While complaints about account takeover and fraud attempts through online messaging applications have increased recently, experts warned that phone operating systems and applications should be updated regularly to protect against such attempts.
With dangerous cyber attacks targeting iPhone users and the popular messaging application WhatsApp, around the world and in Türkiye, personal accounts are infiltrated and past correspondences are analyzed.
With the spyware in question, the victim's speaking style is followed exactly. Then, a message is sent to the victims' relatives under the pretext of "urgent debt" and they ask for money via IBAN.
Commenting on the issue to the AA correspondent, Lecturer İbrahim Gündüzgil, Head of the Cyber Security Program at Istanbul Commerce University Vocational School, stated that in these incidents, attackers generally try to gain access to users' accounts through fake links, phishing methods and social engineering techniques, and added: "Vulnerabilities in applications or operating systems that are not updated can also be exploited by attackers. Out-of-date operating systems and applications may pose an additional risk in terms of exploiting known security vulnerabilities." he said.
Stating that such attacks are not limited to WhatsApp, but also make it possible to take over accounts or active sessions in Telegram and similar messaging applications through different methods, Gündüzgil said that the problem may arise not only from a specific application, but also from exploiting technical vulnerabilities and user behavior together.
"Updates are very important in terms of fixing security vulnerabilities"
Gündüzgil warned users to first enable additional security features such as two-step verification in messaging applications in order to avoid these grievances.
Pointing out that the verification codes received via SMS or application should not be shared with others, Gündüzgil said, "The operating systems of the phones and the applications used should be updated regularly. Updates not only offer new features but are also very important in eliminating detected security vulnerabilities." he said.
Gündüzgil pointed out that the access of unrecognized devices should be terminated by checking the connected devices and active sessions in the applications.
Gündüzgil stated that the identity of the person sending the message should be verified with a different communication method, especially in requests for money from people they know, and added: "It is important for users who suspect that their account has been compromised to initiate account recovery steps without delay and inform their close circle." he said.
"It is caused by devices that are not updated"
Gündüzgil stated that the hijacking of messaging accounts is not limited to a specific operating system, and that Android and iOS users can also be the target of such attacks.
Gündüzgil stated that they have recently received applications stating that the WhatsApp accounts of device users with iOS operating system have been compromised and said, "In our studies, it is seen that the problem here is caused by devices that have not been updated to the iOS operating system." made the statement.
Gündüzgil reminded that WhatsApp Web, Telegram Desktop and similar applications enable users to access their messaging accounts via computers, and said that this feature brings with it some risks in terms of account security.
Stating that sessions left open on untrusted computers, attacks carried out through malicious software and fake QR codes cause unauthorized access to accounts, Gündüzgil said, "While the user continues to use the messaging application on his phone normally, the attacker can access the account through a different device. This situation may not be noticed by the user. Therefore, users need to check the security of not only their phones but also the computers and other devices connected to their accounts." he said.
"If possible, the device should not be reset and applications should not be deleted"
Istanbul Commerce University Vocational School Computer Programming Program Head Lecturer Sabri Erdemir also pointed out that it is important to protect digital evidence when users are exposed to this situation and said, "Screenshots of suspicious messages, sent links, phone numbers, money transfer receipts, if there are bank account information from which money is requested, and the date and time information of the incident should be preserved." he said.
Erdemir said that if remote access is suspected, disconnecting the device from the internet can be an important measure to limit the attacker's ongoing intervention and help protect digital evidence, and emphasized that in cases where only the messaging account is compromised, cutting off the internet connection may not prevent the attacker from accessing the account via a different device.
Erdemir pointed out that in such cases, device security and account security should be evaluated separately and made the following suggestions:
"If possible, the device should not be reset, applications should not be deleted, and transactions that may cause the loss of existing records should be avoided. In case of financial loss, the relevant bank should be contacted without delay and requested to report the suspicious transaction and initiate procedures to stop or reverse the money transfer. However, it is of great importance that people whose messaging accounts have been seized, contact the Chief Public Prosecutor's Office or the police and gendarmerie units with the digital evidence in their possession and have the situation officially recorded, even if there is no financial loss. Because the seized "Accounts can be used by attackers in different fraudulent activities in the future. Therefore, reporting the incident to the competent authorities without delay will both contribute to the investigation of the attack and create an important record that can reveal that the account holder has previously suffered from actions that may have been carried out without his knowledge and will."
- "It is possible to identify the perpetrators as a result of correlating the evidence."
Erdemir said that in such cases, criminal liability is evaluated within the framework of the actions of the people who committed the unlawful act and participated in the crime, and that the seizure of a person's messaging account does not automatically make that person responsible for the fraud.
Stating that detecting attackers is possible through digital forensic examination and forensic investigation processes, Erdemir said, "In this context, digital traces such as access and session records of accounts, IP addresses, data on devices used, bank account movements and money transfers can be examined." made the statement.
Erdemir stated that the money transfer as a result of fraud, the accounts to which the money was transferred if it occurred, and subsequent financial movements can provide important information for the investigation, but the detection of an IP address or bank account alone does not mean that the person who committed the crime has been definitively identified.
Reiterating the importance of evaluating this information together with other digital evidence, Erdemir said, "Although the use of different techniques by the attackers to hide their identities may make the detection process difficult, it is possible to identify the perpetrators as a result of obtaining appropriate digital evidence and associating this evidence with each other." he said.
