Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as users, or the providers themselves, detect illegitimate SMS spoofing?

share|improve this question
add comment

4 Answers 4

up vote 3 down vote accepted

The best way to detect if the message was spoof or not is to check the message-center. Normally, a spoofed source will have the message-center shows different gateway from the network of the gateway where the originating source is.

Ex.

Spoofed ID: VERIZON Message-centre: +927566004455

Original ID: VERIZON Message-centre: +181800001111

got it?

share|improve this answer
1  
Is it correct that in order to find this information you would have to contact your network provider? –  Chris Andrè Dale Mar 11 '13 at 7:57
add comment

The problem is the protocol does not involve identity validation. So the only way to be sure, is to do the same as we do with email. Sign them with GPG.

share|improve this answer
add comment

From an end-user perspective it's often very hard or impossible to detect spoofed SMS.

This all depends on the configuration done by the various operators. As John mentioned, you might be able to tell it from the message-centre (SMSC addr), but again this is eg. changed in various routing scenarios and is not a secure source of information. As Karrax says, it's more about understanding the common types of SMS spoofs.

share|improve this answer
    
Also worth mentioning is eg. Symsofts "SMS Firewall" which can filter based on stuff from rules to limit the number of SMS per hour for a specific SMSC, to analysis of content and originating IMSI and MSISDN. –  Andy Thompson May 22 '13 at 7:17
add comment

Typically there are some tell signs you can look for in SMS spoofed messages:

  • They come written in your non-native language (for non-english users)
  • They appear to be coming from someone stored in your contact-list. They do however not exist in your contact list; often illustrated by a grey name instead of a blue name which is clickable.
  • They require you to contact them back on phone or email, instead of actually replying to the SMS
  • They play you on something beneficial for you, urging you to overlook the warning signs above.

Example phising message follows. Try notice the tell signs:

sms phising

share|improve this answer
    
Yes, I believe this is a visual indicator, but there must be something from the data that can serve as a proof that the message was spoofed rather than just relying on the way it was constructed. Just like validating an email content, looking at the header is important as well.. –  John Santos Sep 12 '12 at 9:16
    
I would say that these are tell-tale signs for spam or phishing messages but not a list of ways to detect SMS spoofing. A text from a non-native english speaking friend saying they have a spare ticket for a concert and asking me to call them would tick 3 of the 4 :) –  Andy Smith Sep 27 '12 at 13:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.