Introduction: Hardware supply chain attacks have reached a new level of sophistication, as demonstrated by a recent discovery of a commercial SIMbox containing a pre‑baked command injection backdoor. The malicious payload resides in the secondary NTP server configuration field, executing every time the device syncs its clock – creating a covert and persistent egress point for attackers. This article dissects the technical mechanisms behind this implant, provides step‑by‑step analysis and exploitation techniques, and offers actionable mitigation strategies for telecom and security professionals.

Het Nederlandse Openbaar Ministerie eist een celstraf van acht maanden tegen een man die een 112-centrale platlegde met duizenden geautomatiseerde telefoonoproepen. De 112-centrale was daardoor langer...

La Guàrdia Civil ha desarticulat una xarxa que explotava milers de SIM per a enviar milions de SMS i crides i enganyar amb suplantacions institucionals. L'operació, amb registres a Barcelona, s'ha saldat amb un detingut, material valorat en 400.000 euros i confiscació de 35 SIMBOX.

Share your videos with friends, family, and the world

ทรู สนับสนุนกสทช. และตำรวจ ร่วมสกัดขบวนการ SIMBOX ลดช่องโหว่ความเสี่ยงด้านอาชญากรรมไซเบอร์ และเสริมมาตรฐานความปลอดภัยดิจิทัลของประเทศ

A criminal network that has been massively defrauding victims in Austria and Latvia through a range of online and phone scams, such as fake sales via websites and WhatsApp fraud, has been dismantled w...

Правоохранительные органы Европы задержали в Латвии крупную цифровую преступную группу. По данным следствия, эта группа обманула тысячи людей и нанесла ущерб как минимум на 5 миллионов евро. Согласно официальным данным, полиция Латвии совместно с Эстонией, Австрией, Europol и Eurojust провела совместную операцию под названием «SIMcartel». В ходе расследования выяснилось, что мошенники управляли тысячами SIM-карт с помощью специальной платформы SIMbox, что позволило им скрывать личности пользователей и создавать поддельные аккаунты. По данным следствия, с помощью этой системы было создано около 50 миллионов онлайн-аккаунтов. Через них осуществлялись банковские и инвестиционные мошенничества, а также другие финансовые преступления в разных странах. Согласно сообщению Europol, более 3200 человек признаны потерпевшими. Основная часть ущерба — около 4,5 миллиона евро — пришлась на Австрию, а в Латвии зафиксированы потери в размере 420 тысяч евро. Кроме того, расследование показало, что группа «SIMcartel» занималась не только интернет-мошенничеством, но также могла быть связана с нелегальной перевозкой мигрантов и вымогательством. На данный момент задержаны семь подозреваемых, большинство из которых — граждане Латвии. Их устройства связи и компьютеры изъяты для экспертизы. Europol планирует расширить расследование и проверить причастность других стран к этой сети. Эксперты называют это одной из крупнейших операций по борьбе с цифровым мошенничеством в Европе за последние годы. Следователи отмечают, что деятельность группы представляет угрозу не только финансовой безопасности, но и кибербезопасности в целом. По данным Europol, операция продолжается, и ведется работа по выявлению новых подозреваемых. Европейские страны вновь убедились в необходимости усиления цифровой защиты.

A major Europol operation has taken down a cybercrime service, leading to seven arrests and the seizure of a massive SIM-box fraud network used for phishing.

Starptautiskā operācija “SIMcartel” Valsts policija aizturējusi piecus noziedziekus, kas legālas uzņēmējdarbības aizsegā, izmantoja anonīmos tiešsaistes kontus un "SIMbox" infrastruktūru apkrāpa visma...

Īstenojot starptautisku operāciju “SIMcartel”, Valsts policija likvidējusi Latvijā izvietotu SIMbox infrastruktūru un aizturēja piecas personas, kas, piesedzoties ar legālu uzņēmējdarbību,…

YouTube video by ChinaSkyline--(Petrichor)

Explore how the rise of eSIMs reshapes SIM Box fraud detection and prevention, with key strategies and security measures to protect telecom networks.

