4

I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages.

My goal was to have a dedicated DID/number which I don't publish publicly that receives SMS messages, such that socially engineering access to my primary mobile phone number won't grant an attacker access to my 2FA SMS.

(And yes, I would rather use TOTP. Sadly, some vendors only offer SMS, and won't SMS to a VoIP number)

How do online services determine if a number is VoIP or a true mobile provider? If I port a Canadian VoIP number to a mobile carrier will I be able to receive such messages or will I permanently limit my options by continuing to use this number?

2 Answers 2

3

In delivering a 2FA SMS, the SMS infrastructure [1] of the sending party (Twilio, Vonage, etc.) reaches out to the SMS infrastructure of the receiving number [2]. For this to work, the 2FA SMS service necessarily needs to know who the receiving service is, and how to reach it. It does this through a lookup to a Home Location Register or 'HLR' [3]. This provides the routing info needed (think of it as a DNS lookup).

A metadata lookup using this info to a second database then answers questions like 'What's the human readable carrier name' and 'Is this a VoIP number?' [4]. Given these attributes, the 2FA provider or customer app can decide not to deliver the SMS. See the twilio docs for an example of what this looks like in practice.

I cannot answer the number porting question. Though if these systems work anything like IP/email reputation services do, I wouldn't risk it, as they tend to be 'sticky'.

[1]: the Short Message Service Center or 'SMSC', see https://www.cspsprotocol.com/smsc/ or https://en.m.wikipedia.org/wiki/Short_Message_service_center

[2]: The receiving SMSC depends on who services your number, not who you bought your number from or any prefix.

[3]: See https://www.cspsprotocol.com/hlr or https://en.m.wikipedia.org/wiki/Network_switching_subsystem#HLR

[4]: I didn't figure out how such a database works in detail, though I can think of at least one way to built one: step 1) as the database provider, buy sms numbers/services from all SMS providers you can find (both VoIP and mobile), step 2) send an sms to each number and take note of the receicing SMSC, step 3) compile the SMSC to provider attribute database. I imagine it might be similar to GeoIP/VPN databases, which are also fallible and a best-effort kind of thing.

1

In a manner similar to how some online services detect VPNs based on known VPN IP address databases, VoIP numbers come in batches that have known prefixes within each area code. Certain providers choose not to allow VoIP numbers for verification because they can be obtained and accessed from anywhere in the world, and are harder to tie to real people, locations or accounts, and are easier to change or dispose of. Some service providers also do not want to be liable for fraud committed by intercepting SMS messages while they are in the IP domain. Intercepting a text message on a cellular network is much more difficult than on a hijacked VoIP account. An attacker does not have to physically obtain the device (like stealing a mobile phone) on a VoIP account, just obtain login credentials.

1
  • It's worth noting that this doesn't really answer the question. For example, I ported a number from a VoIP IP range to a mobile and have never had any issues getting services to accept it as a mobile number, while the same number +1 (same NPA-NXX) is refused. Similarly when I ported a number from a mobile provider to VoIP, services already registered typically still could send SMS (but not always), but I could not add that number anymore.
    – TheDave
    Jul 13, 2023 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .