1 00:00:00,200 --> 00:00:02,313 SIM cloning and ID theft. 2 00:00:03,340 --> 00:00:05,610 If you've gone and bought a new cell phone recently, 3 00:00:05,610 --> 00:00:07,610 you've gone to the store, they've pulled out 4 00:00:07,610 --> 00:00:09,070 a little chip out of your phone 5 00:00:09,070 --> 00:00:11,120 and placed it into your new phone. 6 00:00:11,120 --> 00:00:12,670 What is that chip? 7 00:00:12,670 --> 00:00:14,380 Well, that's a SIM card. 8 00:00:14,380 --> 00:00:17,420 It's stands for subscriber identity module. 9 00:00:17,420 --> 00:00:19,210 This is an integrated circuit that 10 00:00:19,210 --> 00:00:21,410 securely stores the international mobile 11 00:00:21,410 --> 00:00:24,060 subscriber identity, your IMSI number, 12 00:00:24,060 --> 00:00:25,680 and its related key. 13 00:00:25,680 --> 00:00:27,830 This is what tells the cellphone towers 14 00:00:27,830 --> 00:00:30,840 which device is assigned to which number. 15 00:00:30,840 --> 00:00:33,540 Now, if someone is able to clone your SIM card, 16 00:00:33,540 --> 00:00:34,973 they can pretend they're you. 17 00:00:34,973 --> 00:00:38,290 This was very popular in the early days of cellphones 18 00:00:38,290 --> 00:00:40,480 because if I could pretend that I was you, 19 00:00:40,480 --> 00:00:42,970 I could rack up lots of long distance calls 20 00:00:42,970 --> 00:00:44,900 and lots of minutes used on cellular 21 00:00:44,900 --> 00:00:46,120 and not get charged for them 22 00:00:46,120 --> 00:00:47,900 because you would get charged for them. 23 00:00:47,900 --> 00:00:50,707 And so people would go through and impersonate you 24 00:00:50,707 --> 00:00:53,870 and they would do this by cloning your SIM card. 25 00:00:53,870 --> 00:00:56,040 Now, SIM cloning allows two cellphones 26 00:00:56,040 --> 00:00:58,340 to utilize the same service 27 00:00:58,340 --> 00:01:00,140 and allows the attacker to gain access 28 00:01:00,140 --> 00:01:01,990 to the phone's personal data. 29 00:01:01,990 --> 00:01:05,730 So, if I'm cloning your SIM card, the towers think I'm you. 30 00:01:05,730 --> 00:01:07,540 So, if somebody sends you a text message, 31 00:01:07,540 --> 00:01:09,550 I get a copy and you get a copy. 32 00:01:09,550 --> 00:01:12,140 And so now, I'm able to keep track of what you're getting. 33 00:01:12,140 --> 00:01:14,460 Now, this is very dangerous for you. 34 00:01:14,460 --> 00:01:16,161 The good news is that SIM 35 00:01:16,161 --> 00:01:18,700 has changed its ways over the years. 36 00:01:18,700 --> 00:01:21,870 The first versions of SIM cards were very easy to clone, 37 00:01:21,870 --> 00:01:25,650 but the newer SIM version 2 cards are much, much harder. 38 00:01:25,650 --> 00:01:28,810 So, this gives us a lot more security. 39 00:01:28,810 --> 00:01:30,400 Now, one of the second problems 40 00:01:30,400 --> 00:01:33,380 we have with mobile phones and SIM cards and phone numbers 41 00:01:33,380 --> 00:01:35,950 is when people try to take over your phone. 42 00:01:35,950 --> 00:01:37,810 And so, you may think, all right, great, 43 00:01:37,810 --> 00:01:40,220 SIM card cloning is almost a thing of the past, 44 00:01:40,220 --> 00:01:42,110 version 2 has taken care of it. 45 00:01:42,110 --> 00:01:44,945 Well, attackers are smart and they find other ways 46 00:01:44,945 --> 00:01:47,380 to hijack your cellphone account. 47 00:01:47,380 --> 00:01:49,020 What they started doing now 48 00:01:49,020 --> 00:01:51,550 is they will call up your cellphone provider 49 00:01:51,550 --> 00:01:53,080 and pretend to be you. 50 00:01:53,080 --> 00:01:55,020 This is a social engineering scheme. 51 00:01:55,020 --> 00:01:57,150 They'll say, I just bought a new phone 52 00:01:57,150 --> 00:01:59,020 and I need to get it activated. 53 00:01:59,020 --> 00:02:00,520 And the nice customer service agent 54 00:02:00,520 --> 00:02:03,140 will ask them some basic questions about themselves, 55 00:02:03,140 --> 00:02:04,690 like maybe their date of birth, 56 00:02:04,690 --> 00:02:07,150 where they went to high school, their name and address, 57 00:02:07,150 --> 00:02:09,250 things that you can usually find online. 