1

As I read here and there, it seems like SMS isn't encrypted. Let's say I live in an appartment building. If someone uses a cellular modem to intercept my SMS messages, can they determine my name from the phone number and the personnal information within the SMS data? Also, can they send other SMS for free by spoofing my phone number?

*Assume that I never send my name over SMS.

4
  • 4
    Cellular data is encrypted, it isn't like unencrypted Wifi where everyone can listen to everyone elses' packets.
    – ThoriumBR
    Jun 26, 2022 at 13:27
  • Yeah, that sounds right. I probably read some basic google misinformation. I literally typed "is sms encrypted" and the first result that came up said "sms messages are not encrypted" in bold. I should have just read more about it before asking.
    – user123
    Jun 26, 2022 at 15:13
  • Is it secure though? I read that police have stingray devices that intercept phone calls and SMS. Does that only give them a time stamp along with who you called or the whole messages or everything is encrypted and they see nothing?
    – user123
    Jun 26, 2022 at 15:24
  • @user123 as long as you live in a state under the rule of law there's nothing you should afraid of in that regard. A warrant is usually needed for the police if you're doing something potentially malicious. Again, this only is true as long as the rule of law is correctly executed.. Jun 26, 2022 at 16:45

2 Answers 2

1

SMS messages can be redirected and silently intercepted using flaws in the SS7 protocol. That's why the NIST recommends not to use SMS for 2FA.

However, this attacks does not rely on intercepting the radio signal, it can be done remotely over internet. Your neighbor would not have an advantage for this attack. Also, this attack does not enable an attacker to bill SMS to your account at your mobile provider. To bill their SMS messages to your account, your SIM card is required, and that's the main purpose of the SIM card.

What your neighbor can do, however, is using an IMSI-catcher to intercept the radio communications and attempt to force your phone to use weaker or no encryption in order to decrypt your communications. You can prevent it by disabling older protocols (GSM, 2G) in your phone settings. For this attack to work, your neighbor will need to know your phone number or use multiple IMSI-catchers and to triangulate the positions of the phones at proximity and find yours using your address.

Today IMSI-catchers are mainly used to locate specific phones and their users, not to intercept their communications. This can be used for example by the police to identify suspects, or to identify participants to public protests against the local government (the legality of such use depends on the country).

0

You are asking several questions at once. When you say SMS I assume we're talking about GSM traffic here.

  1. Anyone can very easily spoof your phone number on outgoing calls. It doesn't take a lot to make your phone number or any phone number you like (including 911, the number of the local police station, you name it) appear on the display of a call being made. Yet this has nothing to do with SMS.

  2. Can an attacker hijack your phone number, i.e. accept your calls and / or read your SMSs? This is not impossible yet it either requires very special equipment: I am not sure if IMSI catchers will still work these days, yet they may.

  3. Can somelink link your phone number to your name? Sure. There is a myriad of ways of doing so, yet they have little to do with direct attacks against your phone. Yet this would be more of a data protection then an IT security question. (If I store your phone number in my contacts, add your name to it and I then sign up to WhatsApp, Meta at least will have a link between name and phone number. How hard it will be for 3rd parties to use this kind of information is a separate story.

Please also note that in many juridictions, there is something known as "legal interception". That means GSM operators are obliged by law to provide authorities with access to exactly the kind of "tracing you" you are afraid of. To what extend you trust the operators that these means will only be used in a lawful way is up to you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .