SEC blames sim-swapping, lack of MFA for X account hijacking

Multifactor authentication was disabled at the SEC’s request last year after staff had difficulties accessing the social media account.

The Securities and Exchange Commission confirmed Monday that a hack of the agency’s account on the social media site X earlier this month was done through an “apparent SIM swap attack” and that the account did not have multifactor authentication enabled.

According to a statement from the agency, an internal investigation following the Jan. 9 account hijacking determined that an unauthorized party had obtained control of a phone number associated with the SEC’s X account through the agency’s telecommunications carrier.

Sim-swapping involves gaining control of a cellular phone number by convincing a mobile carrier to transfer a number to a sim card controlled by the attacker. Once the attacker controls the victim’s phone number, they can use that phone number to reset the password of accounts belonging to the victim.

Having gained control of the number associated with the agency’s account, the swapper reset the SEC’s password on X, giving them access to the agency’s account. The investigation was carried out by the SEC Office of Inspector General, the FBI, the Cybersecurity and Infrastructure Security Agency, the Commodity Futures Trading Commission, the Department of Justice and the SEC’s enforcement division.

“Among other things, law enforcement is currently investigating how the unauthorized party got the carrier to change the SIM for the account and how the party knew which phone number was associated with the account.”

The statement also confirmed initial public comments from X that the SEC account in question had disabled multifactor authentication. The agency said the account was “disabled by X support, at the staff’s request, in July 2023 due to issues accessing the account.”

The agency said it now has multifactor authentication enabled “for all SEC social media accounts that offer it.”

According to a transparency report around account security published by Twitter/X covering the last half of 2021, two-factor authentication is rarely leveraged by users and when it is most accounts opt for the least secure method. Just 2.6% of accounts between July-December 2021 utilized two-factor authentication, and of those who did, nearly three out of four (74%) chose to verify through SMS or texts. 

Cybersecurity experts say that while SMS-based authentication is better than nothing, it is more vulnerable to sim-swapping and social engineering than other factors like email or a security key. 

Twitter stopped publishing formal biannual transparency reports at the beginning of 2022. Last year, new owner Elon Musk’s changes to the platform included the disabling of SMS multifactor authentication as an option for non-paying accounts.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure