{"id":1474,"date":"2026-06-30T10:41:03","date_gmt":"2026-06-30T16:41:03","guid":{"rendered":"https:\/\/www.netjeff.com\/wp\/?p=1474"},"modified":"2026-07-07T18:47:51","modified_gmt":"2026-07-08T00:47:51","slug":"attack-to-get-into-victims-bank-account","status":"publish","type":"post","link":"https:\/\/www.netjeff.com\/wp\/?p=1474","title":{"rendered":"Attack to get into victim&#8217;s bank account"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Today I learned about an interesting way for an attacker, Bob, to get into the Bank account of their victim, Alice.  This attack applies to any sensitive\/financial account, not just banking.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Attacker Bob knows lots of info about Alice, including her account number and password at the Bank used by Alice.<\/li>\n\n\n\n<li>Bob tries to impersonate Alice by logging into her Bank&#8217;s site, using Alice&#8217;s acct &amp; password. But the Bank site calls\/txts to Alice&#8217;s 212-555-0123 with a one-time code.  Bob can&#8217;t see this code, so he&#8217;s blocked on login.<\/li>\n\n\n\n<li>Bob then tries to gain control of Alice&#8217;s 212-555-0123 by tricking Alice&#8217;s phone provider to transfer the number to Bob&#8217;s device (aka <a href=\"https:\/\/en.wikipedia.org\/wiki\/SIM_swap_attack\">SIM jacking<\/a>). But Bob is unsuccessful with this attack.<\/li>\n\n\n\n<li>But Bob has another way to complete his attack, which I just learned about recently. With enough sophistication, Bob can &#8220;trick&#8221; the part of the public phone network between Alice&#8217;s Bank and Alice&#8217;s device, so that the Bank&#8217;s calls\/txts to 212-555-0123 instead go to a device controlled by Bob.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Note that Bob has <span style=\"text-decoration: underline;\">not<\/span> taken control of 212-555-0123, rather Bob has manipulated a part of the phone network such that the Bank&#8217;s calls\/txts end up at Bob&#8217;s device rather than Alice&#8217;s (and also others might be affected).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is clearly a more sophisticated attack than something like <a href=\"https:\/\/en.wikipedia.org\/wiki\/SIM_swap_attack\">SIM jacking<\/a>, so most people don&#8217;t need to be worried too much about this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There is now an <a href=\"https:\/\/www.rfc-editor.org\/info\/rfc9970\/\">RFC 9970<\/a> that attempts to mitigate this attack. Previous RFCs focused on making it much much harder for attacker Bob to <em>impersonate (spoof) the Bank&#8217;s calls\/txts<\/em> to Alice (using cryptographic techniques). This new RFC adds protection <em>in the opposite direction<\/em>, to make it much much harder for the attacker to <em>impersonate (spoof) Alice<\/em>. In other words, this new RFC 9970 can give the Bank much more confidence that the Bank&#8217;s calls\/txts are reaching a <em>device actually controlled by Alice<\/em> (not attacker Bob).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The RFC 9970 uses the following jargon: Improving &#8220;connected identity&#8221; means making it harder for an attacker to impersonate (spoof) the &#8220;called party&#8221; (Alice) to the &#8220;calling party&#8221; (the Bank).   This RFC 9970 tries to improve this &#8220;connected identity&#8221; problem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Of course there is no such thing as &#8220;perfect security&#8221;.   Even with adoption of RFC 9970, a sufficiently motivated attacker can still get into Alice&#8217;s Bank account.  But adoption of this will make it much harder for attackers.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today I learned about an interesting way for an attacker, Bob, to get into the Bank account of their victim, Alice. This attack applies to any sensitive\/financial account, not just banking. Note that Bob has not taken control of 212-555-0123,&#8230; <a href=\"https:\/\/www.netjeff.com\/wp\/?p=1474\" class=\"readmore\">Read more<span class=\"screen-reader-text\">Attack to get into victim&#8217;s bank account<\/span><span class=\"fa fa-angle-double-right\" aria-hidden=\"true\"><\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,5],"tags":[],"class_list":["post-1474","post","type-post","status-publish","format-standard","hentry","category-risk","category-tech","content-layout-full"],"_links":{"self":[{"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1474"}],"version-history":[{"count":7,"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1474\/revisions"}],"predecessor-version":[{"id":1483,"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1474\/revisions\/1483"}],"wp:attachment":[{"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.netjeff.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}