How can SMS spoofing be detected?

Question

SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as users, or the providers themselves, detect illegitimate SMS spoofing?

Answer 1

The best way to detect if the message was spoof or not is to check the message-center. Normally, a spoofed source will have the message-center shows different gateway from the network of the gateway where the originating source is.

Ex.

Spoofed ID: VERIZON Message-centre: +927566004455

Original ID: VERIZON Message-centre: +181800001111

got it?

Answer 2

The problem is the protocol does not involve identity validation. So the only way to be sure, is to do the same as we do with email. Sign them with GPG.

Answer 3

Typically there are some tell signs you can look for in SMS spoofed messages:

• They come written in your non-native language (for non-english users)
• They appear to be coming from someone stored in your contact-list. They do however not exist in your contact list; often illustrated by a grey name instead of a blue name which is clickable.
• They require you to contact them back on phone or email, instead of actually replying to the SMS
• They play you on something beneficial for you, urging you to overlook the warning signs above.

Example phising message follows. Try notice the tell signs:

Answer 4

From an end-user perspective it's often very hard or impossible to detect spoofed SMS.

This all depends on the configuration done by the various operators. As John mentioned, you might be able to tell it from the message-centre (SMSC addr), but again this is eg. changed in various routing scenarios and is not a secure source of information. As Karrax says, it's more about understanding the common types of SMS spoofs.