MFA authentication techniques. But if you’re an organization that can’t afford such expenses, don’t worry! We still have a backup.

• Use passwordless multifactor authentication, the second most secure method.
• Integrate the strong authenticator factors like MFA location and application details to the MFA push notification method and strengthen the Microsoft 365 security posture.

Nowadays, users tend to break out in the first step itself, that is while authenticating with PASSWORDS! Most organizations don’t take passwords seriously, and users probably use easy-to-remember passwords. So there happens the rise of numerous brute-force attacks, password spraying, etc. So, implement a strong Office 365 password policy in your organization and pose an unbreakable grip.

Always beware when you share your personally identifiable information anywhere and provide security responses that are difficult to decode. Because, for reset actions or account recovery questions, some services will require security answers. So, if you provide your pet’s name as an answer, an attacker will find that information online easily. Make sure you make it impossible for the attacker to access it.

• Protecting your SIM cards with the second layer of defense is always a good idea. 🔐 So, deploy the SIM lock method and protect your SIM cards with PINs. Because when you restart or transfer the SIM to another phone, this requires a numerical PIN to break it through.

• Additionally, some service providers offer Number Lock to prevent unauthorized transfers of phone numbers. This number lock helps to prevent your mobile number from being ported to another line or carrier unless you remove the lock with a PIN or in person. This feature greatly enhances the security of your SIM card when it will be offered by your carrier.

That’s it! Unfortunately, SIM swapping seems to be growing quite quickly. Therefore, hackers will continue to exploit the technology through fraudulent methods. Office 365 administrators can mitigate SIM swap risks by deploying advanced security and consistent education to their users. So, begin mentoring your employees with robust cyber defense techniques and spur them to stay vigilant at all costs.