_Tero_Vesalainen_Alamy.jpg?disable=upscale&width=1200&height=630&fit=crop)
August 29, 2024 at 10:06AM
Messaging channels like SMS and voice have been widely used for customer engagement, but they are also susceptible to telecom-based attacks like toll fraud and 2FA hijacking. These attacks create high costs for businesses and pose risks to cybersecurity. To defend against these threats, businesses can implement proactive measures internally and advocate for long-term industry-wide changes, including lobbying network operators and government bodies for better fraud control measures.
Based on the meeting notes, here are the key takeaways:
1. Messaging channels, particularly SMS and voice, have been extensively used for various purposes, but they are increasingly targeted by attackers for fraudulent activities such as toll fraud and 2FA hijacking.
2. The existing trust-based architecture of the global telecommunications infrastructure, particularly Signaling System 7 (SS7), is vulnerable to exploitation by attackers due to its lack of visibility and susceptibility to fake traffic generation.
3. Telco-driven attacks not only result in financial losses for businesses but also pose cybersecurity threats, including increased phishing attempts, intercepted SMS 2FA, denial of service, revenue loss, and an expanded attack surface for social engineering-driven attacks.
4. Businesses are advised to adopt proactive measures such as moving away from SMS and voice messaging channels, monitoring and disputing high messaging channel bills, blocking premium rate number deliveries, adopting bot defense measures, and implementing geofencing. They can also work on long-term measures by forming coalitions to lobby network operators and government bodies to upgrade infrastructure and adopt better fraud controls.
5. Some government bodies, such as the Australian Communications and Media Authority (ACMA), have started to take action against network providers for fraudulent activities, but a wider government push is needed to protect businesses’ interests.
These takeaways highlight the urgent need for businesses to take proactive and long-term measures to protect themselves against telco-driven attacks and to lobby for industry-wide improvements in infrastructure and fraud control measures.