What makes an SMS gateway insecure?

Question

Is it specifically something about SMS protocol, the proprietary software used to do message routing, or perhaps an ACL on the server? I would imagine that a gateway accepting emails from anywhere that were then sent via SMS would check the from field on any incoming message against RFC5322, but then again this is clearly not the case since some gateways allow any message through, allowing for spoofing.

Can someone explain where in the entire process this is weak, and why? Also why do they not fix things like this?

Answer 1

There is nothing wrong with SMS. Let's reverse engineer, and redesign the whole network as if to protect communication between two people.

1) Let's make it a point-to-point communication network where there's a salt known only to the sender and receiver and the phone numbers are encrypted. This prevents spoofing and/or spam.

2) the gateway itself only has one instance, and that instance is secured by at least 256 bit encryption, and is physically isolated from other equipment and tampering. To ensure that endpoint device theft isn't an issue, offline mode is disabled.

3) A one-time phone number can be used to send SMS to users outside of this secure environment restricting the original phone number from being harvested or spoofed.

4) Phone number blocks all SMS's for numbers not on contact list. . . . . Now, we forward engineer about 20 years, scale it using enteprise and off-the-shelf equipment and call it Snapchat (and hack off the group messaging feature). It's now more secure than President Obama's Blackberry, but still isn't impervious to jealous girlfriends, wives, and screen shots.

Answer 2

Disclaimer: I work for an SMS provider.

The default SMS protocol (SMPP) is inherently insecure (by design), so several layers of security must be put in place on top of the protocol itself, one way of achieving that is by VPN for instance – this would be on the connectivity (or network) layer. With other technologies like email as you stated, a domain authority such as your domain registrar can technically restrict others from using or spoofing your domain, so there’s a little bit more security there, which is not applicable in SMS or SMPP. Because of these security shortcomings in the SMS protocol, an SMS gateway must take extra precautions to secure all the other layers involved in SMS transmission, we already spoke about the network layer, there’s also the application layer and securing passwords and account and restricting access to only whitelist IPs for example, there’s also the content layer, interfaces (most SMS gateways allow API access, so that’s another layer of security for example), using HTTPS for encrypting data during transmission.

We heavily invest in securing our SMS gateway because most of our clients are in the financial sector which requires compliance with industry security standards like PCI/DSS. More detail about SMS gateway security, and a whitepaper on the same can be found on this blog post.