Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.
-1
votes
3answers
98 views
Is it Unrestricted file upload vulnerability?
I am using a messenger app that's similar to WhatsApp.
This app allows me to send any type of files, like Html, Php, SWF etc. via text messages.
Is this a vulnerability?
3
votes
1answer
134 views
SMS based 2FA intercepts
Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
-1
votes
1answer
49 views
Unable to utilise curl commands on website [closed]
There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
2
votes
1answer
89 views
Phone Number Appears to Have Been Temporarily Hijacked
What Happened:
At 8:40am Telegram sends me a login code via the Telegram desktop app.
At 8:44am Telegram informs me that someone has logged into my
account via ip address #1 (appears to be PIA vpn)
I ...
3
votes
1answer
51 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
1
vote
1answer
95 views
SMS OTP as 2FA - should there be sms session id in sms for user's verification?
Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
1
vote
0answers
30 views
Is it possible for old text messages to be used in an SMS spoofing attempt?
Background
The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email.
The Issue
...
2
votes
0answers
124 views
Prevent against OTP abuse in app sign up flow
This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue.
Let's say there is an app that ...
2
votes
1answer
113 views
What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?
There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
140
votes
2answers
26k views
Received a set of SMS/MMS containing 2 photos, a voice message, and a text “I need help” with Google Maps link from a known contact. Is it spam?
My girlfriend (let's call her Jane) just got a set of SMS or MMS messages coming from a friend of her (let's call her Hellen). These messages contain:
Two photos of Hellen
A voice message
A text that ...
2
votes
0answers
97 views
“Reply T to unsubscribe” in SMS spam messages, ignore or reply “T”? [duplicate]
I'm in China and I occasionally get spam SMS messages. Most of them ends in a sentence that says this or something else alike.
Reply T to unsubscribe.
(T is the leading letter in Chinese word "...
1
vote
1answer
73 views
Can SMS messages be traced when they come from a computer?
From Amazon SNS, I can send SMS messages to any mobile phone.
To recipient phones, the SenderId is just a string of my choosing. The messages cannot be replied to.
I receive quite a few phishing ...
-1
votes
1answer
331 views
How to avoid silent SMS attack?
I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
1
vote
1answer
135 views
Received SMS/MMS with suspicious link - what to do now?
I today received a personalized sms on my android phone which:
addresses me by my first name
is labeled sms/mms
claims to be from a contact with a first name which I do not have in my contact list, ...
3
votes
1answer
37 views
Providing a SMS recovery feature without compromising the security of an account
I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either:
Providing the password for the account
Resetting the password using ...
1
vote
1answer
1k views
Reply to a spoofed SMS message
If my phone number is (212)555-1212 and Bob spoofs my number vias SMS to Alice, will Alice's reply be sent to Bob, me or both?
EDIT: The concern is that the spoof prompts Alice to disclose ...
1
vote
1answer
54 views
Secure forwarding of 2FA SMS codes [closed]
Do solutions exist for forwarding SMS messages whereby:
the service provider stores no logs of messages
login protection with google authenticator or comparable
2
votes
1answer
185 views
Is it normal to receive working SMS verification code from strange number?
Here is a sample SMS that usually I trust:
The sender is in a text format and there is an information saying the sender does not support replies.
When I tried to login, I received verification code ...
4
votes
1answer
289 views
Password Reset Chatbot with Authentication through text message
I just saw a design for a chatbot that resets a password for a locked out user after failed logins. It authenticates the user by sending a text message to the user's phone.
How practically safe is ...
5
votes
1answer
144 views
Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)
In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
3
votes
1answer
119 views
Does SMS flood cause denial of service even when “blocked”?
Imagine a SMS flood using a few phone numbers. The client blocks the phone numbers using the build in mechanism of the smart phone, and thus does not receive any notifications. Even though the user ...
1
vote
0answers
108 views
How difficult are SS7 hacks? [duplicate]
Out of band communication via SMS has recently been shunned due to SS7 hacks. How likely are these to become more prevalent? I saw this question:
Should 2FA over SMS be considered insecure in the ...
6
votes
1answer
133 views
Alternatives to SMS as a out-of-band channel
I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
1
vote
1answer
48 views
How secure it is to identify a user by an sms's caller id?
I need to verify a user based on its phone number. I am thinking that instead of me sending him an sms, it would be cheaper if he sends me the sms and I verify he's phone number based on his caller ID....
1
vote
2answers
2k views
Got a paypal confirmation code when I don't even have an account? [closed]
Basically just right now I got a text on my phone giving me a code that expires in 5 minutes. The scary thing is that I've never used paypal ever in my life. Is this just someone mistyping his phone ...
1
vote
1answer
3k views
Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver?
A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I ...
2
votes
0answers
60 views
How can I go about securing services that require SMS tokens as backups?
I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
1
vote
4answers
157 views
Is a SIM card secure against governments?
Let's say I live in Russia and I use Gmail. My Gmail has my phone number for recovery in case I lost my Gmail password.
Obviously if Russian police want to access my Gmail account then they can ...
0
votes
1answer
193 views
What action plan a hacker can do to enter an iPhone [closed]
I am interested by mobile protection for general public, we have all information saved on our phone. I am thinking what action plan a hacker can do with Kali or other to enter an iPhone and read SMS, ...
