fidzu : debian

In discussion about my post on banks and phones [1] questions were asked about CEO impersonation (link to an article on the security blog Krebs on Security about it) [2].

CEO fraud (or more generally executive fraud) is a subset of Business Email Compromise fraud which allegedly loses Australian businesses $84M/year [3]. The numbers vary a lot depending on what is counted, is it just attacks where money is lost or do situations where the bank reverses the transaction count? There's a lot of secrecy around this because of reputation issues related to fraud, a company that gets defrauded might be regarded as an unreliable business partner. Also in terms of interpreting results there are organisations that want to promote the idea that "it's a major crime that could cost you everything unless you pay us to improve your security".

My experience of these things is that at one company I worked for someone had gained access to an executive mailbox and setup rules to move mail from certain senders to a mailbox that wouldn't be checked (maybe .Sent or .Spam or something - I can't remember the details) as well as forwarding it to an address the attacker controlled. That meant that the executive wouldn't see email from the scam targets while the email gets forwarded to the attackers. At the time it appeared that Office 365 didn't have any features for sending automatic audit alerts for such changes. I think that all changes to executive email accounts should trigger alerts to the corporate security team (in that case me). One would hope that such exploitation would be a major wake-up call for the company but it wasn't. It was never discovered how the attacker got access to the account, I presume it was by compromising a personal computer of the executive which they used for company purposes. Having a strong separation of hardware used for work and hardware for personal use is a really good thing.

At the same company every time the CEO went on a scheduled trip there would be email sent impersonating him claiming that money needed to be transferred. It was never discovered how the attackers knew when he was on a trip. Was the CEO telling people on LinkedIn about his plans or something? Was his calendar shared to someone outside the company? Was there an employee leaking information? We never found out and surprisingly the executive team didn't think this was a problem. It's not necessarily bad for the CEO to publicise their trips even if that alerts hostile parties, but everyone needs to know what the situation is. An unexplained attack is more concerning than a known attack that can be predicted and dealt with.

The role of CEO has a unique combination of being able to authorise funds transfers while also being able to reject other security methods. You can tell a line manager that they need to follow the process for a $10 purchase but you can't necessarily tell the CEO that they need to follow the process for $100,000. Even if the CEO always follows the process for funds transfers you have to convince all the people involved in funds transfers that the CEO will follow the process and any unexpected email demanding an immediate transfer should be rejected.

A final problem is getting executives to understand the importance of computer security. My experience is that getting a CTO to adhere to good security practices can be a challenge and that even on the rare occasions someone like me gets to communicate with the CEO it's not possible to convince them to change anything.

Most computer security problems end up as people problems.

• [1] https://etbe.coker.com.au/2026/10/25/banks-phones/
• [2] https://tinyurl.com/j3byjek
• [3] https://ezyshield.com.au/threats/ceo-fraud/

26 Oct 2026 4:09am GMT

The Problem

For years there have been ongoing issues with SMS being used as a security mechanism for important things including financial services. The problem with this is that access to a phone number is not very well secured, the business model of phone stores is based on having a price of service that doesn't allow the amounts of money spent on security and training that organisations such as banks can spend and are legally required to spend.

The way things work now is that SMS is a second factor of authentication for banks and other traditional financial companies as well as for services involving cryptocurrencies such as bitcoin. To gain unauthorised access to SMS an attacker can physically steal a phone or SIM or they can trick an employee of a phone store into replacing the SIM or attack the computers of the telco to gain access to replace SIMs.

SMS authentication is also used for many services which have indirect access to financial service. For example when I'm employed in a sysadmin role I may get given admin access to the email server used for the CEO's email and have it default to using the phone number of my personal phone for authentication. So while my personal phone doesn't give the potential for defrauding much money I own it does give the potential for being used for defrauding however much money the CEO can authorise which may be significantly greater than my net worth.

Hardware Security Devices

The best thing to do for securing such things is to use hardware security devices like FIDO keys, of which there is a wide range that cost less than $50. The problem with acceptance of such things is lack of general knowledge and lack of forced requirements to use them.

The vast majority of banks (including all banks in Australia AFAIK) have chosen not to require hardware security devices because of the cost. It has been widely claimed that 20% of the customers of a typical bank make 120% of the profit - 80% of the customers lose money for the bank. While I'm not in a position to know the accuracy of that most banks seem to have implemented monthly fees for accounts below a certain minimum balance to discourage less profitable customers. If there were banking regulations requiring hardware security devices then the costs would be passed on to people who really can't afford an extra $50 per year in banking fees to pay for it.

