1

I don't know much about security and don't know if these things are possible or not.

Last night I received a text message stating "Please use ****** to authenticate your phone number in the DIGITS from T-Mobile app"

I looked up information about the DIGITS from T-Mobile app and it looks like this is the message you are sent when you try to register a phone number with it. I don't have a T-Mobile SIM card and did not try registering it with this app, so it seems that somebody else has tried to.

I believe it could be an honest mistake, that somebody may have fat-fingered my phone number instead of theirs, but in case it was intentional, is it possible for this person to successfully spoof my number? If they were able to register it with DIGITS, then they will receive any future text messages, which is particularly concerning because I have a number of accounts who use 2-factor authentication via SMS. And is there anything I can do to either prevent my number from being spoofed, or at the very least, to protect myself in the event of my number being spoofed?

Anything at all to help me understand security better and to protect myself is very welcome!

Improve this question
2
  • Another note on IMSI catchers - While the other user said there weren't any Wikipedia articles on the topic in English, there actually are! Here's an article on the Stingray, a certain brand of IMSI catcher which became famous as its use became widely known, and here's a general Wikipedia article covering all IMSI Catchers.
    – Pad Brogrammer
    Jun 7, 2017 at 22:46
  • 1
    It's sad to see that T-Mobile sent the authentication text to an non T-Mobile number despite them being able to check whether the number is theirs before sending the text. Yet another example of incompetence and stupidity from the telecom industry.
    – André Borie
    Jun 8, 2017 at 9:22

3 Answers 3

Reset to default
2

As a 'consumer', you can get a HackRF One, and run OpenBTS on your PC. You can make your own low-power IMSI-catcher, but more interestingly you can view most of the physical layer stuff of mobile networks. You can view the signal strength of towers and peers. You can make your PC beep if some parameters change. OpenBTS is very well-documented. Don't worry too much though, just assume pwnage and act accordingly.

Use OpenVPN/Opera VPN, and additionally use Wire/WhatsApp/Signal/Facetime/iMessage/etc for calls and messaging, don't use normal SMS and voicecalls. You can't stop IMSI-catchers with off-the-shelf phones anyway, and one individual with a HackRF can snoop on your old-world calls and texts, after downgrading you to 2G/GSM. Who you gonna call?

Improve this answer
3
  • This seems like it will be a good educational tool. Thanks! I already use WhatsApp for all of my communication. A number of my accounts which have 2FA use SMS based authentication instead of an authenticator app like Authy, unfortunately. Good to at least know that I can't stop IMSI-catchers.I guess I should try contacting T-Mobile to find out if somebody was somebody registered my phone number with their DIGITS app.
    – Iceape
    Jun 8, 2017 at 6:43
  • @Iceape Then upvote and select 'answer'. It is the christian thing to do.
    – user2497
    Jun 8, 2017 at 7:18
  • Iceape can't upvote, since a reputation of 15 is needed.
    – Mok-Kong Shen
    Jun 8, 2017 at 7:48
0

To respond to the 1st half of the last line of your OP: There are the so-called IMSI-Catchers, i.e. faked towers of the cellular network that could be established by hacking criminals (besides by law enforcement etc.). A wiki article in German is de.wikipedia.org/wiki/IMSI.Catcher. (There seems to be no corresponding English wiki article.)

Improve this answer
2
0

The only solution is to not rely on the mobile network's ability to protect your calls and texts because they can't with the current legacy technologies they use and they're not really interested in upgrading any of it (to a telecoms provider "security" is about someone making free calls and hurting their profits - security of customer's data is not their priority).

Use the mobile network as a dumb network connection and assume someone is listening in at all times, which means encrypted protocols are necessary. Most of your data traffic is encrypted anyway (HTTPS, etc) so you don't have to worry about it. For voice, get yourself a VoIP number from a provider that supports encrypted connections (SIP over TLS with SRTP) and use it instead. You won't solve the problem of number spoofing (which is someone else pretending to be your number for outgoing calls and texts) but will prevent someone from intercepting your own calls and texts since they will be encrypted up to your VoIP provider. IMSI catchers will only see encrypted data traffic they won't be able to make sense of.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .