0

I was accessing some sites with the Tor browser. I got the URLs from some site and was hitting them one by one just to explore. Suddenly pages stopped responding but the internet was working fine. Then after a minute or two I get a popup from my phone application asking to enter my PIN to complete a transaction. 10 dollars were to be sent to some company-like name. I cancelled that transaction and received a message from the service provider (which shows that it was real).

  • I want to know how my phone application was accessed.
  • Can it still happen?
  • What to do to get rid of it?
  • Antivirus not detecting anything?
1
  • Was the Tor browser on your phone?
    – schroeder
    Dec 22, 2021 at 16:56

2 Answers 2

2

This largely depends on the phone and even your country. What follows might only work as described where I am, in Italy, but the concept ought to be valid planet-wide with relatively minor changes.

Basically, there exist so-called "Value Added Services" that can be accessed through either javascript or HTTPS API calls, hosted on your phone carrier's website. Weather alerts, jingles, gossip news or news alerts.

When I access https://(my carrier)/api/subscribe/{vendor}/{service}, the phone carrier website recognizes my IP and tracks it down to my SIM (it can do this because it is my carrier, and has all my billing information), and validates a VAS subscription on my phone bill. From then on, I'll be billed whatever and whenever the vendor and my provider agreed to (e.g. 5 Euros per week). It is mandatory for the vendor to first show me the contract, ask for confirmation and blah blah and explicitly get my consent, before redirecting me to the VAS subscription. Otherwise, the whole transaction is illegal and void, and if I realize it took place, and if I know that I can, and how, I can appeal within (IIRC) 90 days and get my money back.

But of course a dishonest vendor might register as a VAS supplier with my provider, then just hide a "script src=https://..." in a web page and send it to my phone. Or to my computer connected through a WiFi cellphone router: the SIM that counts is the one on the router, the one that connected to the Internet. Hoping I won't realize, or I won't ask for my money back.

Yes, you were using TOR browser, but it's possible to trick the browser into revealing the true IP. Or it can trigger a DNS request to a DNS server that is in enemy hands, using a unique domain name. Once certain having got your real IP, they can forge a request in your name (some services allow(ed?) the IP to be externally specified, so you could, maybe still can, subscribe someone else entirely).

The carriers, no use saying otherwise, are in on the scam and do as little as possible to make life difficult for scammers. Rather the contrary. They can't actively promote such, but they get their piece of the action, and so they won't proactively inform you or be too keen in supplying you with the necessary defenses.

What happens if you have a 2FA or similar confirmation on your SIM? Exactly what you experienced. The call goes through, but then a confirmation is asked, and since you do not recall having asked anything, you refuse it.

Why does the antivirus not recognize it? Because it is not a virus, it is a Webpage request. And a legitimate webpage request at that: the antivirus has no way of knowing that you did not consent and never even knew the request was being made.

Can it still happen? Yup. Of course.

What to do to get rid of it? You can do nothing. Some of those requests come from advertisement javascript that might be displayed on legitimate pages you know and trust, that merely trusted the ads they are displaying.

But now the useful question: How do I prevent being scammed out of my money, one subscription at a time?. You ensure that no VAS can be subscribed in your name (ask your carrier: I have "VAS block" active on all my SIMs since I, too, was burned), and activate 2FA wherever possible. If the carrier refuses or hasn't VAS block or 2FA, just change carrier.

2
  • "but it's possible to trick the browser into revealing the true IP." - wouldn't that defeat the whole point of the Tor browser?
    – nobody
    Dec 24, 2021 at 17:18
  • @nobody yes, and that's why you want to have an updated browser and Tor routing - so that this kind of tricks don't work ( e.g. this 2017 one, zdnet.com/article/… ). It is theoretically possible, though (we're dealing with SIM modules) that you can issue a subscription request by contacting a virtual HTTP service running on the local host (i.e., the phone/tablet).
    – LSerni
    Dec 25, 2021 at 13:19
0

I am no expert, but:

  1. could it be that the two occurrences don't have a causal connection? I know it seems like it because of the association by time, but that could be random / bad luck.

  2. if 1) is not valid, then maybe your phone number is accessible via your "day to day" (clear web) browser (auto complete), and someone got it in their hands. Even then it would be far more probable that this attack happened on your day to day clear web browser than the tor browser.

Not the answer you're looking for? Browse other questions tagged or ask your own question.