Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.

learn more… | top users | synonyms

1
vote
0answers
41 views

SS7 exploit on the wiretapping part

Wondering if there are info/source code/guide on the SS7 wiretapping part (SMS interception). I had a look on the track any mobile by a German researcher, and on PTsecurity about how the structure ...
10
votes
3answers
174 views

How does SMS spoofing work practically?

I have been researching the web for information on how I can spoof an SMS myself, but I seem to find more on how to detect it, or how to use tools to do it rather on how to do it myself. I have tried ...
4
votes
1answer
72 views

texting password reset link instead of a code

An increasingly common process for assisting with password resets is the application texting a code/token to the user’s verified mobile phone. We have a client which would like to eliminate the need ...
3
votes
1answer
51 views

Security requirements for one time access code/token in the url

I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an ...
7
votes
5answers
184 views

Secure application data transmission via SMS channel

There are mobile banking applications that use SMS channel to communicate with their server. Some of them offer both internet and sms channels which the customer gets to choose from. While there's ...
7
votes
2answers
248 views

mobile number authorization strategy using SMS, best pattern and practices

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
1
vote
4answers
98 views

What is the security of one time login with SMS code?

I am writing a web application and I want to let my users to login by sending one time code to a given number. The code will be received by a GSM module within certain time after it's generation and ...
1
vote
2answers
113 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
7
votes
3answers
135 views

Why do Google 2-factor authentication SMS codes never start with a 0? [closed]

When you use 2-step authentication to log to your Google Account, you can get an SMS on your mobile-phone with a G-123456 style code. I think that I never got a code with a leading zero. Is there a ...
1
vote
1answer
183 views

How to protect against the new malware Mazar Bot?

Mazar Bot is new Android malware that spreads via SMS. Its capabilities: It can read incoming SMS and send itself, make calls to directory contacts, contaminate Chrome, access to the Network, read the ...
2
votes
1answer
111 views

Capturing text messages on the fly

Suppose your phone is not connected to any network. You are sitting in a cafeteria with 50 other people, everyone is communicating to each other via text messages. Is it possible through any device or ...
0
votes
2answers
203 views

Can someone send a text to a phone and make it appear on another person's phone text message?

A friend said her husband was sleeping on the couch, and she got a text that appeared to come from his phone, but he didn't send the text. Is this possible to do, and, how can she trace the origin? ...
5
votes
1answer
93 views

Can I use a satellite phone for 2 factor auth sms and such?

Would 2 factor authentication SMS messages or other kinds of internet security notifications work with satellite phones? E.g. companies like Google, Paypal, Facebook, banking institutions and others ...
1
vote
2answers
285 views

Is it safe to use Google Authenticator app and SMS instead of passwords

I currently want to start web development where I will be making a login system and want an alternative to storing passwords. The question is: is it safe to use the Google Authenticator app as the ...
1
vote
2answers
123 views

Is this spam SMS containing an audio file dangerous?

Yesterday I received a group text message from a number I don't know and opened it by mistake. I was in a group chat with two other people, one in Pennsylvania one in Massachusetts. The message body ...
1
vote
0answers
80 views

How can one tell is a message is spoofed from one phone to another but “about” a third party? [closed]

This question is about whether the source phone number of an SMS message can be spoofed and, if so, what forensic measures might be taken to determine and prove that that has occurred. Assume that a ...
-1
votes
2answers
53 views

How to secure SMS functionlity in web application?

How to secure SMS sending feature in web applications? If an application is using third party SMS gateway then SMS also can be spoofed. Like attacker can change mobile number with firebug and abuse ...
0
votes
3answers
203 views

How can i prevent my phone from spying through sms

Recently while reading up a article over here ,The following were the summary : hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message So based on the ...
1
vote
1answer
94 views

(Theoretically) intercepting GCHQ's smartphone exploit

In the lastest Snowden interview, it was revealed that GCHQ used an exploit sent via SMS to gain access to smartphones, and that this 'exploit' goes unnoticed to the handset user. I was wondering if ...
1
vote
1answer
77 views

Is originating number tied to an SMS from a mobile phone?

I've been working with an SDR (software-defined radio) as part of a computer security class project. We've been wondering if, let's say a mobile phone associates with the SDR (which is operating as a ...
2
votes
2answers
96 views

How can Authenticity be achieved in SMS or Text Messaging?

What tools or information is needed to verify the authenticity of a SMS message... or to send one so that such authenticity is intact? This answer describes something as a "message center", but I'm ...
1
vote
0answers
102 views

Can someone trace the source of a text msg without a phone number, only a four digit code instead?

I am receiving phishing texts from someone claiming to be from Chase Bank. There is no return phone number at the top, only a four digit number instead. The police tell me that this text (which ...
0
votes
1answer
83 views

Google account 2FA only with HW security key?

Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ? It seems that SMS confirmation code is still primary 2FA ...
-3
votes
1answer
104 views

How to sell a new idea – “100% secure communication”, feedback wanted [closed]

I have thought of an idea (new product) to have 100% secure communication between 2 parties and would like your feedback/ideas on how to sell it. Oh, before you start that there is no such thing as ...
4
votes
1answer
120 views

Are “Security SMS codes” any safer than plain SMS?

Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS. Firstly, are ...
1
vote
2answers
126 views

How to deal with SMS spam? [closed]

Every few weeks, I get an annoying SMS trying to sell me something, or trying to get me to click something, or otherwise spamming me. I don't think it's a targeted thing- I think my phone number is ...
-5
votes
2answers
163 views

How do i make a phone number authetication system for my website? [closed]

I really need to prevent users from create multiple accounts. So I was thinking about making a phone number authentication system. Where when a user signs up, a 4 digit code is sent to their phone, ...
1
vote
1answer
93 views

Encode URL in link that will appear on page in plain text?

I need to send a user a link via SMS that when clicked, and then when some demographic info is verified, will allow them to sign up for my service (which is a healthcare portal, so HIPAA/PCI/PII etc). ...
2
votes
3answers
121 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
0
votes
1answer
86 views

Are deleted SMS still retrievable from Android-based phones? [closed]

I'm wondering whether deleted SMS on Android phones are retrievable? If so, how is this done? How can one avoid it?
2
votes
2answers
997 views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
0
votes
1answer
94 views

Is it possible for someone to send messages from my phone and seem like if I send it to them? [closed]

Ok so there's this guy who pays my iPhone6 and lately it's been sending messages to him as if I was the person who typed it but it wasn't me... Does anyone get me? Someone please help!!
3
votes
1answer
52 views

Securing 2 factor data from apps that are co-located on the same device?

Several apps such as GMail, Coinbase, Yahoo and others require the use of the mobile device to gain access to the data within the app. For example Gmail requires TOTP in Google Authenticator ...
2
votes
4answers
166 views

Suspicious SMS getting received on selected browsing

I am receiving several suspicious SMS messages with links telling me that I have requested subscription to their services (which I have not) asking me to confirm subscription. These SMS appear only ...
1
vote
1answer
268 views

What makes an SMS gateway insecure?

Is it specifically something about SMS protocol, the proprietary software used to do message routing, or perhaps an ACL on the server? I would imagine that a gateway accepting emails from anywhere ...
7
votes
1answer
1k views

If I know a currently working exploit to spoof SMS on a major carrier, what should I do? [closed]

This currently works on all iPhones and one known android phone as of today, a formal complaint has been filed with the carrier and the FCC. I doubt they will do anything about it though since this is ...
3
votes
1answer
346 views

Can sms-only authentication be safe?

many Android mobile applications (e.g., Whatsapp, Telegram), when used for the first time on a device, "authenticate" users by sending them a secret code in a SMS message. The same mechanism is used ...
1
vote
1answer
135 views

verify an api call is made from the mobile device [duplicate]

I am developing a webserver and provide an API to be used by mobile clients. Some of my calls are without any authorization, for example, to start the authentication process. Is there a good way/best ...
4
votes
1answer
6k views

SMS Spoofing not available in kali

Has the SMS Spoofing option been removed from the Social Engineering Toolkit ? I run 3.14-kali1-amd64. I get only the options shown below. Tried updating both kali and SET but i still dont get the ...
2
votes
2answers
89 views

Secure alerting for a monitored web application

What is a good method to receive security alerts? Email is the first thing that springs to mind, although it is susceptible to MITM attacks (e.g. an attacker preventing the email from being ...
1
vote
2answers
177 views

Is it safe to rely on text messages as a means on authentication?

Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
2
votes
2answers
21k views

Trace source and destination of an SMS message [closed]

Is it possible to trace the source or destination (location, even coordinates) of an SMS message ? If it is, is it possible to do it even if the phone is roaming in a different country ?
-2
votes
1answer
298 views

Spoofing SMS messages [closed]

I received a message recently on a droid phone that appeared to have originated from an Iphone in my contact list. I was able to look at the Iphone from which the message appeared to have originated ...
1
vote
2answers
2k views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
18
votes
4answers
11k views

Are SMS,MMS stored on the network service providers' servers?

Are SMS and MMS sent via a mobile phone stored on telecommunication service providers' servers before passing them to the recipient? Does it depend on the country or does every network service ...
2
votes
2answers
374 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
3
votes
1answer
173 views

What Information is Exposed When I Send A Message From My Mobile Device

When I send a text message and/or an email, with or without location services turned on, what information is available to the recipient of that message if they know how to read the data behind the ...
3
votes
1answer
133 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
0
votes
1answer
108 views

Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections. This site is full of ...
12
votes
1answer
2k views

TextSecure protocol

Is anyone aware of an analysis of the TextSecure protocol? https://whispersystems.org/blog/simplifying-otr-deniability/ https://github.com/WhisperSystems/TextSecure/wiki/Protocol It is a ...