2
votes
0answers
69 views
Could an attacker delete messages using an MMS exploit?
My SMS messages are getting deleted. What I noticed is, that some number keeps sending me MMS messages, mostly pictures. Yes, I had the "accept MMS automatically" turned on my Samsung device to ON.
...
1
vote
1answer
92 views
Someone is bothering me by messaging through websites message services [closed]
Someone is sending me sms from last few weeks through 'SMS sending websites' who don't publish the sender name in the message. Sometimes it shows ' sent through websms' in the message. Please help if ...
2
votes
1answer
78 views
Responsibility of disclosing potential social engineering attack
I've just gotten a text message from a number pretending to be my bank and telling me to install a certificate from a suspicious link (link looks like this: bankname-certificate.ru/installation not ...
2
votes
1answer
93 views
How do 2FA (and other account verification) systems identify true mobile numbers vs VoIP numbers?
I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages.
My goal was to have a dedicated DID/number which I don't ...
1
vote
2answers
253 views
SMS based authentication, handling recycled phone numbers?
If a site requires you to authenticate with only a phone number and a one time login code, what safeguards can be put in place such that when I change my phone number and the phone company recycles it,...
1
vote
2answers
139 views
ELI5: What is the goal of the senders of the fake texts I receive
^^^Fake text sent to me, have received 10 this week. This was in the first batch of four I received around 630 am this week. It is incorrectly dated to say 2013 and it says PM but was actually ...
1
vote
0answers
130 views
Are my SMS messages being intercepted? Or is this some kind of issue with the app itself?
When getting verification codes, I've been getting weird messages, such as:
YoUR siGnaL veRiFICATioN c(O(D(E(: ***-***
YOUR SIgNal VERiFICAtION c)O)D)E): ***-***
yoUR siGnaL veRificATiON ...
3
votes
1answer
839 views
Catch incoming SMS/Calls in a fake GSM Network
I am currently working on a Project where I am doing a downgrade attack from LTE to GSM. I am using OpenLTE and OpenBTS for creating the fake base stations.
When the phone connects to the fake GSM ...
2
votes
3answers
713 views
Storing password in sqlite vs asking user to type it in every time
I am making an Android app that needs to be very secure. For authentication to the server, it will use 2-factor authentication that includes:
username/password
sms verification
I can't use client ...
66
votes
4answers
17k views
Are there any security risks in replying to an SMS message?
I routinely receive seemingly harmless SMS messages from unknown people. They're usually simple, like "Hi" or "Hello" or "Are you there?". This happens several times a week, and certainly often enough ...
1
vote
2answers
409 views
How to secure Google Account from SIM hijacking & intercepting Two factor SMS codes on the way & still keep it accessible?
As mentioned on many places at web, SIM cards are one of the weakest link in Two Factor Authentication process. Bad actors can impersonate as user to Telecom Company to get duplicate SIM, or simply ...
0
votes
1answer
143 views
SMS Encryption with Hashing [closed]
I need help, I want to send a encrypted SMS from Alice to Bob, where does hashing comes in here? How do I use the hashing??
0
votes
1answer
199 views
How Could A Diffie Hellman Key Exchange Work on SMS Apps on Two Different Mobile Devices?
How Could A Diffie Hellman Key Exchange Work on SMS Android Apps on Two Different Mobile Devices? It is understandable for a client browser communicating with a server, the internet data path is ...
1
vote
2answers
729 views
Google login 2 factor authentication sms -fake or real?
All my 2 factor authentication used to come from Google sms, but recently I've had the following numbers come up on my phone. I realise that to do this the person would need to have my phone number. I ...
3
votes
1answer
6k views
Identify suspicious flood of SMS (phone exploit?) [closed]
edit
Based on comments and answers, there seems to be some misconception. Allow me to clarify:
I have of course searched for REG-RESP on Google prior to writing this question, but what is to be ...
1
vote
1answer
202 views
has there ever been router virus able to send SMS (text)
I am fighting with my network provider.
If I have router with LTE GSM Card inside, is it possible for router malware to send text messages from it? Or has it ever been done? They say I subscribed to ...
-2
votes
1answer
140 views
Spoofing a message [closed]
Theoretically, if a sender spoofs a number and sends a text, how can the sender get the receiver to reply to the message but having the reply go specifically to a different number?
13
votes
5answers
2k views
SMS verification, is it secure? [duplicate]
In my web app (everything works with HTTPS), I send the user an SMS with a unique 5-digit code to a cellphone number he provides. I then ask the user to enter in the browser the code he received. ...
0
votes
0answers
109 views
Need some info or examples about tp-pid in sms pdu
I'm doing a research about vulnerabilities in SMS and I need some help.
The rooting SIM cards vulnerability by srlab uses the tp-pid 0x7f (SIM data download), but there is a list of other possible ...
1
vote
1answer
382 views
Is this an SMS hack attempt?
A member of staff at work has been getting a number of texts like the below. He got a batch of them in July, and then again 2 weeks ago.
Am trying to find out if this is a hack attempt. Has anyone ...
2
votes
3answers
168 views
How hiding the SMS number really works?
I'm working in a web application and it has to include some send SMS feature; I'm planning to create an Android Application and use it to send SMS taking data from the server. The customer asked if ...
