When did you last use SMS for two-factor authentication (2FA)? Maybe you used it to log in to your email or social media accounts, or to access online banking? It’s become an accepted part of life in the digital age, and yet a number of recent high-impact breaches were down to attackers intercepting 2FA SMS messages. By exploiting inherently insecure Signalling System No. 7 (SS7) networks, attackers can intercept and divert texts sent as 2FA. In some cases, these text messages contain codes used to authorise bank transfers, meaning interception could spell financial disaster for the victim.
\n\n\n\nOur expert content team have built a lab which takes you through a simulated SS7 network exploitation to intercept a 2FA SMS and transfer (imaginary!) funds to a bank account. Check out Matt Parven, our Principal Content Engineer, on why understanding — and experiencing — this exploitation is important for both red and blue teams.
\n\n\n\nWhen did you last use SMS for two-factor authentication (2FA)? Maybe you used it to log in to your email or social media accounts, or to access online banking? It’s become an accepted part of life in the digital age, and yet a number of recent high-impact breaches were down to attackers intercepting 2FA SMS…
\n","blocks":[{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"When did you last use SMS for two-factor authentication (2FA)? Maybe you used it to log in to your email or social media accounts, or to access online banking? It's become an accepted part of life in the digital age, and yet a number of recent high-impact breaches were down to attackers intercepting 2FA SMS messages. By exploiting inherently insecure Signalling System No. 7 (SS7) networks, attackers can intercept and divert texts sent as 2FA. In some cases, these text messages contain codes used to authorise bank transfers, meaning interception could spell financial disaster for the victim.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreHeadingBlock","name":"core/heading","attributes":{"__typename":"WordPress_CoreHeadingBlockAttributes","textAlign":null,"content":"Get hands on with the SS7 exploitation in our lab","level":2,"textColor":null,"anchor":""}},{"__typename":"WordPress_CoreParagraphBlock","name":"core/paragraph","attributes":{"__typename":"WordPress_CoreParagraphBlockAttributes","content":"Our expert content team have built a lab which takes you through a simulated SS7 network exploitation to intercept a 2FA SMS and transfer (imaginary!) funds to a bank account. Check out Matt Parven, our Principal Content Engineer, on why understanding -- and experiencing -- this exploitation is important for both red and blue teams.","textAlign":null,"fontSize":null}},{"__typename":"WordPress_CoreEmbedBlock","name":"core/embed","attributes":{"__typename":"WordPress_CoreEmbedBlockAttributes","providerNameSlug":"youtube","type":"video","oEmbed":""}},{"__typename":"WordPress_AcfLatestPostsBlock","name":"acf/latest-posts","acf":{"latestPostsCount":"3"}},{"__typename":"WordPress_AcfCtaBlock","name":"acf/cta","acf":{"ctaNegativeBottomMargin":true,"ctaPost":{"__typename":"WordPress_Cta","id":"cG9zdDo3OTE3","attributes":{"ctaColor":"orangeMain","ctaTitle":"Ready to see for yourself?","ctaText":"Take a tour of our platform including the chance to get hands-on with emerging threats, CTF style challenges and playable cyber crisis