SIM Swap Threats: Telecom Vulnerabilities and Account Takeover in Wartime

SIM swapping—convincing or coercing a mobile carrier to transfer a target's phone number to a SIM card controlled by an attacker—exploits the telecommunications infrastructure's fundamental reliance on phone numbers as identity anchors. Once an attacker controls a victim's phone number, they can intercept SMS-based two-factor authentication (2FA) codes, reset passwords on linked accounts, and take control of banking, email, government, and communication services. In the context of the Russo-Ukrainian war, SIM swap attacks represent a low-technical-complexity pathway to account takeover for high-value targets among Ukrainian officials, journalists, civil society, and military personnel—a pathway that supplements more technically sophisticated intrusion campaigns.

Anatomy of a SIM Swap Attack

SIM swaps succeed through several pathways. Social engineering targets carrier customer service representatives, with attackers impersonating the victim and providing personally identifying information (name, address, partial account numbers, answers to security questions) obtained through data breaches or open-source intelligence. Corrupt telecoms insiders—particularly a concern for networks in or near conflict areas—can process unauthorized SIM transfers directly. SS7 protocol exploitation enables remote number redirection without physical SIM changes by manipulating the signaling infrastructure that routes calls and texts between carriers. Each method delivers the same result: the victim's number rings on the attacker's device, and their messages (including 2FA codes) are delivered to the attacker.

SIM Swap Attack Vectors and Risk Factors

Impact on Ukrainian High-Value Targets

Ukrainian government officials, military commanders, and civil society leaders face elevated SIM swap risk because their identities are publicly known and their accounts are high-value targets for adversarial intelligence collection. The Ukrainian telecommunications sector's experience under Russian cyber pressure has included reports of social engineering attempts targeting carrier representatives. The consequence of a successful SIM swap against a ministry official could include access to government email accounts, secure messaging accounts, banking services, and potentially access to systems where the compromised account has secondary authentication capability. Ukraine's IT Army volunteers and hacktivist leadership similarly face SIM swap risk, given the value of their coordination accounts to adversaries attempting to disrupt Ukrainian cyber operations or identify participants for targeting.

SS7 Vulnerabilities and Telecom Security Gaps

The SS7 signaling protocol, designed in 1975, was built for a telecommunications ecosystem where all participants were presumed trustworthy national carriers. The protocol's architecture does not authenticate message sources, enabling any entity with SS7 network access—including criminal groups who purchase access from rogue carriers, and nation-state agencies with direct network access—to send network messages that redirect calls, forward texts, and track subscriber location. Research by Karsten Nohl and others has repeatedly demonstrated that SS7 vulnerabilities remain unpatched at a network protocol level because the fix requires industry-wide coordination among thousands of carriers. Partial mitigations include SMS traffic firewalls that carriers can deploy to filter anomalous SS7 messages, though deployment has been inconsistent globally.

Countermeasures and SIM Swap Resistance

Effective SIM swap defense centers on removing SMS-based 2FA from high-value account authentication. Hardware security keys (FIDO2/U2F) such as YubiKeys provide phishing-resistant authentication that cannot be intercepted via SIM swap, since authentication requires physical possession of the hardware token. Time-based one-time password (TOTP) authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) provide significantly better security than SMS 2FA—they are not delivered via telecom networks and are not affected by SIM swaps, though they remain vulnerable to real-time phishing. Account-level carrier PINs and port freeze requests (blocking SIM transfers without in-person identity verification) reduce social engineering risk at carrier level. For highest-risk individuals, using a dedicated phone number for 2FA that is never shared or publicly associated with the user's identity limits the attacker's ability to target the authentication number through social engineering.

FAQ

What is a SIM swap attack?

A SIM swap (or SIM hijacking) attack involves an attacker convincing or coercing a mobile carrier to transfer a victim's phone number to a SIM card the attacker controls. This allows them to receive SMS messages and calls intended for the victim, including two-factor authentication codes used to access online accounts.

Why is SMS-based 2FA vulnerable?

SMS-based 2FA routes authentication codes through the phone network, which can be intercepted via SIM swap attacks, SS7 exploitation, or malware on the device. Unlike app-based or hardware-key authentication, SMS codes are delivered through infrastructure accessible to attackers with carrier-level access or network protocol knowledge.

What is the best alternative to SMS 2FA?

Hardware security keys (YubiKey, Google Titan) using FIDO2/U2F protocols offer the strongest protection—they require physical possession and tie authentication to specific websites, preventing phishing. TOTP authenticator apps (Google Authenticator, Authy) offer stronger security than SMS and are immune to SIM swaps, though they can be compromised by real-time phishing attacks.

Can SS7 attacks be prevented by users?

Individual users cannot prevent SS7 exploitation, which requires carrier-level network changes. Users can mitigate impact by not relying on SMS for authentication. Service providers can deploy SS7 firewalls to filter anomalous traffic, though adoption across the global carrier ecosystem remains incomplete.

How can telecom customers protect against SIM swaps?

Carriers typically offer account-level security options including a PIN/passcode required for any account changes, port freeze requests blocking transfers, and callback verification procedures. Enabling these features and using a non-public phone number exclusively for authentication further reduces social engineering risk.

Sources

1. Nohl, K. et al., "Rooting SIM Cards," Black Hat USA, 2013; SS7 Security Research, 2014-2022
2. FTC, "What to Know About SIM Swap Scams," 2023
3. Access Now, "Protecting High-Risk Users: SIM Security Guidance," 2022
4. EFF, "Two-Factor Authentication: What You Need to Know," 2023
5. CISA, "More Than a Password: Phishing-Resistant MFA," 2022