How does SMS spoofing work practically?

Question

I have been researching the web for information on how I can spoof an SMS myself, but I seem to find more on how to detect it, or how to use tools to do it rather on how to do it myself.

I have tried websites and apps, that worked perfectly to spoof SMS but websites seem to be able to detect this, so I wanted to dive in to this and maybe enhance it a little bit. How does this spoofing work on a software level, how is a spoofed text message constructed, and how are companies able to detect this?

Answer 1

It depends on where the receiving phone is located.

In the USA, you aren't likely to ever see a spoofed SMS work, it's locked down pretty tight. In other countries though, there is less validation at the carrier level.

Spoofing of any message is usually done by one of 3 ways.

1. Pretending you are a proxy relaying the message for someone else. This is commonly how email spoofing is done, as there's commonly no validation, and email passes through multiple separately controlled networks.
2. Cloning a legitimate users credentials and pretending to be them, so that the service provider believes it's a legitimate message from their user.
3. You can run a fake base station - Phones will connect to your base station as it has the strongest signal (if it's closer than a legit tower) then you can spoof any sender address you like. There have been many instances of this happening. For example, in the People's Republic of China where they recently locked up 1600 people for running fake base stations involved in SMS spamming. This only affects the end user the base station is close to, you can't use it to send an SMS to someone across the country.

Answer 2

You simply need a way to send SMS messages that allows you to send a message where you can specify the sender.

As noted in another answer, the US cellular carriers have strict rules in place that make spoofing much harder. Typically, messages sent to US numbers must have a numeric sender (i.e a valid phone number or short code).

In other countries things are less strict. It's quite common for businesses and other organisations to set the sender to the name of the business or product the message relates to.

For legitimate businesses in those other countries, the issue of spam is dealt with by an expectation that the business will ensure the recipient can tell who sent the message. This is less of an issue where the messages are not advertising (e.g. login verification codes).

I use Clockwork SMS (https://www.clockworksms.com/) to send SMS messages programmatically. They have libraries available that can be used to send messages easily from common programming languages like C#, Java and PHP. There are many other providers offering the same sort of service. I can specify any sender that I want for these messages. I don't impersonate anyone in doing so, but it does mean that I can set the sender to be something more meaningful for my applications.

It does also mean that you could use this sort of service to send messages appearing to be from "PayPal" or "Google", asking someone to click a link that will take them to a phishing site.

Answer 3

You simply need a way to send SMS messages that allows you to send a message where you can specify the sender.

That's certainly the easiest way to do it, but having that level of access is tough. My company provides apps and APIs to allow people to send/receive SMS. We do a lot of work to ensure that the "sender" you set is a phone number belonging to you.

We connect directly to SMS aggregators, and they generally don't do much validation on the sender phone number that our platform provides. For example, I can easily send myself a message from a fake number like 15551234567, a toll-free number, someone's mobile or landline, etc.

That said, carriers and aggregators constantly monitor for spam and other odd usage patterns. They will block phone numbers and/or originators of bad traffic. An occasional spoofed message or two could fly under the radar, but it's in the interests of any entities that grant you access to the SMS world to prevent you from sending these types of messages.

tl;dr: Spoofing is possible, but you'll have a hard time finding anyone willing to give you that access, since granting that access could jeopardize their entire business.