How a Cybercriminal Can Steal Your Text Messages

We always picture hackers as these foreboding, black-clad criminals, smirking through the shadows in their dark room by their computer monitor. Hard, uncaring individuals who don’t go outside very often, staring at code as if they were able to decipher the Matrix.

It’s time we give up this persona and stop mystifying cybercriminals. Why?

It only takes a few dollars and some spare time to truly hold an individual’s data hostage.

Cybercrime doesn’t require the skill of a computer programmer, any more than robbing someone on the street requires the skill of a James Bond villain. It just takes a level of dedication and a significant lack of compassion. 

It’s So Easy to Have Everything Taken Away From You

Keep the comparison of cybercriminals with street muggers in mind. That’s really what these people are. When my friend (we’ll call him Ryan) watched his online accounts systematically get broken into, he wasn’t dealing with a highly-skilled, Hollywood-like hacker. He was probably dealing with a kid who found an easy way to take advantage of others.

Here’s the story:

Ryan received a weird message from a stranger. That message had screenshots of a few of his online accounts including Amazon, Netflix, and a few others. This stranger was proving that he had access to Ryan’s accounts.

A few minutes later, the stranger started to show text messages that were intended for Ryan. He logged into Ryan’s Facebook account and started messaging Ryan’s friends and family. 

Ryan’s phone wasn’t acting odd, there was no evidence that it had been hijacked. His computer at home wasn’t showing any signs of malicious activity. Everything worked as normal.

This stranger was going through all of Ryan’s online accounts and changing passwords, taking over, and locking Ryan out. It wasn’t long before he found his way into Ryan’s Paypal account.

Several possible ways this could happen:

If you use the same passwords on multiple accounts, it’s easy for a cybercriminal to sift through sites and businesses that were breached and try your username and password on other services. Stolen information is often displayed and sold on the Dark Web, and for a few bucks, anyone can grab loads of personal, sensitive information like this.

Another way could be SIM Swapping, which is a term for when a criminal tricks a cell phone carrier to forward your calls and text messages to their own device. It only takes a confident criminal and a misguided support person at your carrier.

In this case, however, the criminal didn’t even go that far.

They used a legitimate service called Sakari, which is a text messaging marketing service that lets businesses perform mass communication to their customers or subscribers via text. 

Anyone can create an account with Sakari, and for a few dollars, seize another person’s phone number.

The victim doesn’t lose access to their smartphone. They still get calls and texts. However, the cybercriminal gets to see everything going on. Since many online accounts will text you if you try to get in without a password, the so-called hacker could intercept these messages and take the steps to gain control over your identity. Once they are in your text messages, they can quickly escalate into your email, and then control everything.

We’re likely going to see companies like Sakari increase their security to prevent this from becoming a widespread problem, but it just goes to show you that hackers can be resourceful without actually needing a lot of skill, just dedication to do wrong.

To protect yourself from this type of attack, be sure to use strong passwords and never use the same password on multiple accounts. Utilize 2FA that goes beyond SMS messaging, such as the Google Authenticator, Duo, Lastpass Authenticator, or a similar tool. Most importantly, never hesitate to ask your trusted IT experts what you can do to further protect yourself, your identity, and your business.

Want to discuss your cybersecurity? Give Macro Systems a call at 703-359-9211.