Skip to main content

Questions tagged [sms]

Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
455 views

Unable to utilise curl commands on website [closed]

There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
John Greeny's user avatar
2 votes
1 answer
326 views

Phone Number Appears to Have Been Temporarily Hijacked

What Happened: At 8:40am Telegram sends me a login code via the Telegram desktop app. At 8:44am Telegram informs me that someone has logged into my account via ip address #1 (appears to be PIA vpn) I ...
rhythmthumper's user avatar
3 votes
1 answer
267 views

Call and Unsolicited One Time Passwords

Context: I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
Shayan's user avatar
  • 33
1 vote
1 answer
472 views

SMS OTP as 2FA - should there be sms session id in sms for user's verification?

Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
vsespb's user avatar
  • 29
1 vote
0 answers
136 views

Is it possible for old text messages to be used in an SMS spoofing attempt?

Background The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email. The Issue ...
algernon's user avatar
20 votes
4 answers
8k views

Prevent against OTP abuse in app sign up flow

This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue. Let's say there is an app that ...
qre0ct's user avatar
  • 1,522
2 votes
1 answer
208 views

What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?

There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
popeye_the_sailorman's user avatar
137 votes
2 answers
46k views

Received a set of SMS/MMS containing 2 photos, a voice message, and a text "I need help" with Google Maps link from a known contact. Is it spam?

My girlfriend (let's call her Jane) just got a set of SMS or MMS messages coming from a friend of her (let's call her Hellen). These messages contain: Two photos of Hellen A voice message A text that ...
ravasaurio's user avatar
  • 1,221
2 votes
0 answers
164 views

"Reply T to unsubscribe" in SMS spam messages, ignore or reply "T"? [duplicate]

I'm in China and I occasionally get spam SMS messages. Most of them ends in a sentence that says this or something else alike. Reply T to unsubscribe. (T is the leading letter in Chinese word "...
iBug's user avatar
  • 1,378
2 votes
1 answer
743 views

Can SMS messages be traced when they come from a computer?

From Amazon SNS, I can send SMS messages to any mobile phone. To recipient phones, the SenderId is just a string of my choosing. The messages cannot be replied to. I receive quite a few phishing ...
Robin's user avatar
  • 121
-1 votes
1 answer
2k views

How to avoid silent SMS attack?

I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
user235956's user avatar
1 vote
1 answer
660 views

Received SMS/MMS with suspicious link - what to do now?

I today received a personalized sms on my android phone which: addresses me by my first name is labeled sms/mms claims to be from a contact with a first name which I do not have in my contact list, ...
Techradar's user avatar
  • 177
3 votes
1 answer
145 views

Providing a SMS recovery feature without compromising the security of an account

I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either: Providing the password for the account Resetting the password using ...
Mrwerdo's user avatar
  • 142
2 votes
1 answer
13k views

Reply to a spoofed SMS message

If my phone number is (212)555-1212 and Bob spoofs my number vias SMS to Alice, will Alice's reply be sent to Bob, me or both? EDIT: The concern is that the spoof prompts Alice to disclose ...
gatorback's user avatar
  • 1,531
1 vote
1 answer
356 views

Secure forwarding of 2FA SMS codes [closed]

Do solutions exist for forwarding SMS messages whereby: the service provider stores no logs of messages login protection with google authenticator or comparable
user1935987's user avatar
4 votes
1 answer
3k views

Is it normal to receive working SMS verification code from strange number?

Here is a sample SMS that usually I trust: The sender is in a text format and there is an information saying the sender does not support replies. When I tried to login, I received verification code ...
a20_umb's user avatar
  • 43
4 votes
1 answer
1k views

Password Reset Chatbot with Authentication through text message

I just saw a design for a chatbot that resets a password for a locked out user after failed logins. It authenticates the user by sending a text message to the user's phone. How practically safe is ...
David West's user avatar
5 votes
1 answer
496 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
Sum's user avatar
  • 113
3 votes
1 answer
364 views

Does SMS flood cause denial of service even when "blocked"?