simulations. ","ctaImage":{"sourceUrl":"https://cms.immersivelabs.com/content/uploads/2020/06/cta-demo-1-1300x288.png","imageFile":{"publicURL":"/static/d52c66fd6a9bf82b6641c6bac7b8ef11/cta-demo-1-1300x288.png","childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAECAYAAACOXx+WAAAACXBIWXMAAAsTAAALEwEAmpwYAAAA4ElEQVQY062Pz0vCAACF92d614MHrx0DwRQxpFMMPAWlFkJBkWzNuVWi07lNXb+Yh67+WI6cJF7ec4e62NUHHx+8w4MncD/BnwU/WKI/8uC6Y7xHeEMPny9jyLdPSB+IyKQKyCXzyCeyKMYjYodoXNTRcT2Y/VcYzzZM3YKjmlyvfqLBRUBJ6/G4eM7SaY3iSYVOZ0D5SqZ4VKV0o7F5rbFx+UC1LFM9u6ehtNmy32g7H+y2BrQebYx0i4G/gLDZrDGZ+LiT2lB0E4pqYDr/wmw+xe+Vf3yHy8jY7RmuQmwBMJMbQYYHsSYAAAAASUVORK5CYII=","aspectRatio":4.545454545454546,"src":"/static/d52c66fd6a9bf82b6641c6bac7b8ef11/12f10/cta-demo-1-1300x288.png","srcSet":"/static/d52c66fd6a9bf82b6641c6bac7b8ef11/16ac3/cta-demo-1-1300x288.png 300w,\n/static/d52c66fd6a9bf82b6641c6bac7b8ef11/0e1f9/cta-demo-1-1300x288.png 600w,\n/static/d52c66fd6a9bf82b6641c6bac7b8ef11/12f10/cta-demo-1-1300x288.png 1200w,\n/static/d52c66fd6a9bf82b6641c6bac7b8ef11/808ee/cta-demo-1-1300x288.png 1300w","srcWebp":"/static/d52c66fd6a9bf82b6641c6bac7b8ef11/8edc8/cta-demo-1-1300x288.webp","srcSetWebp":"/static/d52c66fd6a9bf82b6641c6bac7b8ef11/fdc3b/cta-demo-1-1300x288.webp 300w,\n/static/d52c66fd6a9bf82b6641c6bac7b8ef11/47049/cta-demo-1-1300x288.webp 600w,\n/static/d52c66fd6a9bf82b6641c6bac7b8ef11/8edc8/cta-demo-1-1300x288.webp 1200w,\n/static/d52c66fd6a9bf82b6641c6bac7b8ef11/38bb9/cta-demo-1-1300x288.webp 1300w","sizes":"(max-width: 1200px) 100vw, 1200px"}}}},"ctaTitleSticky":null,"ctaTextSticky":null,"ctaButtonType":"link","ctaLink":{"target":"","title":"Get a demo","url":"https://www.immersivelabs.com/talk-to-an-expert"},"ctaButtonText":"Get a demo","ctaFormIntroContent":"Take just 30 minutes to embark on your journey to human cyber readiness.
\n","ctaHubspotPortalId":"3792509","ctaHubspotFormId":"7a5cd709-0200-4283-bb38-d32420a4efb7","ctaHubspotScript":"\r\n\r\n"}}}}],"seo":{"title":"Exploiting SS7 to Intercept Text Messages - Immersive Labs","metaDesc":"By exploiting inherently insecure Signalling System No. 7 (SS7) networks, attackers can intercept and divert texts sent as 2FA. Learn more in our blog post.","metaKeywords":"","canonical":"","opengraphType":"article","opengraphTitle":"Exploiting SS7 to Intercept Text Messages - Immersive Labs","opengraphDescription":"By exploiting inherently insecure Signalling System No. 7 (SS7) networks, attackers can intercept and divert texts sent as 2FA. Learn more in our blog post.","opengraphImage":{"sourceUrl":"https://cms.immersivelabs.com/content/uploads/2019/03/shutterstock519503956.jpg","uri":"https://www.immersivelabs.com/resources/blog/intercepting-text-messages/shutterstock_519503956/"}},"featuredImage":{"sourceUrl":"https://cms.immersivelabs.com/content/uploads/2019/03/shutterstock519503956.jpg","imageFile":{"publicURL":"/static/b2fa036062a382dff8a8d1dcdb04829b/shutterstock519503956.jpg","childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAUGBP/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAFqs0pChJ4s/8QAGxAAAgIDAQAAAAAAAAAAAAAAAhEAAQMEEiL/2gAIAQEAAQUCdI6DsSQ5/Ou7nZT/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFH/8QAGRAAAgMBAAAAAAAAAAAAAAAAACEBETEi/9oACAEBAAY/AkOGYcouzZP/xAAbEAEAAwADAQAAAAAAAAAAAAABABExIVFhkf/aAAgBAQABPyERagkXpt5lcKgG8Ml2l9wDPtP/2gAMAwEAAgADAAAAEHDP/8QAFhEBAQEAAAAAAAAAAAAAAAAAAQAR/9oACAEDAQE/ENBtv//EABYRAQEBAAAAAAAAAAAAAAAAAAEREP/aAAgBAgEBPxAKXH//xAAaEAEAAwEBAQAAAAAAAAAAAAABABEhMUFR/9oACAEBAAE/EDCgAui+8iEAtGPkJGp8OQ1PZ1TVy1ZK9OwLFex//9k=","aspectRatio":1.7964071856287425,"src":"/static/b2fa036062a382dff8a8d1dcdb04829b/1276b/shutterstock519503956.jpg","srcSet":"/static/b2fa036062a382dff8a8d1dcdb04829b/6aaa1/shutterstock519503956.jpg 