Questions tagged [sms]
Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.
1
vote
0answers
48 views
Strange inbound MMS messages
We received some strange inbound MMS messages on our Twilio account today. Our account was not compromised, as there are no suspicious outbound messages sent from our number via Twilio.
We first ...
-1
votes
1answer
43 views
Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?
In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS.
Note, this would be used on a website that should never have more than perhaps 30 users.
I'm ...
0
votes
2answers
157 views
Is sending only password (not username) by sms secure? [duplicate]
Is it secure to send only password and not sending with username by sms?
Is there any risk?
9
votes
3answers
281 views
What is future of SMS 2-step authentication?
Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for authorization (in case of 2 step auth) or for controlling the account (password reset,...
3
votes
3answers
134 views
When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?
I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS.
Since many people already know your phone number, or it may be listed ...
2
votes
1answer
79 views
Problems with this 2 factor authentication implementation
I'm implementing my own 2 factor authentication using SMS.
We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
0
votes
0answers
159 views
Emulate a phone number to receive SMS?
I would like to perform some registrations on a website sending SMS code to verify identity on each registration process. Free SMS sites are flagged.
Is there any way to choose a random phone number ...
0
votes
1answer
57 views
Send a form with sensitive information via SMS attachment
A prospective business associate wants me to send an image of an application with some of my important self-identifying information via SMS as an attachment, e.g. image or PDF of the form. This doesn'...
0
votes
1answer
285 views
Is telegram SMS login secure?
TL;DR: Can
1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or
2) A "telegram ...
4
votes
3answers
251 views
Is receiving an OTP via email any more secure than receiving it via SMS?
I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS?
(Assuming the email - ...
5
votes
2answers
137 views
SMS Verification Code vs. Response Message [duplicate]
I need to verify each user's phone number in an enterprise SaaS system. Instead of using the common "Enter the 4/8 digit code in this form", I'd prefer to have the user respond with an SMS message ...
1
vote
2answers
208 views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
8
votes
3answers
260 views
Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?
Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
2
votes
2answers
188 views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
0
votes
1answer
124 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
8
votes
3answers
368 views
Should I delete SMS messages containing one-time passwords?
I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset.
Should I delete those SMS messages after the one-time ...
0
votes
1answer
32 views
Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?
We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS.
But this ...
12
votes
2answers
912 views
is LastPass SMS Recovery a security risk?
According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords.
LastPass encrypts your Vault before it goes to the server using
256-bit AES encryption. Since the ...
-3
votes
1answer
635 views
How To detect Fake mobile number for SMS verification [closed]
I am facing some issues regarding SMS verification in my website. Suddenly, some transactions are happening using the fake numbers like https://www.receive-sms-online.info
How to detect the number is ...
-1
votes
3answers
126 views
Is it Unrestricted file upload vulnerability?
I am using a messenger app that's similar to WhatsApp.
This app allows me to send any type of files, like Html, Php, SWF etc. via text messages.
Is this a vulnerability?
3
votes
1answer
291 views
SMS based 2FA intercepts
Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
-1
votes
1answer
87 views
Unable to utilise curl commands on website [closed]
There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
2
votes
1answer
128 views
Phone Number Appears to Have Been Temporarily Hijacked
What Happened:
At 8:40am Telegram sends me a login code via the Telegram desktop app.
At 8:44am Telegram informs me that someone has logged into my
account via ip address #1 (appears to be PIA vpn)
I ...
3
votes
1answer
70 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
1
vote
1answer
138 views
SMS OTP as 2FA - should there be sms session id in sms for user's verification?
Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
1
vote
0answers
55 views
Is it possible for old text messages to be used in an SMS spoofing attempt?
Background
The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email.
The Issue
...
9
votes
4answers
923 views
Prevent against OTP abuse in app sign up flow
This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue.
Let's say there is an app that ...
2
votes
1answer
119 views
What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?
There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
139
votes
2answers
27k views
Received a set of SMS/MMS containing 2 photos, a voice message, and a text “I need help” with Google Maps link from a known contact. Is it spam?
My girlfriend (let's call her Jane) just got a set of SMS or MMS messages coming from a friend of her (let's call her Hellen). These messages contain:
Two photos of Hellen
A voice message
A text that ...
