13

I have been researching the web for information on how I can spoof an SMS myself, but I seem to find more on how to detect it, or how to use tools to do it rather on how to do it myself.

I have tried websites and apps, that worked perfectly to spoof SMS but websites seem to be able to detect this, so I wanted to dive in to this and maybe enhance it a little bit. How does this spoofing work on a software level, how is a spoofed text message constructed, and how are companies able to detect this?

  • 2
    @kieranClaessens: Sorry I couldn't understand what is what you want to enhance? do you want websites not to detect it? BTW, what do you mean by "websites"? I would suggest you to add more details to your question, so its easier for us to help. Also be aware that sending anonymous SMS can be illegal in some countries. – lepe Apr 22 '16 at 3:47
7

It depends on where the receiving phone is located.

In the USA, you aren't likely to ever see a spoofed SMS work, it's locked down pretty tight. In other countries though, there is less validation at the carrier level.

Spoofing of any message is usually done by one of 3 ways.

  1. Pretending you are a proxy relaying the message for someone else. This is commonly how email spoofing is done, as there's commonly no validation, and email passes through multiple separately controlled networks.
  2. Cloning a legitimate users credentials and pretending to be them, so that the service provider believes it's a legitimate message from their user.
  3. You can run a fake base station - Phones will connect to your base station as it has the strongest signal (if it's closer than a legit tower) then you can spoof any sender address you like. There have been many instances of this happening. For example, in the People's Republic of China where they recently locked up 1600 people for running fake base stations involved in SMS spamming. This only affects the end user the base station is close to, you can't use it to send an SMS to someone across the country.
  • 2
    It's too small an edit to make myself, but "effects" in the last sentence should be "affects". – Moshe Katz Apr 27 '16 at 21:52
  • Hmm, I can't seem to edit in the stack exchange app. It's not showing the latest answer text when I click "edit" – Daisetsu Apr 27 '16 at 21:56
  • I've seen that bug in the app, but I don't have a good enough way to reproduce it in order to file a bug report - it only happens to me sometimes. – Moshe Katz Apr 27 '16 at 22:16
  • I submitted something to the meta stackexchange for this. We'll see what turns up. – Daisetsu Apr 27 '16 at 22:26
3

You simply need a way to send SMS messages that allows you to send a message where you can specify the sender.

As noted in another answer, the US cellular carriers have strict rules in place that make spoofing much harder. Typically, messages sent to US numbers must have a numeric sender (i.e a valid phone number or short code).

In other countries things are less strict. It's quite common for businesses and other organisations to set the sender to the name of the business or product the message relates to.

For legitimate businesses in those other countries, the issue of spam is dealt with by an expectation that the business will ensure the recipient can tell who sent the message. This is less of an issue where the messages are not advertising (e.g. login verification codes).

I use Clockwork SMS (https://www.clockworksms.com/) to send SMS messages programmatically. They have libraries available that can be used to send messages easily from common programming languages like C#, Java and PHP. There are many other providers offering the same sort of service. I can specify any sender that I want for these messages. I don't impersonate anyone in doing so, but it does mean that I can set the sender to be something more meaningful for my applications.

It does also mean that you could use this sort of service to send messages appearing to be from "PayPal" or "Google", asking someone to click a link that will take them to a phishing site.

2

You simply need a way to send SMS messages that allows you to send a message where you can specify the sender.

That's certainly the easiest way to do it, but having that level of access is tough. My company provides apps and APIs to allow people to send/receive SMS. We do a lot of work to ensure that the "sender" you set is a phone number belonging to you.

We connect directly to SMS aggregators, and they generally don't do much validation on the sender phone number that our platform provides. For example, I can easily send myself a message from a fake number like 15551234567, a toll-free number, someone's mobile or landline, etc.

That said, carriers and aggregators constantly monitor for spam and other odd usage patterns. They will block phone numbers and/or originators of bad traffic. An occasional spoofed message or two could fly under the radar, but it's in the interests of any entities that grant you access to the SMS world to prevent you from sending these types of messages.

tl;dr: Spoofing is possible, but you'll have a hard time finding anyone willing to give you that access, since granting that access could jeopardize their entire business.

  • Why do you do all that work to make sure of that? Wouldn't your service be more useful without that restriction? How is it in your interest to prevent it? If you enable more ways of using your service, you'll get more business. – flarn2006 Oct 4 '18 at 16:35

protected by Community May 22 at 11:15

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.