Questions tagged [sms]
Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.
1
vote
2answers
80 views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
8
votes
3answers
199 views
Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?
Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
2
votes
2answers
155 views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
0
votes
1answer
106 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
8
votes
3answers
363 views
Should I delete SMS messages containing one-time passwords?
I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset.
Should I delete those SMS messages after the one-time ...
0
votes
1answer
28 views
Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?
We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS.
But this ...
9
votes
1answer
274 views
is LastPass SMS Recovery a security risk?
According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords.
LastPass encrypts your Vault before it goes to the server using
256-bit AES encryption. Since the ...
-3
votes
1answer
391 views
How To detect Fake mobile number for SMS verification [closed]
I am facing some issues regarding SMS verification in my website. Suddenly, some transactions are happening using the fake numbers like https://www.receive-sms-online.info
How to detect the number is ...
-1
votes
3answers
113 views
Is it Unrestricted file upload vulnerability?
I am using a messenger app that's similar to WhatsApp.
This app allows me to send any type of files, like Html, Php, SWF etc. via text messages.
Is this a vulnerability?
3
votes
1answer
223 views
SMS based 2FA intercepts
Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
-1
votes
1answer
59 views
Unable to utilise curl commands on website [closed]
There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
2
votes
1answer
113 views
Phone Number Appears to Have Been Temporarily Hijacked
What Happened:
At 8:40am Telegram sends me a login code via the Telegram desktop app.
At 8:44am Telegram informs me that someone has logged into my
account via ip address #1 (appears to be PIA vpn)
I ...
3
votes
1answer
60 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
1
vote
1answer
113 views
SMS OTP as 2FA - should there be sms session id in sms for user's verification?
Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
1
vote
0answers
43 views
Is it possible for old text messages to be used in an SMS spoofing attempt?
Background
The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email.
The Issue
...
2
votes
0answers
317 views
Prevent against OTP abuse in app sign up flow
This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue.
Let's say there is an app that ...
2
votes
1answer
116 views
What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?
There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
139
votes
2answers
26k views
Received a set of SMS/MMS containing 2 photos, a voice message, and a text “I need help” with Google Maps link from a known contact. Is it spam?
My girlfriend (let's call her Jane) just got a set of SMS or MMS messages coming from a friend of her (let's call her Hellen). These messages contain:
Two photos of Hellen
A voice message
A text that ...
2
votes
0answers
98 views
“Reply T to unsubscribe” in SMS spam messages, ignore or reply “T”? [duplicate]
I'm in China and I occasionally get spam SMS messages. Most of them ends in a sentence that says this or something else alike.
Reply T to unsubscribe.
(T is the leading letter in Chinese word "...
1
vote
1answer
141 views
Can SMS messages be traced when they come from a computer?
From Amazon SNS, I can send SMS messages to any mobile phone.
To recipient phones, the SenderId is just a string of my choosing. The messages cannot be replied to.
I receive quite a few phishing ...
-1
votes
1answer
487 views
How to avoid silent SMS attack?
I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
1
vote
1answer
184 views
Received SMS/MMS with suspicious link - what to do now?
I today received a personalized sms on my android phone which:
addresses me by my first name
is labeled sms/mms
claims to be from a contact with a first name which I do not have in my contact list, ...
3
votes
1answer
43 views
Providing a SMS recovery feature without compromising the security of an account
I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either:
Providing the password for the account
Resetting the password using ...
1
vote
1answer
2k views
Reply to a spoofed SMS message
If my phone number is (212)555-1212 and Bob spoofs my number vias SMS to Alice, will Alice's reply be sent to Bob, me or both?
EDIT: The concern is that the spoof prompts Alice to disclose ...
1
vote
1answer
67 views
Secure forwarding of 2FA SMS codes [closed]
Do solutions exist for forwarding SMS messages whereby:
the service provider stores no logs of messages
login protection with google authenticator or comparable
2
votes
1answer
216 views
Is it normal to receive working SMS verification code from strange number?
Here is a sample SMS that usually I trust:
The sender is in a text format and there is an information saying the sender does not support replies.
When I tried to login, I received verification code ...
4
votes
1answer
376 views
Password Reset Chatbot with Authentication through text message
I just saw a design for a chatbot that resets a password for a locked out user after failed logins. It authenticates the user by sending a text message to the user's phone.
How practically safe is ...
5
votes
1answer
197 views
Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)
In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
3
votes
1answer
147 views
Does SMS flood cause denial of service even when “blocked”?
Imagine a SMS flood using a few phone numbers. The client blocks the phone numbers using the build in mechanism of the smart phone, and thus does not receive any notifications. Even though the user ...