Imagine a SMS flood using a few phone numbers. The client blocks the phone numbers using the build in mechanism of the smart phone, and thus does not receive any notifications. Even though the user ...
Daniel Grover's user avatar
1 vote
0 answers
232 views

How difficult are SS7 hacks? [duplicate]

Out of band communication via SMS has recently been shunned due to SS7 hacks. How likely are these to become more prevalent? I saw this question: Should 2FA over SMS be considered insecure in the ...
Chri3's user avatar
  • 327
6 votes
1 answer
350 views

Alternatives to SMS as a out-of-band channel

I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
Chri3's user avatar
  • 327
1 vote
1 answer
116 views

How secure it is to identify a user by an sms's caller id?

I need to verify a user based on its phone number. I am thinking that instead of me sending him an sms, it would be cheaper if he sends me the sms and I verify he's phone number based on his caller ID....
awavi's user avatar
  • 113
2 votes
2 answers
36k views

Got a paypal confirmation code when I don't even have an account? [closed]

Basically just right now I got a text on my phone giving me a code that expires in 5 minutes. The scary thing is that I've never used paypal ever in my life. Is this just someone mistyping his phone ...
MrSomeone's user avatar
2 votes
1 answer
137k views

Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver?

A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I ...
cr0's user avatar
  • 373
2 votes
0 answers
145 views

How can I go about securing services that require SMS tokens as backups?

I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
Steve Rukuts's user avatar
1 vote
4 answers
362 views

Is a SIM card secure against governments?

Let's say I live in Russia and I use Gmail. My Gmail has my phone number for recovery in case I lost my Gmail password. Obviously if Russian police want to access my Gmail account then they can ...
ilhan's user avatar
  • 415
0 votes
1 answer
1k views

What action plan a hacker can do to enter an iPhone [closed]

I am interested by mobile protection for general public, we have all information saved on our phone. I am thinking what action plan a hacker can do with Kali or other to enter an iPhone and read SMS, ...
user avatar
2 votes
0 answers
166 views

Could an attacker delete messages using an MMS exploit?

My SMS messages are getting deleted. What I noticed is, that some number keeps sending me MMS messages, mostly pictures. Yes, I had the "accept MMS automatically" turned on my Samsung device to ON. ...
balex's user avatar
  • 272
1 vote
1 answer
166 views

Someone is bothering me by messaging through websites message services [closed]

Someone is sending me sms from last few weeks through 'SMS sending websites' who don't publish the sender name in the message. Sometimes it shows ' sent through websms' in the message. Please help if ...
Rohit's user avatar
  • 11
2 votes
1 answer
159 views

Responsibility of disclosing potential social engineering attack

I've just gotten a text message from a number pretending to be my bank and telling me to install a certificate from a suspicious link (link looks like this: bankname-certificate.ru/installation not ...
Florian Humblot's user avatar
4 votes
2 answers
469 views

How do 2FA (and other account verification) systems identify true mobile numbers vs VoIP numbers?

I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages. My goal was to have a dedicated DID/number which I don't ...
TheDave's user avatar
  • 41
1 vote
2 answers
1k views

SMS based authentication, handling recycled phone numbers?

If a site requires you to authenticate with only a phone number and a one time login code, what safeguards can be put in place such that when I change my phone number and the phone company recycles it,...
tt9's user avatar
  • 121
1 vote
2 answers
802 views

ELI5: What is the goal of the senders of the fake texts I receive

^^^Fake text sent to me, have received 10 this week. This was in the first batch of four I received around 630 am this week. It is incorrectly dated to say 2013 and it says PM but was actually ...
PuckLife's user avatar
1 vote
0 answers
349 views

Are my SMS messages being intercepted? Or is this some kind of issue with the app itself?

When getting verification codes, I've been getting weird messages, such as: YoUR siGnaL veRiFICATioN c(O(D(E(: ***-*** YOUR SIgNal VERiFICAtION c)O)D)E): ***-*** yoUR siGnaL veRificATiON ...
simplegamer's user avatar
3 votes
1 answer
4k views

Catch incoming SMS/Calls in a fake GSM Network

I am currently working on a Project where I am doing a downgrade attack from LTE to GSM. I am using OpenLTE and OpenBTS for creating the fake base stations. When the phone connects to the fake GSM ...
slashcrypto's user avatar
2 votes
3 answers
2k views

Storing password in sqlite vs asking user to type it in every time

I am making an Android app that needs to be very secure. For authentication to the server, it will use 2-factor authentication that includes: username/password sms verification I can't use client ...
user3362334's user avatar
69 votes
4 answers
120k views

Are there any security risks in replying to an SMS message?

I routinely receive seemingly harmless SMS messages from unknown people. They're usually simple, like "Hi" or "Hello" or "Are you there?". This happens several times a week, and certainly often enough ...
Caleb's user avatar
  • 669
2 votes
2 answers
1k views

How to secure Google Account from SIM hijacking & intercepting Two factor SMS codes on the way & still keep it accessible?

As mentioned on many places at web, SIM cards are one of the weakest link in Two Factor Authentication process. Bad actors can impersonate as user to Telecom Company to get duplicate SIM, or simply ...
DavChana's user avatar
  • 123
0 votes
1 answer
579 views

SMS Encryption with Hashing [closed]

I need help, I want to send a encrypted SMS from Alice to Bob, where does hashing comes in here? How do I use the hashing??
Faisal Ali Gama's user avatar
0 votes
1 answer
492 views

How Could A Diffie Hellman Key Exchange Work on SMS Apps on Two Different Mobile Devices?

How Could A Diffie Hellman Key Exchange Work on SMS Android Apps on Two Different Mobile Devices? It is understandable for a client browser communicating with a server, the internet data path is ...
Faisal Ali Gama's user avatar
2 votes
2 answers
3k views

Google login 2 factor authentication sms -fake or real?

All my 2 factor authentication used to come from Google sms, but recently I've had the following numbers come up on my phone. I realise that to do this the person would need to have my phone number. I ...
user637251's user avatar
3 votes
1 answer
12k views

Identify suspicious flood of SMS (phone exploit?) [closed]

edit Based on comments and answers, there seems to be some misconception. Allow me to clarify: I have of course searched for REG-RESP on Google prior to writing this question, but what is to be found ...
Damon's user avatar
  • 5,221
1 vote
1 answer
463 views

has there ever been router virus able to send SMS (text)

I am fighting with my network provider. If I have router with LTE GSM Card inside, is it possible for router malware to send text messages from it? Or has it ever been done? They say I subscribed to ...
Gerard Domek's user avatar
-1 votes
1 answer
218 views

Spoofing a message [closed]

Theoretically, if a sender spoofs a number and sends a text, how can the sender get the receiver to reply to the message but having the reply go specifically to a different number?
user130306's user avatar
13 votes
5 answers
3k views

SMS verification, is it secure? [duplicate]

In my web app (everything works with HTTPS), I send the user an SMS with a unique 5-digit code to a cellphone number he provides. I then ask the user to enter in the browser the code he received. ...
frenchie's user avatar
  • 1,091
3 votes
1 answer
2k views

Is this an SMS hack attempt?

A member of staff at work has been getting a number of texts like the below. He got a batch of them in July, and then again 2 weeks ago. Am trying to find out if this is a hack attempt. Has anyone ...
TemperedGlass's user avatar
2 votes
3 answers
571 views

How hiding the SMS number really works?

I'm working in a web application and it has to include some send SMS feature; I'm planning to create an Android Application and use it to send SMS taking data from the server. The customer asked if ...
NathanWay's user avatar
  • 559
1 vote
0 answers
364 views

PDU: SMS-DELIVER direct from a GSM Modem

My understanding of the SMS-DELIVER/SMS-SUBMIT is that when Bob wants to send a text on the GSM the following happens... Bob submits a request to send a short message to a short message service ...
otacat's user avatar
  • 11
2 votes
2 answers
5k views

Can SMS messages be traced to a specific phone after one month time has passed? [closed]

I have been cyber bullied by an unknown assailant. They sent several emails using a throwaway GMail account and then sent several SMS texts from two different phone numbers. The last number actually ...
user126350's user avatar
4 votes
2 answers
1k views

3G/4G network SMS Interception

I am not really experienced with how the 3G/4G network work, but I know that SS7 have some security vulnerabilities, and Diameter protocol brought over some of the SS7 vulnerabilities. So I would ...
iOSAndroid's user avatar