A hacker attempted to send more than 4m text messages saying “death to the Jews” by exploiting the network of a global telecommunications company.
A Guardian investigation has revealed that data was stolen in 2013 as a result of unauthorised access to the systems of SMSGlobal, which provides messaging services for “some of the world’s best known brands” and has more than one million customers worldwide.
In April 2015, a hacker attempted to send over 4m messages to phone numbers across the Middle East. The message said: “Our motto forever Death to America, Death to the Jews.”
SMSGlobal succeeded in blocking most messages, but approximately 5,000 were distributed to mobile numbers in the United Arab Emirates. The identity of the hacker or group of hackers is not known. The company has defended their handling of the incident, and said that no message history, data or any other personal customer data was taken as a consequence of the breaches.
The 2013 theft was attributed by the company to be a cause of the breach in April 2015. Clients who had not changed their passwords were potentially vulnerable.
The investigation has also revealed that SMSGlobal said it “proactively” cooperates with UAE intelligence agencies, and has pointed to help it has given the FBI and the Australian federal police.
The company is based in Australia and has a strong presence in the UAE and offices in Britain and the US.
SMSGlobal’s clients include Nestle Waters, Serco, Etihad Airways, Emirates Transport, Tecom, Samsung, Microsoft, IBM, Dell, the Australian Football League and law enforcement agencies around the world. SMSGlobal’s corporate structure is based largely in Australia through SMSGlobal Investments Pty Ltd, SMSGlobal Holdings and SMSGlobal Pty Ltd.
The beneficial owner and chief executive is the Australian Carl Krumins, who was nominated in 2013 for the Ernst & Young entrepreneur of the year award.
Etihad uses SMSGlobal to provide authorisations for its pilots before their planes take off, and the Australian defence department has signed an A$80,000 contractwith the company to provide messaging services for its e-health service.
“SMSGlobal makes note that an attempt to send in excess of 4 million SMS messages to +971 UAE numbers was attempted through the compromised accounts,” it said.A letter obtained by the Guardian from SMSGlobal to the Dubai telecommunications company DU following the April 2015 breach said text messages had been received with “malicious content” arising from a number of accounts.
It said the April 2015 breach was attributed to the “use of a brute force attack” to penetrate accounts due to a “number of vulnerabilities” such as that customers’ passwords were not encrypted in SMSGlobal’s database, user accounts were not complicated enough, and an earlier platform’s code was no longer supported.
The letter outlined measures that had been taken to resolve the breach, but said: “There is a risk of brute force attacks continuing and more so that other legacy account credentials may have been compromised. That said SMSGlobal believes that by adding a number of additional security measures we can stop this from happening and/or any SMS from being sent through these attacks.”
The company listed a number of measures it had taken to remedy future breaches, including increasing content filtering, and contacting some customers using a particular type of their service to ask them to change their passwords.
But the letter did not disclose to DU that the company believed the hack was linked to the 2013 security breach.
No comments:
Post a Comment