Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.
2
votes
1answer
44 views
What Information is Exposed When I Send A Message From My Mobile Device
When I send a text message and/or an email, with or without location services turned on, what information is available to the recipient of that message if they know how to read the data behind the ...
3
votes
1answer
106 views
Should an administrator be able to turn off TFA for a user
We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users?
Google Auth uses SMS as backup option but SMS does not ...
0
votes
1answer
59 views
Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?
In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections.
This site is full of ...
10
votes
1answer
741 views
TextSecure protocol
Is anyone aware of an analysis of the TextSecure protocol?
https://whispersystems.org/blog/simplifying-otr-deniability/
https://github.com/WhisperSystems/TextSecure/wiki/Protocol
It is a ...
6
votes
3answers
595 views
Why does a spam sms contain a link to an email address?
A colleague of mine just received a (spam) sms with this message:
Congratulations! Your mobile have won $1,000,000,00 Pounds with Draw#
294 64/2013. For more info & claims, contact our ...
7
votes
2answers
579 views
How do I forensically determine whether a mobile phone has been infected with a spy suite?
What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)?
I have Blackberry and iPhone 4 phones that are ...
7
votes
1answer
346 views
Is there a list of phone numbers Facebook uses to send auth tokens?
Up to a few days ago, I always received Facebook auth tokens from numbers +181338477XX, except a few times from +85294985XXX.
Problem is that lately I've been receiving codes directly from Italian ...
17
votes
3answers
2k views
Could my bank's two-factor authentication be hacked?
When I attempt to log in to my bank, an SMS code is sent to my phone. I then type this nine-character code into the bank's Web site, to login to my account.
Is this vulnerable to attack, without ...
2
votes
1answer
314 views
Is TextKey SMS 2 factor authentication secure against cell phone cloning?
I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods.
In typical SMS authentication, the provider sends you an access code ...
2
votes
1answer
108 views
Send credentials by sms [duplicate]
If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
8
votes
1answer
343 views
Getting strange texts to an iPhone #PWD123456#00X
My dad is getting strange SMS texts to his iPhone 4
Some examples:
#PWD123456#WHL003=2308480298
#PWD123456#WHL004=2398480389
#PWD123456#WHL002
#PWD123456#WHL002
#PWD123456#STATUS?
...
-1
votes
1answer
344 views
Is it still possible to sign up for a Google account without SMS verification? (March, 2013) [closed]
Non of these two methods worked: http://googlesystem.blogspot.com/2012/01/new-google-accounts-require-gmail-and.html
2
votes
2answers
779 views
Retreive header from SMS iphone
I received a lot of SMS from a guy where the phone number change every time. I can answer to these SMS, so I think it's only a spoofing of the sender ID of the SMS header which will be displayed in ...
6
votes
2answers
248 views
Can a SMS recipient charge any arbitrary fee to the sender without approval?
I received an email from a prospective "client" in broken English. We have been going back and forth about services for a while and he wants me to text him. Is it possible for him to charge me some ...
-1
votes
2answers
123 views
Can 2FA help handle mixed personal and business accounts after leaving a company?
I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
26
votes
1answer
1k views
How does a new SMS message overwrite a previous one?
During a talk from a vendor, the speaker mentioned that their product used a "little known feature" of SMS in order to overwrite the last text message received from them. This feature was being used ...
8
votes
4answers
6k views
How can SMS spoofing be detected?
SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as ...
7
votes
4answers
447 views
Should SMS systems warn users of possible spoofing attacks?
The author of this blog post Never trust SMS: iOS text spoofing says that: The sender of an SMS message may provide arbitrary sender information using low level protocol features. Furthermore the ...
3
votes
4answers
514 views
SMS Authentication: random OTP or a cryptographic one
I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest:
Sending random 8 ...
1
vote
0answers
95 views
What's the deal with SMS archiving? [closed]
The other week I was texting a friend of mine, and something happened that I haven't experienced before. Instead of receiving the text I'd just sent, my friend received a text I sent several months ...
-6
votes
2answers
218 views
Is it possible to MITM between Google voice SMS/TXT Messaging
I have 2 spammers who won't stop spamming me via SMS once I post stuff online.
I would like to determine their location based on language, so if I were to somehow become a man in the middle and have ...
4
votes
1answer
409 views
How to catch a SMS spammer who is using google voice to spam me
How do I catch a SMS spammer who is using google voice to spam me?
I have the google voice number and 2 of their burner emails with gmail. How do I gather enough information to inform the ...
1
vote
0answers
194 views
Honeypot for catching a spammer [closed]
I've been receiving more and more emails and now even TXT messages originating from google voice for inquiries of items that I've listed for sale on craigslist.
What I would like to accomplish: I ...
25
votes
5answers
10k views
What is preventing us from sniffing the mobile phone communcation?
I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
5
votes
1answer
5k views
Is there a sms authentication that works like 10minutemail?
I remember reading on this site a user recommending 10minutemail.com as a way to register or give email address to non-trusted websites.
Is there any similar site for disposable phone number for ...
5
votes
1answer
277 views
SMS PDU specification and carving techniques?
I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on dreamfabric.com, but I'm having some trouble. First of all, the specification isn't ...
5
votes
3answers
1k views
Proof of SIM card possession on iOS devices
I need to proof that a user of my app is in possession of the correct SIM card.
On android devices, this is possible by simply sending a challenge within an SMS to the corresponding number (the proof ...
3
votes
2answers
1k views
SMS / voice call interception with a fake base station
This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
35
votes
6answers
7k views
How hard is it to intercept SMS (two-factor authentication)?
A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
3
votes
4answers
913 views
Can SMS text messages be used to verify a person's unique identity through a short code system?
We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
10
votes
3answers
830 views
Is it “standard” to SMS passwords?
When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and ...
