7

This currently works on all iPhones and one known android phone as of today, a formal complaint has been filed with the carrier and the FCC. I doubt they will do anything about it though since this is SMS protocol working as intended, and any particular spoofing technique is not (from what I can tell) interesting, and not a valid bug report.

I also am not a security expert by any means and would like any references to research materials to help me write a formal report on how this is actually working, but I have very little expertise and kind of just stumbled on this. Any known suite of tools also to help me do this would be great.

The exploit is purely software in nature, there is no use of hardware except the phone obviously, I have a feeling that it may be an issue with the carriers email -> SMS gateway, which to me is something they could probably fix.

closed as too broad by RoraΖ, TildalWave, Xander, schroeder, Jens Erat Feb 4 '15 at 19:25

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What topics are you looking for? I'm not sure this is the right forum for this question. – RoraΖ Feb 4 '15 at 14:37
  • I guess the easiest thing to do is explain the exploit and then someone who knows what they're doing can zoom in on each part of the process to find out where the actually hole is at. How do I do that properly? Should I just post up how to do it publicly? – knishka Feb 4 '15 at 14:50
  • Something like this? – Hagen von Eitzen Feb 4 '15 at 16:08
  • @HagenvonEitzen the problem with stuff like that, is that there's tons of it all over the internet, yet none of it works, and literally nothing is explained. It seems like it's common knowledge that it's so easy to spoof, yet no one actually delivers. My perspective is that if we have such awful protocols running our communications, perhaps we should get the telecom companies and the FCC to change them, but that seems at odds with everything they stand for. – knishka Feb 4 '15 at 17:21
  • Are you under the impression that either a carrier or the FCC is going to be unaware of the ability to send spoofed spam via SMS? Is there some goal you hope to accomplish? The worldwide conversion of all carriers from SMS to some new set of protocols that enforce authentication? – Don Simon Feb 4 '15 at 18:15
16

Make a demonstration video.

I have found that demonstration videos are an incredibly powerful way to communicate security issues, capturing the attention of managers who would otherwise dismiss this as "geeks talking geek".

Try to make the video as real life as possible. Include an example that is not just "oh look, this shouldn't happen" but actually gives a plausible real world scenario where this would be a serious issue.

Do not include technical detail in the video. If there's a technical step, just show someone running some commands on a computer - maybe even blur the screen to hide the commands. The video is to show WHAT can happen, not HOW it happens. This also means the video is less sensitive, as it doesn't contain technical details of the vulnerability.

If it is only some carriers that are vulnerable, include an example of attempting the same attack on a non-vulnerable carrier - to show that it doesn't succeed.

Share the video with the carrier privately at first, and tell them that if you don't get an adequate and timely response you will share the video more widely.

Here is an example of myself and a colleague in a demonstration video.

  • 1
    This was shared with the carrier, I've heard I should just wait 90 days to see what happens. In the meantime though, I guess I should just sit on it? I really want to know why this works, but I'm so inexperienced I don't know where to start, it seems like anything I could dig in to is way beyond my reach. – knishka Feb 4 '15 at 15:10
  • @knishka - you already made a video? If you get no response in a week or so, try different routes to contact the vendor/carrier. If you get no response at all, it may be appropriate to publish the video more widely sooner than 90 days. The 90 days is usually when the vendor is in contact and working on a patch. – paj28 Feb 4 '15 at 15:21
  • I did make one, yes. It's been two weeks now. I really want to learn about why this is working, and document it. I'm not sure if that's as dumb as asking "tell me exactly how my car engine works" to the person who made it. – knishka Feb 4 '15 at 15:29
  • 1
    @knishka share it then. – user62147 Feb 4 '15 at 19:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.