1
vote
0answers
135 views
How difficult are SS7 hacks? [duplicate]
Out of band communication via SMS has recently been shunned due to SS7 hacks. How likely are these to become more prevalent? I saw this question:
Should 2FA over SMS be considered insecure in the ...
6
votes
1answer
175 views
Alternatives to SMS as a out-of-band channel
I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
1
vote
1answer
48 views
How secure it is to identify a user by an sms's caller id?
I need to verify a user based on its phone number. I am thinking that instead of me sending him an sms, it would be cheaper if he sends me the sms and I verify he's phone number based on his caller ID....
2
votes
2answers
5k views
Got a paypal confirmation code when I don't even have an account? [closed]
Basically just right now I got a text on my phone giving me a code that expires in 5 minutes. The scary thing is that I've never used paypal ever in my life. Is this just someone mistyping his phone ...
1
vote
1answer
9k views
Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver?
A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I ...
2
votes
0answers
63 views
How can I go about securing services that require SMS tokens as backups?
I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
1
vote
4answers
169 views
Is a SIM card secure against governments?
Let's say I live in Russia and I use Gmail. My Gmail has my phone number for recovery in case I lost my Gmail password.
Obviously if Russian police want to access my Gmail account then they can ...
0
votes
1answer
256 views
What action plan a hacker can do to enter an iPhone [closed]
I am interested by mobile protection for general public, we have all information saved on our phone. I am thinking what action plan a hacker can do with Kali or other to enter an iPhone and read SMS, ...
2
votes
0answers
76 views
Could an attacker delete messages using an MMS exploit?
My SMS messages are getting deleted. What I noticed is, that some number keeps sending me MMS messages, mostly pictures. Yes, I had the "accept MMS automatically" turned on my Samsung device to ON.
...
1
vote
1answer
92 views
Someone is bothering me by messaging through websites message services [closed]
Someone is sending me sms from last few weeks through 'SMS sending websites' who don't publish the sender name in the message. Sometimes it shows ' sent through websms' in the message. Please help if ...
2
votes
1answer
87 views
Responsibility of disclosing potential social engineering attack
I've just gotten a text message from a number pretending to be my bank and telling me to install a certificate from a suspicious link (link looks like this: bankname-certificate.ru/installation not ...
2
votes
1answer
107 views
How do 2FA (and other account verification) systems identify true mobile numbers vs VoIP numbers?
I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages.
My goal was to have a dedicated DID/number which I don't ...
1
vote
2answers
311 views
SMS based authentication, handling recycled phone numbers?
If a site requires you to authenticate with only a phone number and a one time login code, what safeguards can be put in place such that when I change my phone number and the phone company recycles it,...
1
vote
2answers
153 views
ELI5: What is the goal of the senders of the fake texts I receive
^^^Fake text sent to me, have received 10 this week. This was in the first batch of four I received around 630 am this week. It is incorrectly dated to say 2013 and it says PM but was actually ...
1
vote
0answers
157 views
Are my SMS messages being intercepted? Or is this some kind of issue with the app itself?
When getting verification codes, I've been getting weird messages, such as:
YoUR siGnaL veRiFICATioN c(O(D(E(: ***-***
YOUR SIgNal VERiFICAtION c)O)D)E): ***-***
yoUR siGnaL veRificATiON ...
3
votes
1answer
1k views
Catch incoming SMS/Calls in a fake GSM Network
I am currently working on a Project where I am doing a downgrade attack from LTE to GSM. I am using OpenLTE and OpenBTS for creating the fake base stations.
When the phone connects to the fake GSM ...
2
votes
3answers
923 views
Storing password in sqlite vs asking user to type it in every time
I am making an Android app that needs to be very secure. For authentication to the server, it will use 2-factor authentication that includes:
username/password
sms verification
I can't use client ...
66
votes
4answers
23k views
Are there any security risks in replying to an SMS message?
I routinely receive seemingly harmless SMS messages from unknown people. They're usually simple, like "Hi" or "Hello" or "Are you there?". This happens several times a week, and certainly often enough ...
1
vote
2answers
533 views
How to secure Google Account from SIM hijacking & intercepting Two factor SMS codes on the way & still keep it accessible?
As mentioned on many places at web, SIM cards are one of the weakest link in Two Factor Authentication process. Bad actors can impersonate as user to Telecom Company to get duplicate SIM, or simply ...
0
votes
1answer
203 views
SMS Encryption with Hashing [closed]
I need help, I want to send a encrypted SMS from Alice to Bob, where does hashing comes in here? How do I use the hashing??
0
votes
1answer
217 views
How Could A Diffie Hellman Key Exchange Work on SMS Apps on Two Different Mobile Devices?
How Could A Diffie Hellman Key Exchange Work on SMS Android Apps on Two Different Mobile Devices? It is understandable for a client browser communicating with a server, the internet data path is ...