Episode Notes Description: In this episode of Upwardly Mobile, we dive into one of the most pressing cybersecurity threats facing mobile carriers and their subscribers: eSIM swap fraud. While digital SIMs offer superior security against physical theft, they remain vulnerable to sophisticated credential-based attacks and social engineering that target the carrier's systems. We explain how this critical fraud operates and reveal the advanced, cloud-based technologies—App Attestation and Device Binding—that mobile operators are now deploying to verify user identity and device integrity in real time, effectively blocking fraudsters before a swap can be completed. The eSIM Swap Threat eSIM swapping is a form of identity fraud where an attacker convinces a mobile carrier to transfer a victim's phone number to a new eSIM under the attacker's control, often by impersonating the legitimate user remotely. • Attack Method: Attackers often gather personal details from public sources or breaches, then contact the carrier, claiming they need to transfer their number to a new device. Since no physical access is needed, the fraud relies entirely on weaknesses in the carrier’s authentication process. • The Impact: Once a swap is successful, the criminal gains full control over the victim's phone number. They can intercept calls, texts, and, critically, one-time security codes (OTPs) sent via SMS, allowing them to bypass two-factor authentication (2FA) for online banking, cryptocurrency exchanges, and other sensitive accounts, leading to massive financial loss. https://approov.io/blog/why-hackers-love-phones-keep-your-eye-on-the-device To counter these remote, identity-based attacks, carriers are adopting a multi-layered verification approach focused on establishing the trustworthiness of the application and the hardware initiating the swap request. 1. App Attestation This technology focuses on verifying the integrity and legitimacy of the carrier's mobile application. • Verification: App Attestation confirms that the carrier's app being used is the genuine, untampered version downloaded directly from an official app store. • Prevention: It detects if the app has been modified with malicious code or is running in a compromised environment, such as an emulator. If an attacker attempts to use a fake or compromised version of the carrier’s app to initiate a fraudulent eSIM swap request, https://approov.io/mobile-app-security/rasp/app-attestation/ detects and blocks that request. 2. Device Binding Device Binding provides a cryptographic link between a user's account and the unique hardware characteristics of their trusted device. • Secure Link: When a user first logs in, a secure link is created between the app and the device's hardware IDs. • Suspicion Flagging: If a request for an eSIM swap is later initiated from a different, unverified device, the system flags the activity as suspicious, regardless of whether the attacker has stolen credentials. The system can then require additional verification steps or outright deny the unauthorized transfer. This combined approach shifts the security decision-making from the potentially compromised user device to a secure cloud service, making it extremely difficult for attackers to bypass checks through client-side tampering or reverse-engineering. Comprehensive Security Layers for Mobile Carriers Beyond app and device verification, mobile carriers are advised to strengthen defenses through systemic controls: • Stricter Authentication: Implementing secure authentication processes for eSIM transfers, including demanding extra layers like verbal confirmation or a photo ID. • Device Fingerprinting: Binding eSIM profiles to unique device hardware IDs to prevent unauthorized cloning or reuse across multiple devices. • Advanced Analytics: Leveraging AI-Driven Fraud Detection and machine learning to monitor network activity for anomalies, such as unusual call volumes or multiple simultaneous activations, which might signal digital SIM Box fraud schemes. • User Protection Features: Offering tools like Verizon's "SIM Protection," which allows customers to lock lines on their account, prohibiting any transaction requiring a new SIM/eSIM transfer until manually unlocked (with a possible 15-minute delay when unlocking). Protect Yourself: User Best Practices Users must also adopt strong security habits to minimize risk: • Prioritize App-Based 2FA: Always use authenticators like Google Authenticator or Authy over SMS-based two-factor authentication (2FA) for critical accounts, as SMS codes can be intercepted post-swap. • Secure Your Carrier Account: Set a strong password and add an account PIN or passcode with your carrier to prevent unauthorized changes. • Stay Vigilant: Immediately contact your carrier if you notice unexpected loss of cellular service, unusual account alerts, or unauthorized charges, which are common signs of a successful eSIM hack. -------------------------------------------------------------------------------- Sponsor This episode is brought to you by Approov, pioneers in Mobile App and Device Security. Learn how Approov’s App Attestation and Device Binding solutions safeguard your mobile transactions and prevent sophisticated fraud. Visit: https://notebooklm.google.com/approov.io

L’Iliad Simbox si evolve e diventa protagonista della nuova offerta estiva. Non solo SIM attivabili in pochi minuti, ma anche smartphone nuovi e rigenerati disponibili direttamente dal totem automatico, con pagamenti flessibili e senza lunghe procedure in negozio. Una novità che punta a rendere ancora più semplice e veloce l’esperienza di acquisto. Cos’è una Iliad Simbox La Iliad Simbox…

È possibile acquistare uno smartphone anche attraverso le SIMBOX di iliad posizionate negli store dell'operatore e nei centri commerciali. The post iliad vende gli smartphone con le SIMBOX appeared first on Punto Informatico.