Questions tagged [sms]
Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.
217
questions
0
votes
2answers
74 views
How can I use a user's own SMS service to send OTP and make mobile number verification in my Android app?
Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile ...
0
votes
2answers
86 views
Malicious SMS and iMessage Interception
I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
-1
votes
0answers
34 views
Which of SMS or email 2FA is more secure? [duplicate]
Is it more secure to do 2 factor authentication via email or via SMS? What are the risks in both cases?
1
vote
2answers
125 views
report bribery: snail mail vs email vs SMS
Say I live in a western country and suspect a foriegn businessperson is trying to bribe local officials. I am provided with 3 options to report: snail mail, email and SMS. For my threat model, I am ...
43
votes
1answer
5k views
Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]
Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
0
votes
1answer
96 views
Multiple SMS activation codes received by error
For several days now I am receiving activation codes by SMS that look like this:
Your ToYou verification code is 8058
Some are from ToYou, that seems to be a delivery service, others are from similar ...
2
votes
0answers
118 views
A message sent to your phone to erase another message
After giving a new credit card to a client some banks send its PIN code with an SMS. Later they send another SMS that's only purpose is to erase the SMS with the PIN from user's phone. Does this trick ...
0
votes
0answers
76 views
Is there some way to "fully delete" received and sent SMS messages (and any other "deleted" data") on my cellphone?
I have a cheap cellphone bought about ten years ago. It has a physical SIM card. I have in-phone "deleted" all sent and received messages, but very strongly suspect that these are still ...
0
votes
3answers
226 views
What to do after opening a potentially malicious link on smartphone?
What must one do if they opened a malicious link?
Warning: Please do not open the links below as they may be malicious. They have been deliberately mangled to prevent accidental opening
I received an ...
0
votes
0answers
28 views
Is verification code a scam? [duplicate]
When facebook sends the confirmation code, the name FACEBOOK is not displayed as the sender,, instead phone numbers of different countries. Until now, it was only on my notebook, but today I synced my ...
1
vote
1answer
367 views
Google Voice vs SMS for two-factor authentication
I'm trying to set up two-factor authentication for all my accounts. Some of them, unfortunately, only support SMS.
In that case, which of these options would be more secure?
SMS
Google Voice (which ...
12
votes
3answers
4k views
If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?
And if not would like specific reasons why.
I have this suspicion that, although an inferior method these days to MFA applications, believe that the security is adequate enough as most phone companies ...
0
votes
0answers
308 views
If I receive Google verification codes that do not work, is my phone compromised? [duplicate]
I know that something similar has happened to other people before (see for instance here or here), but the situation and the question are slightly different.
I wanted to log in to my Gmail account ...
0
votes
2answers
153 views
How much is it hard to implement a mechanism to encrypt SMSs in transit
Why service providers didn't implement something like SSL to make SMS more secure and reliable in multiple scenarios ?
I did ask a question about why SMS is used as a way of verification while it is ...
81
votes
7answers
20k views
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
I did some research about how secure and private SMS messages are.
Providers and governments can see these SMS messages in plaintext,
but what is weird is that these messages are not encrypted in ...
0
votes
1answer
102 views
Cell Phone texting [closed]
Is it possible for someone to redirect text messages to you from another’s phone? Something weird is going on…over the last few weeks I have received “wrong number”text messages from people with ...
-1
votes
3answers
282 views
What's stronger: phone/text 2FA or authenticator app? [duplicate]
I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku:
Is phone/text based 2 Factor Authentication generally weaker than using an ...
0
votes
0answers
25 views
How can a phishing attempt SMS be sent by the same number as the legitimate company? [duplicate]
My bank (let's call it theBank; it's a trusted bank in a Scandinavian country) uses among other methods SMS prompts. When performing an action (e.g. payment), you are sent an SMS containing a code ...
1
vote
1answer
382 views
Received a strange text message. What is it? [closed]
This morning I received the following text message from a Gmail account:
v3s5f3rs4f3gs3.nf5j4k8j4k3o.solar?G$1?V&?KL?O=$HO?&S?K0?$1T
A couple of my friends got it too. I have an iPhone and it ...
0
votes
0answers
110 views
Facebook and Yahoo 2FA SMS codes from odd numbers
When logging in to Facebook/Yahoo mail, I receive my 2FA codes from random numbers. Here are some examples (I have a Romanian phone number, hence the country codes):
+40 747 691 103
+40 727 347 814
+...
4
votes
0answers
214 views
What is "JavaGhost - Mass Twilio Checker"?
Over the past week, the account credentials for my organization's Twilio account were stolen and used to send ~10,000 fraudulent SMS messages claiming to be from a major bank.
The passwords have all ...
1
vote
1answer
102 views
How to decrease the fraud level on SMS verification
To prevent fraud, we require the users to link their account to a mobile phone number. We send a code by SMS.
Fraudsters use hacked social networks to convince "friends" to send them the ...
0
votes
1answer
140 views
2FA with blower.io SMS
I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon?
Also is it safe/ok to send a short lived authentication ...
1
vote
2answers
83 views
I have a custom domain for email. Do I need to configure DNS to prevent outgoing text messages with an address from my domain? [duplicate]
I own a custom domain that I use for e-mail. The mail server is configured with a catch-all that redirects messages to any user to my inbox. For the first time this afternoon, I received a benign &...
1
vote
1answer
104 views
Spoof texting a regiatered number to yourself and relying....having a conversation [closed]
I feel like I am going crazy. A friend was at my house and received text messages from a number from a person i know. She had a conversation with this number for basically a week. She is now saying ...
2
votes
0answers
164 views
Received Google 2FA Code via SMS from two unknown phone numbers [duplicate]
I recently encountered a strange incident regarding the 2FA of my Google Account.
