Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.
1
vote
1answer
52 views
What makes an SMS gateway insecure?
Is it specifically something about SMS protocol, the proprietary software used to do message routing, or perhaps an ACL on the server? I would imagine that a gateway accepting emails from anywhere ...
8
votes
1answer
1k views
If I know a currently working exploit to spoof SMS on a major carrier, what should I do? [closed]
This currently works on all iPhones and one known android phone as of today, a formal complaint has been filed with the carrier and the FCC. I doubt they will do anything about it though since this is ...
3
votes
1answer
82 views
Can sms-only authentication be safe?
many Android mobile applications (e.g., Whatsapp, Telegram), when used for the first time on a device, "authenticate" users by sending them a secret code in a SMS message.
The same mechanism is used ...
1
vote
1answer
44 views
verify an api call is made from the mobile device [duplicate]
I am developing a webserver and provide an API to be used by mobile clients.
Some of my calls are without any authorization, for example, to start the authentication process.
Is there a good way/best ...
4
votes
1answer
253 views
SMS Spoofing not available in kali
Has the SMS Spoofing option been removed from the Social Engineering Toolkit ? I run 3.14-kali1-amd64. I get only the options shown below. Tried updating both kali and SET but i still dont get the ...
2
votes
2answers
62 views
Secure alerting for a monitored web application
What is a good method to receive security alerts?
Email is the first thing that springs to mind, although it is susceptible to MITM attacks (e.g. an attacker preventing the email from being ...
0
votes
2answers
140 views
Is it safe to rely on text messages as a means on authentication?
Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
1
vote
2answers
3k views
Trace source and destination of an SMS message [closed]
Is it possible to trace the source or destination (location, even coordinates) of an SMS message ?
If it is, is it possible to do it even if the phone is roaming in a different country ?
-2
votes
1answer
148 views
Spoofing SMS messages [closed]
I received a message recently on a droid phone that appeared to have originated from an Iphone in my contact list. I was able to look at the Iphone from which the message appeared to have originated ...
1
vote
2answers
727 views
Could “receive SMS online” site be a scam?
There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
18
votes
5answers
4k views
Are SMS,MMS stored on the network service providers' servers?
Are SMS and MMS sent via a mobile phone stored on telecommunication service providers' servers before passing them to the recipient?
Does it depend on the country or does every network service ...
2
votes
2answers
165 views
Does Google 2-step verification protect user from session hijacking?
After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account.
Consider an attacker does session ...
3
votes
1answer
96 views
What Information is Exposed When I Send A Message From My Mobile Device
When I send a text message and/or an email, with or without location services turned on, what information is available to the recipient of that message if they know how to read the data behind the ...
3
votes
1answer
121 views
Should an administrator be able to turn off TFA for a user
We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users?
Google Auth uses SMS as backup option but SMS does not ...
0
votes
1answer
91 views
Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?
In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections.
This site is full of ...
10
votes
1answer
1k views
TextSecure protocol
Is anyone aware of an analysis of the TextSecure protocol?
https://whispersystems.org/blog/simplifying-otr-deniability/
https://github.com/WhisperSystems/TextSecure/wiki/Protocol
It is a ...
6
votes
3answers
805 views
Why does a spam sms contain a link to an email address?
A colleague of mine just received a (spam) sms with this message:
Congratulations! Your mobile have won $1,000,000,00 Pounds with Draw#
294 64/2013. For more info & claims, contact our ...
7
votes
2answers
975 views
How do I forensically determine whether a mobile phone has been infected with a spy suite?
What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)?
I have Blackberry and iPhone 4 phones that are ...
7
votes
1answer
428 views
Is there a list of phone numbers Facebook uses to send auth tokens?
Up to a few days ago, I always received Facebook auth tokens from numbers +181338477XX, except a few times from +85294985XXX.
Problem is that lately I've been receiving codes directly from Italian ...
17
votes
3answers
2k views
Could my bank's two-factor authentication be hacked?
When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account.
Is this vulnerable to attack, without ...
2
votes
1answer
607 views
Is TextKey SMS 2 factor authentication secure against cell phone cloning?