58 00:02:09,250 --> 00:02:10,730 So, the attacker pretends to be you 59 00:02:10,730 --> 00:02:12,310 and gives that information. 60 00:02:12,310 --> 00:02:15,090 The customer service agent is wonderfully helpful, 61 00:02:15,090 --> 00:02:17,100 and they transfer your phone service 62 00:02:17,100 --> 00:02:19,160 from you to the attacker. 63 00:02:19,160 --> 00:02:22,120 Now, the attacker has a phone and a new SIM card 64 00:02:22,120 --> 00:02:24,140 that is now attached to your number. 65 00:02:24,140 --> 00:02:25,210 Why are they doing this? 66 00:02:25,210 --> 00:02:27,100 Why do they want your phone number? 67 00:02:27,100 --> 00:02:30,210 Well, it comes down to two-step authentication. 68 00:02:30,210 --> 00:02:33,710 A lot of websites now are using two-factor authentication 69 00:02:33,710 --> 00:02:36,730 where you log in and they send you a text message 70 00:02:36,730 --> 00:02:39,290 with a secret code that you then put into the website 71 00:02:39,290 --> 00:02:41,550 to verify that you are who you say you are. 72 00:02:41,550 --> 00:02:44,249 If the attacker is able to take over your phone number, 73 00:02:44,249 --> 00:02:45,960 they can now pretend to be you 74 00:02:45,960 --> 00:02:48,830 and log into your bank, your Facebook, your Gmail, 75 00:02:48,830 --> 00:02:52,190 or whatever else you have for two-factor authentication. 76 00:02:52,190 --> 00:02:54,380 This is becoming a big problem. 77 00:02:54,380 --> 00:02:55,840 And so, you have to be careful 78 00:02:55,840 --> 00:02:57,610 where you post your phone number. 79 00:02:57,610 --> 00:02:59,900 Because if somebody now has your phone number, 80 00:02:59,900 --> 00:03:01,700 and they've already stolen your account, 81 00:03:01,700 --> 00:03:03,910 your email, and maybe your password, 82 00:03:03,910 --> 00:03:05,660 they can now take over your phone number 83 00:03:05,660 --> 00:03:07,360 and then take over your accounts. 84 00:03:07,360 --> 00:03:11,030 So, this is what we call ID theft, or account takeover. 85 00:03:11,030 --> 00:03:13,080 So, how do we combat this? 86 00:03:13,080 --> 00:03:15,180 Well, one of the ways is to be careful 87 00:03:15,180 --> 00:03:17,100 where your post your phone number. 88 00:03:17,100 --> 00:03:19,160 Because if you are a victim of a data breach, 89 00:03:19,160 --> 00:03:21,350 and somebody has stolen your name 90 00:03:21,350 --> 00:03:23,250 and your address and your email, 91 00:03:23,250 --> 00:03:25,100 and now they have your phone number, 92 00:03:25,100 --> 00:03:27,800 they can perform this account takeover against you. 93 00:03:27,800 --> 00:03:28,950 And now, they're going to be able 94 00:03:28,950 --> 00:03:30,880 to log in to your accounts as if they were you, 95 00:03:30,880 --> 00:03:34,200 even if you had the two-factor authentication set up. 96 00:03:34,200 --> 00:03:36,610 So, what do we recommend to bypass this 97 00:03:36,610 --> 00:03:38,630 if you really want to be paranoid? 98 00:03:38,630 --> 00:03:41,250 Well, you can go and get a Google Voice number, 99 00:03:41,250 --> 00:03:42,730 or something of that nature, 100 00:03:42,730 --> 00:03:43,930 where you have a single phone number 101 00:03:43,930 --> 00:03:46,180 that people call and then nobody knows 102 00:03:46,180 --> 00:03:49,050 your actual cellphone number that's behind it. 103 00:03:49,050 --> 00:03:50,960 You then can use that cellphone number 104 00:03:50,960 --> 00:03:53,700 to validate your accounts for two-factor authentication. 105 00:03:53,700 --> 00:03:55,980 Again, this is getting a little paranoid. 106 00:03:55,980 --> 00:03:57,460 But this is something that some people 107 00:03:57,460 --> 00:03:59,320 are worried about and are taking this action 108 00:03:59,320 --> 00:04:00,770 and these steps to bypass it.