It might be a good option for the government to require personal presence at the bank or a hardware security device for transfers of more than $1000. That would allow kids and minimum wage workers to have bank accounts without excessive fees while forcing a higher level of security for larger transfers.

I really should use the hardware security devices I own more, although they are mostly only usable on systems I run.

Improving Phone Store Security

The problems of employees of phone stores being tricked or bribed to giving attackers access to someone's phone service could be addressed by introducing new regulations about security at phone stores. I think this isn't a viable option as the amount of work required to develop new procedures, train staff, and implement more secure systems is significant. Also the stores used for selling phones aren't the type of secure buildings that are used for banks so some construction work would be required and many phone stores in small towns would no longer be economically viable and would be shut down.

I think we should have legislation to require better security for phone stores as there is a lot of scope to do things better without the expense of bank type security. Crimes that involve stealing phone service don't just hurt people who want a regular phone service, they hurt the community by facilitating other crimes.

How Virtual Telcos Work

In Australia there are 3 companies providing the full mobile phone service, Telstra, TPG (which bought Vodafone), and Optus. There are many "virtual telcos" that use those services. The virtual telcos are companies that will sell a phone service but use one of the 3 companies to provide the actual connection. The backend mobile service run by the big 3 has appeared to be secure, but probably doesn't have the "protect $200m of bitcoin" level of security.

When you get a phone service you are issued a SIM or given a QR code for an eSIM by a company that has SIMs issued by the big 3. That company can then replace your SIM if it's damaged, lost, or stolen by using a level of security that it deems appropriate, which probably isn't very secure. Most of the news about SIM swapping attacks comes from other countries and it's shown that the security of virtual telcos in the US is quite insecure and probably Australian companies aren't any better.

To transfer a service to another virtual telco you used to be able to do it with just knowing the invoice number of your last invoice but in recent times you receive a SMS on your old SIM to confirm that you wish to change. That could be viable for any crime that involves stealing a phone today and stealing money tomorrow. But for most attacks that involve stealing a phone number transferring to a different virtual telco isn't a good option.

Another possibility for crime that I haven't seen reported yet is to steal eSIMs. It's unreasonably difficult (although not impossible) to steal an eSIM once it's installed in a phone. But stealing an eSIM before it gets installed is much easier. Kogan and Aldi email eSIMs to customers which is very vulnerable to attack and should be illegal. Telstra and Optus use an app to install an eSIM which could be quite secure if implemented properly. TPG uses a web page and QR code or an app which again could be quite secure.

Currently the iPhone 17 Air is apparently the only phone released world-wide without support for physical SIMs. When phones that have no support for physical SIMs become common people may have to make the security of eSIM delivery a factor when choosing a telco.

Banks as Virtual Telcos or SIM Providers

I think that in the near future the best thing to do to improve security involving the phone system would be to have the banks run virtual telco businesses or manage the supply of SIMs for virtual telcos. Then getting a SIM replaced would require the same security as changing access to a bank account and a lot of problems related to stealing phone service would be solved. Banks wouldn't need to provide all phone services, just services to customers who want to use it which would be everyone who considers themself to be at risk of fraud.

I don't think that this would be a great solution, but I think it's better than anything else that's likely to get used by a sufficient number of people in the near future.

What Will Happen

This blog post is mostly a thought experiment on ways of improving overall computer security in society. It can be read as advocacy for hardware security tokens. I don't expect anything to be done to improve these issues.

I expect that banks will continue with their current security mechanisms (including SMS authentication) and just accepting a certain amount of fraud as the cost of doing business. For large fraud they can try to claw the money back or blame the customer to avoid having to pay. It's not impossible to solve these things, I had a hardware device issued to me by a Dutch bank about 25 years ago but countries like Australia and the US are much more than 25 years behind.

I expect most people to regard whatever security they have on their bank account to be sufficient and that they will be happy to use the same for everything else. So we will continue to have things like SMS on a personal phone used to secure important corporate access to data and then people will be shocked when something goes wrong.

To make things even more exciting if a criminal takes over the phone number of the sysadmin to access the CEO's email then there may be no-one to call to get the access restored.

We can add rampant financial fraud to the list for the AI related world economic crash that's about to happen.

25 Oct 2026 12:55pm GMT

The diffoscope maintainers are pleased to announce the release of diffoscope version 335. This version includes the following changes:

[ Chris Lamb ]
* Support the dumppdf binary being called dumppdf.py on the host system.
* Update copyright years.
* Fix a silly "prepend" typo.

You find out more by visiting the project homepage.

23 Oct 2026 12:00am GMT