Hot answers tagged

185

This does not seem to be a virus. It is a panic function in some android phones, that allows to send these messages in case you are kidnapped or otherwise in danger by pressing the power button 3 times. She must have activated it accidentally. More info here and here.


108

This is an exact description of the panic feature built into phones as Peter Harmann already said. Anecdotally I can tell you on my previous Samsung smartphone, I could trigger this exact feature by pressing the power button 3 times in a quick succession. My phone would then take a couple pictures record a short clip of audio and then text those along with ...


78

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV games where each participant pays a little money when calling a special number or sending a SMS. At the end, either one of the players earns something, or the ...


59

The primary attack method against text message OTP is to 'sim swap' and take over the target's phone number. If the site provided the full number in this scenario, they'd be giving the attacker exactly the information they need to break the security being used. (To lift up comments: In general, more personal information is needed, if you're going to social ...


50

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the attack. Even an "average user" might have crypto wallets or precious twitter accounts. Sometimes the gain of an attack is also not that obvious, like when a ...


33

One useful thing an attacker could gather is what your response time is at different times during the day and also things like your sleep schedule. If you leave your phone at home when you go jogging or to a meditation class they may be able to determine times at which other entities may not be able to reach you quickly. This may give the attacker knowledge ...


29

If you publish you mobile number in a directory such as Spokeo they can look you up If you use Telegram, the other person will be able to see your public name. Your last seen online time could be retrieved either precisely or imprecisely depending on your privacy settings - this information cannot be hidden completely. Telegram will always tell anyone ...


26

This is not about a "vulnerability". This is about personally identifiable information (PII). It's the same reason why credit cards numbers are not displayed in full on sites either. Anyone passing by your screen, cameras recording, etc, would see the info. And it's not necessary to show the whole number. It's just there as a reminder to the user.


24

The telecommunications service provider (your cell phone company) has to transmit the SMS and MMS messages to their recipients; so yes, the provider has to store them, however briefly. Most providers retain messages for varying, not-so-brief, periods of time. Search [sms carrier retention period].


23

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in the ...


21

Why can't you use TOTP or HOTP which is standard and supported by most authenticator apps? When people register for your service they need to enroll their authenticator app by scanning a QR code which contains the secret seed used to generate codes. On subsequent visits the site prompts them to enter codes generated by the app, without any network access ...


17

If a phone is not on the network messages must be stored until they can be delivered, so SMSCs and MMSCs have storage capabilities. SMS and MMS messages can be retained indefinitely on the system or they can be exported to an archive if the carrier chooses. If governments are storing phone call records they are almost certainly retaining SMS and MMS messages....


17

Call is safer, for reading your sms you only need a simple program whereas for monitoring your calls, you need an actual person, thereby increasing the effort needed by a lot. Reading sms is something you can do on as many phones as you want whereas listening to that many calls at the same time is impossible (unless you're the NSA I guess). Even if you ...


17

I'm going to say no. While SMS is a generally accepted 2nd factor, there have been a number of cases where an attacker has used social engineering to break into a user's carrier account and pick up the verification code and use it. So to answer your question, is it 100% secure aside from guessing, no. EDIT: To add to this information, even NIST is removing ...


16

Make a demonstration video. I have found that demonstration videos are an incredibly powerful way to communicate security issues, capturing the attention of managers who would otherwise dismiss this as "geeks talking geek". Try to make the video as real life as possible. Include an example that is not just "oh look, this shouldn't happen" but actually ...


16

Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective. Most stuff, including every new system that comes up every few months and that completely obsoletes everything else is usually based on personal financial interests, dogma, belief, and snake oil. ...


14

It really will depend on your threat model. SMS may be easier to sniff, or to be intercepted by an malicious app on your phone. So if you are worried about those kind of attack, it may be the better to use the call option. However, most phones will not require a device unlock to accept a call, so if you leave your phone unattended, ex on your desk, (or it ...


14

If the full number were listed then I could visit your account, request a new password, and know your phone number. The last two digits are a tradeoff that permit you to know its (likely) your number without giving away your phone number to anybody who wants to view it on the website.


12

What you describe is absolutely not a secure approach. SMS messages are broadcast over the air without guarantee of encryption. They can be intercepted and recorded. In addition, your SMS messages are only as secure as your provider. Hackers can execute a social engineering attack: such as convincing a cellular carriers tech support to send messages ...


12

Yes, it is a slight security risk, for the reason Conor Mancone points out. But no, it does not mean that LastPass stores your master password on their servers, and would-be hackers need to do more than just obtain the recovery SMS. To use SMS recovery, you must have access to a computer and browser where you have previously used LastPass. LastPass ...


11

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


11

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices. The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch. I'll try to translate the commands for you #...


10

"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability and risk against cost and inconvenience. A different question you could ask is whether SMS 2FA is sufficient mitigation against criminal teams working on mass ...


9

The other answers already explain the security of GSM and the technologies involved against technical attacks. However, there are a number of other attacks which bypass the technical protections. The German Wikipedia article on transaction authentication numbers (which are often sent by SMS) lists some attacks: stealing or stealthily access the victim's ...


9

If I were in your position, I would grab complete image(s) of the individual mobile device(s) to forensically analyze the images using another, independent system because… You do not have to install anything on the related mobile devices as you can analyze the device image(s) on your other system with any tool you like/want/need. You can modify (in the ...


8

The service makes all SMS they receive available to any internet user. That means any confidential information you receive via SMS is compromised. Many websites which use two-factor authentication via SMS also use SMS to communicate other confidential information to you. This information isn't confidential anymore in this case. They might, for example, also ...


8

The text message to infect your device with the Mazar bot looks like this: You have received a multimedia message from +[country code] [sender number] Follow the link http: //www.mmsforyou [.] Net / mms.apk to view the message. Don't run the link and you don't get infected. You can also ensure that the option to not allow installation of applications ...


8

This is a classic implementation choice to help reduce data entry mistakes. People who are in computer sciences or information security understand the difference between a text string and a series of digits that represents a value. But people who have been trained in finance, accounting, and other fields have been taught to truncate leading zeros when ...


8

As usual, let's start by defining the threat model: you're worried about someone getting a hold of your phone and looking through your SMS history. But you're not worried about the SMSes being intercepted. That's a bit of an odd security model cause intercepting SMSes is really easy, and stealing your phone and getting through a strong password is relatively ...


8

Great question! I'll attempt to break down the security models. Is there anything inherently more secure about having users enter a 4/8 digit code online vs. sending a code or simple message from their device? While SMS as a whole makes for a weak 2FA method (see the article above from The Verge), at least the former requires the attacker to do some ...


Only top voted, non community-wiki answers of a minimum length are eligible