300w,\n/static/b2fa036062a382dff8a8d1dcdb04829b/05631/shutterstock519503956.jpg 600w,\n/static/b2fa036062a382dff8a8d1dcdb04829b/1276b/shutterstock519503956.jpg 1000w","srcWebp":"/static/b2fa036062a382dff8a8d1dcdb04829b/a1ba4/shutterstock519503956.webp","srcSetWebp":"/static/b2fa036062a382dff8a8d1dcdb04829b/fdc3b/shutterstock519503956.webp 300w,\n/static/b2fa036062a382dff8a8d1dcdb04829b/47049/shutterstock519503956.webp 600w,\n/static/b2fa036062a382dff8a8d1dcdb04829b/a1ba4/shutterstock519503956.webp 1000w","sizes":"(max-width: 1000px) 100vw, 1000px"}}}},"tags":{"edges":[{"node":{"name":"Blog","slug":"blog","count":114,"attributes":{"colorTheme":"electricBlue"}}},{"node":{"name":"Free Labs","slug":"free-labs","count":12,"attributes":{"colorTheme":"electricBlue"}}}]},"categories":{"edges":[{"node":{"name":"All Resources","slug":"all-resources","count":352,"attributes":{"colorTheme":"electricBlue"}}},{"node":{"name":"Blog","slug":"blog","count":189,"attributes":{"colorTheme":"electricBlue"}}}]},"attributes":{"schema":"{\r\n \"@context\": \"https://schema.org\",\r\n \"@type\": \"NewsArticle\",\r\n \"mainEntityOfPage\": {\r\n \"@type\": \"WebPage\",\r\n \"@id\": \"https://google.com/article\"\r\n },\r\n \"headline\": \"$title\",\r\n \"image\": [\r\n \"$featuredImage\"\r\n ],\r\n \"datePublished\": \"$date\",\r\n \"dateModified\": \"$modified\",\r\n \"author\": {\r\n \"@type\": \"Person\",\r\n \"name\": \"$author\"\r\n },\r\n \"publisher\": {\r\n \"@type\": \"Organization\",\r\n \"name\": \"Immersive Labs\",\r\n \"logo\": {\r\n \"@type\": \"ImageObject\",\r\n \"url\": \"$logo\"\r\n }\r\n }\r\n}","postIncognito":null},"author":{"name":"Immersive Labs","attributes":{"userAvatarImage":{"altText":"","sourceUrl":"https://cms.immersivelabs.com/content/uploads/2020/06/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg","imageFile":{"publicURL":"/static/4b4dc210573184658e94223497b65cd5/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg","childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAUABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUEA//EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAaWTdOKwOU4KgP/EAB0QAAICAQUAAAAAAAAAAAAAAAEDAAIEERIiIzH/2gAIAQEAAQUCeSFrO1sYNaJt2S3mKOU//8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGxABAAICAwAAAAAAAAAAAAAAAQIQABEhMWH/2gAIAQEABj8C4de4BKUh73Thtta//8QAHBAAAgICAwAAAAAAAAAAAAAAAREAMRAhQVHR/9oACAEBAAE/IeRE76CNLBYFwXYgEO9wW0ALRFRz/9oADAMBAAIAAwAAABCzDwD/xAAUEQEAAAAAAAAAAAAAAAAAAAAg/9oACAEDAQE/EB//xAAUEQEAAAAAAAAAAAAAAAAAAAAg/9oACAECAQE/EB//xAAcEAEAAgIDAQAAAAAAAAAAAAABABEhQRAxUWH/2gAIAQEAAT8QcK0AC3ZUfyQBMXjhHFEs8SOcEsL0uFS6sTEcGDSdZl/k/9k=","aspectRatio":1,"src":"/static/4b4dc210573184658e94223497b65cd5/5c772/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg","srcSet":"/static/4b4dc210573184658e94223497b65cd5/07fa7/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg 150w,\n/static/4b4dc210573184658e94223497b65cd5/5c772/0bdac40f82cf9e85a5e1cc04ef4a9af2.jpg 192w","srcWebp":"/static/4b4dc210573184658e94223497b65cd5/0814e/0bdac40f82cf9e85a5e1cc04ef4a9af2.webp","srcSetWebp":"/static/4b4dc210573184658e94223497b65cd5/ef536/0bdac40f82cf9e85a5e1cc04ef4a9af2.webp 150w,\n/static/4b4dc210573184658e94223497b65cd5/0814e/0bdac40f82cf9e85a5e1cc04ef4a9af2.webp 192w","sizes":"(max-width: 192px) 100vw, 192px"}}}},"userJobTitle":"Senior Developer"}}}}},"pageContext":{"id":"cG9zdDozMzE5","slug":"intercepting-text-messages"}},"staticQueryHashes":["1134781590","1430943121","1691173908","2407081983","2499683418","3123027226","3518138710","3678308812","4001368598","4116960265","437961647"]}