The user Dunois has described a very similar occurrence in this post: Functional Google 2FA code (via SMS) received ...
1
vote
0answers
72 views
Can OTP (One-Time password) be used to protect data after intrusion has been detected? [closed]
I am working on Social Engineering attacks happening via SMSs. Let's assume a person receives an SMS asking him to click on a malicious link. If a virus is installed on the person's device, how can ...
1
vote
2answers
170 views
Someone uses my service to spam people with sms. How to deal with this?
Every time when user wants to login to my service it sends one time password (OTP) to the user's phone number, then this OTP is used to confirm login.
Someone uses my service to bombard people with ...
1
vote
2answers
1k views
How to spoof IMEI/SIM location?
Once you plug it into a phone and power it on, the IMEI number of the
phone and the SIM's serial number will be transmitted to the nearest
cell tower(s).
source
Is there a way to spoof the location ...
1
vote
1answer
68 views
Which practices should i use while generating SMS codes for auth on my project?
Let's imagine that we have an SMS verification auth, and using random 4-digit codes,
i.e. 1234, 5925, 1342 and etc.
I'm using this random inclusive algorithm on my node.js server:
function ...
2
votes
1answer
177 views
Is phone number verifications with SMS magic HTTP links less secure than OTP?
I want to verify phone number ownership with specially crafted and encrypted payload within an HTTP hyperlink callback through SMS as opposed to sending an SMS OTP code and writing it back in server ...
31
votes
2answers
9k views
If you SMS text someone, how much more information will they know about you?
If I send someone a text, how much information am I giving up? Could they add me to an app like Whatsapp and access my name and profile? Or does their number first have to be saved in my phone ...
30
votes
6answers
6k views
Is revealing the phone number during OTP verification process considered a vulnerability?
One of the common way of implementing 2FA is using phone number Text message or Call with OTP. As I can see, usually web services show something like:
OTP was sent to the number +*********34
Is it ...
0
votes
1answer
189 views
I have one Friend that said he is getting texts from me but its not me
A friend of mine is getting a text asking him to click on a link to view a video. The name is my first and last name. Most people do not spell their first name as mine but there is no phone number ...
1
vote
1answer
183 views
Recycled phone numbers [closed]
I just wanted to ask because I am in a situation now, where I have been locked out of my Instagram due to my mobile phone provider deactivating my Simcard. I have contacted Instagram support sending ...
4
votes
1answer
1k views
How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?
My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
1
vote
1answer
458 views
What are security issues about sending bank alerts via email/SMS?
Banks offer to send alerts for each transaction happening on a customers account. My bank is offering three options: SMS alerts, email alerts and push alerts into their own app. Only sms alerts are ...
1
vote
2answers
2k views
Why my mobile sends SMS to a random number without my permission?
My mobile sends SMS to random numbers without my permission. All messages are sent automatically. Here is an example of an SMS.
SBIUPI qUrXgeX26iEY%2B2si9JHhubIjm7R2aHoo6pWcbXBpJho%3D
All the ...
0
votes
0answers
106 views
Blockchain 2FA by sms (wallet code) secure (hack)?
To keep a long story short, I got hacked on my PC by downloading and executing a wrong file. Programs as InterVPN, Cryptobot and HVNC (told by the hacker via google chat) were installed. My accounts (...
1
vote
0answers
165 views
Cell phone receiving text messages between an acquaintance and his girlfriend
An acquaintance was staying with us a short time ago and I let him use my cell phone to text his girlfriend and listen to music. A week ago he acquired a cell phone of his own. Completely different ...
8
votes
1answer
1k views
Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number
tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
1
vote
0answers
121 views
Phone number stolen. What to do?
It seems a friend of mine got his phone number stolen. Someone got access to his Facebook account (where they tried to post ad campaigns) and to his WhatsApp account. The Facebook security page said ...
2
votes
1answer
291 views
What is the most unique data identifier for a phone user that cannot be repeated?
I'm currently developing an Android (and probably iOS in the future) application for my company.
I was wondering what is the most unique data identifier to authenticate the users. A data that cannot ...
1
vote
0answers
126 views
Is there a way to find out WHO sent me a life threatening text? [closed]
Recently I received several text messages from TWO different numbers that I did not recognize. I called the numbers back, and texted them, but there was no answer, or vm. I googled them as well, and ...
3
votes
1answer
596 views
Is eavesdropping possible over smpp?
I don't know much about the SMPP protocol, but I often hear that it is not a secure protocol.
If Alice sends a SMS to Bob, can Eve view what Alice sent to him? If yes, can you give an example on how ...
0
votes
1answer
115 views
A recieved text message that was never sent on iPhone [duplicate]
My girlfriend asked me why I texted her at 2:30 am. But I went to bed at 2am and that message was not recorded on my phone. She had an iPhone and I have a Samsung Galaxy S9. She sent me a picture of ...
3
votes
1answer
162 views
Protect page sms verification from spamming
I'm developing a merchant page where users can pay their bills.
On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC).
As a verification, we have a ...
1
vote
0answers
87 views
What are spammers trying to acheive who only provide the correct contact information in their spam? [closed]
I've recently received 2 spam SMS messages, claiming to be from 2 different organizations, but (obviously) not sent by them.
However, all of the contact details in the SMS match the real details of ...
1
vote
1answer
206 views
SMS not received and read by somebody else (no SIM swap)?
A friend of mine was phished for his credit card details and driving license. Very foolish, I know. The criminals then bought bitcoin. The fact is his card is VbV. He claims not to have received any ...
51
votes
5answers
6k views
Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?
Security experts are constantly discouraging users from using SMS-based 2FA systems, usually because of worries the auth code could be intercepted by an attacker, either through a SIM swap or a MitM ...
