0
votes
2answers
114 views

Is it safe to rely on text messages as a means on authentication?

Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
18
votes
5answers
2k views

Are SMS,MMS stored on the network service providers' servers?

Are SMS and MMS sent via a mobile phone stored on telecommunication service providers' servers before passing them to the recipient? Does it depend on the country or does every network service ...
0
votes
1answer
71 views

Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections. This site is full of ...
28
votes
1answer
2k views

How does a new SMS message overwrite a previous one?

During a talk from a vendor, the speaker mentioned that their product used a "little known feature" of SMS in order to overwrite the last text message received from them. This feature was being used ...
8
votes
4answers
7k views

How can SMS spoofing be detected?

SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as ...
1
vote
0answers
109 views

What's the deal with SMS archiving? [closed]

The other week I was texting a friend of mine, and something happened that I haven't experienced before. Instead of receiving the text I'd just sent, my friend received a text I sent several months ...
27
votes
5answers
12k views

What is preventing us from sniffing the mobile phone communcation?

I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
5
votes
1answer
290 views

SMS PDU specification and carving techniques?

I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on dreamfabric.com, but I'm having some trouble. First of all, the specification isn't ...
5
votes
3answers
2k views

Proof of SIM card possession on iOS devices

I need to proof that a user of my app is in possession of the correct SIM card. On android devices, this is possible by simply sending a challenge within an SMS to the corresponding number (the proof ...
3
votes
2answers
1k views

SMS / voice call interception with a fake base station

This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
37
votes
6answers
9k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...