I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods.
In typical SMS authentication, the provider sends you an access code ...
2
votes
1answer
134 views
Send credentials by sms [duplicate]
If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
8
votes
1answer
388 views
Getting strange texts to an iPhone #PWD123456#00X
My dad is getting strange SMS texts to his iPhone 4
Some examples:
#PWD123456#WHL003=2308480298
#PWD123456#WHL004=2398480389
#PWD123456#WHL002
#PWD123456#WHL002
#PWD123456#STATUS?
...
-1
votes
1answer
451 views
Is it still possible to sign up for a Google account without SMS verification? (March, 2013) [closed]
Non of these two methods worked: http://googlesystem.blogspot.com/2012/01/new-google-accounts-require-gmail-and.html
2
votes
2answers
1k views
Retreive header from SMS iphone
I received a lot of SMS from a guy where the phone number change every time. I can answer to these SMS, so I think it's only a spoofing of the sender ID of the SMS header which will be displayed in ...
6
votes
2answers
314 views
Can a SMS recipient charge any arbitrary fee to the sender without approval?
I received an email from a prospective "client" in broken English. We have been going back and forth about services for a while and he wants me to text him. Is it possible for him to charge me some ...
-1
votes
2answers
127 views
Can 2FA help handle mixed personal and business accounts after leaving a company?
I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
28
votes
1answer
2k views
How does a new SMS message overwrite a previous one?
During a talk from a vendor, the speaker mentioned that their product used a "little known feature" of SMS in order to overwrite the last text message received from them. This feature was being used ...
8
votes
4answers
10k views
How can SMS spoofing be detected?
SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as ...
7
votes
4answers
487 views
Should SMS systems warn users of possible spoofing attacks?
The author of this blog post Never trust SMS: iOS text spoofing says that: The sender of an SMS message may provide arbitrary sender information using low level protocol features. Furthermore the ...
4
votes
4answers
920 views
SMS Authentication: random OTP or a cryptographic one
I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest:
Sending random 8 ...
1
vote
0answers
115 views
What's the deal with SMS archiving? [closed]
The other week I was texting a friend of mine, and something happened that I haven't experienced before. Instead of receiving the text I'd just sent, my friend received a text I sent several months ...
-6
votes
2answers
257 views
Is it possible to MITM between Google voice SMS/TXT Messaging
I have 2 spammers who won't stop spamming me via SMS once I post stuff online.
I would like to determine their location based on language, so if I were to somehow become a man in the middle and have ...
4
votes
1answer
492 views
How to catch a SMS spammer who is using google voice to spam me
How do I catch a SMS spammer who is using google voice to spam me?
I have the google voice number and 2 of their burner emails with gmail. How do I gather enough information to inform the ...
1
vote
0answers
241 views
Honeypot for catching a spammer [closed]
I've been receiving more and more emails and now even TXT messages originating from google voice for inquiries of items that I've listed for sale on craigslist.
What I would like to accomplish: I ...
29
votes
5answers
15k views
What is preventing us from sniffing the mobile phone communcation?
I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
7
votes
1answer
9k views
Is there a sms authentication that works like 10minutemail? [closed]
I remember reading on this site a user recommending 10minutemail.com as a way to register or give email address to non-trusted websites.
Is there any similar site for disposable phone number for ...
5
votes
1answer
306 views
SMS PDU specification and carving techniques?
I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on dreamfabric.com, but I'm having some trouble. First of all, the specification isn't ...
5
votes
3answers
2k views
Proof of SIM card possession on iOS devices
I need to proof that a user of my app is in possession of the correct SIM card.
On android devices, this is possible by simply sending a challenge within an SMS to the corresponding number (the proof ...
3
votes
2answers
2k views
SMS / voice call interception with a fake base station
This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
43
votes
6answers
13k views
How hard is it to intercept SMS (two-factor authentication)?
A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
3
votes
4answers
1k views
Can SMS text messages be used to verify a person's unique identity through a short code system?
We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
12
votes
4answers
1k views
Is it “standard” to SMS passwords?
When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and ...