2
votes
0answers
101 views
“Reply T to unsubscribe” in SMS spam messages, ignore or reply “T”? [duplicate]
I'm in China and I occasionally get spam SMS messages. Most of them ends in a sentence that says this or something else alike.
Reply T to unsubscribe.
(T is the leading letter in Chinese word "...
1
vote
1answer
221 views
Can SMS messages be traced when they come from a computer?
From Amazon SNS, I can send SMS messages to any mobile phone.
To recipient phones, the SenderId is just a string of my choosing. The messages cannot be replied to.
I receive quite a few phishing ...
-1
votes
1answer
608 views
How to avoid silent SMS attack?
I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
1
vote
1answer
252 views
Received SMS/MMS with suspicious link - what to do now?
I today received a personalized sms on my android phone which:
addresses me by my first name
is labeled sms/mms
claims to be from a contact with a first name which I do not have in my contact list, ...
3
votes
1answer
50 views
Providing a SMS recovery feature without compromising the security of an account
I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either:
Providing the password for the account
Resetting the password using ...
1
vote
1answer
4k views
Reply to a spoofed SMS message
If my phone number is (212)555-1212 and Bob spoofs my number vias SMS to Alice, will Alice's reply be sent to Bob, me or both?
EDIT: The concern is that the spoof prompts Alice to disclose ...
1
vote
1answer
84 views
Secure forwarding of 2FA SMS codes [closed]
Do solutions exist for forwarding SMS messages whereby:
the service provider stores no logs of messages
login protection with google authenticator or comparable
2
votes
1answer
258 views
Is it normal to receive working SMS verification code from strange number?
Here is a sample SMS that usually I trust:
The sender is in a text format and there is an information saying the sender does not support replies.
When I tried to login, I received verification code ...
4
votes
1answer
482 views
Password Reset Chatbot with Authentication through text message
I just saw a design for a chatbot that resets a password for a locked out user after failed logins. It authenticates the user by sending a text message to the user's phone.
How practically safe is ...
5
votes
1answer
267 views
Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)
In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
3
votes
1answer
175 views
Does SMS flood cause denial of service even when “blocked”?
Imagine a SMS flood using a few phone numbers. The client blocks the phone numbers using the build in mechanism of the smart phone, and thus does not receive any notifications. Even though the user ...
1
vote
0answers
165 views
How difficult are SS7 hacks? [duplicate]
Out of band communication via SMS has recently been shunned due to SS7 hacks. How likely are these to become more prevalent? I saw this question:
Should 2FA over SMS be considered insecure in the ...
6
votes
1answer
194 views
Alternatives to SMS as a out-of-band channel
I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
1
vote
1answer
49 views
How secure it is to identify a user by an sms's caller id?
I need to verify a user based on its phone number. I am thinking that instead of me sending him an sms, it would be cheaper if he sends me the sms and I verify he's phone number based on his caller ID....
2
votes
2answers
9k views
Got a paypal confirmation code when I don't even have an account? [closed]
Basically just right now I got a text on my phone giving me a code that expires in 5 minutes. The scary thing is that I've never used paypal ever in my life. Is this just someone mistyping his phone ...
2
votes
1answer
17k views
Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver?
A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I ...
2
votes
0answers
63 views
How can I go about securing services that require SMS tokens as backups?
I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
1
vote
4answers
180 views
Is a SIM card secure against governments?
Let's say I live in Russia and I use Gmail. My Gmail has my phone number for recovery in case I lost my Gmail password.
Obviously if Russian police want to access my Gmail account then they can ...
0
votes
1answer
356 views
What action plan a hacker can do to enter an iPhone [closed]
I am interested by mobile protection for general public, we have all information saved on our phone. I am thinking what action plan a hacker can do with Kali or other to enter an iPhone and read SMS, ...
2
votes
0answers
79 views
Could an attacker delete messages using an MMS exploit?
My SMS messages are getting deleted. What I noticed is, that some number keeps sending me MMS messages, mostly pictures. Yes, I had the "accept MMS automatically" turned on my Samsung device to ON.
...
1
vote
1answer
92 views
Someone is bothering me by messaging through websites message services [closed]
Someone is sending me sms from last few weeks through 'SMS sending websites' who don't publish the sender name in the message. Sometimes it shows ' sent through websms' in the message. Please help if ...
