We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

185

This does not seem to be a virus. It is a panic function in some android phones, that allows to send these messages in case you are kidnapped or otherwise in danger by pressing the power button 3 times. She must have activated it accidentally. More info here and here.


107

This is an exact description of the panic feature built into phones as Peter Harmann already said. Anecdotally I can tell you on my previous Samsung smartphone, I could trigger this exact feature by pressing the power button 3 times in a quick succession. My phone would then take a couple pictures record a short clip of audio and then text those along with ...


103

GSM includes some protection through cryptography. The mobile phone and the provider (i.e. the base station which is part of the provider's network) authenticate each other relatively to a shared secret, which is known to the provider and stored in the user's SIM card. Some algorithms known under the code names "A3" and "A8" are involved in the ...


76

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV games where each participant pays a little money when calling a special number or sending a SMS. At the end, either one of the players earns something, or the ...


48

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the attack. Even an "average user" might have crypto wallets or precious twitter accounts. Sometimes the gain of an attack is also not that obvious, like when a ...


33

For telecommunications, check out GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations. For interception of GSM, I refer you to a white paper ...


33

One useful thing an attacker could gather is what your response time is at different times during the day and also things like your sleep schedule. If you leave your phone at home when you go jogging or to a meditation class they may be able to determine times at which other entities may not be able to reach you quickly. This may give the attacker knowledge ...


29

This is built in to SMS and is implemented in the Protocol Identifier (TP-PID): For MT short messages, on receipt of a short message from from the SC, the MS shall check to see if the associated Protocol Identifier contains a Replace Short Message Type code. If such a code is present, the the MS will check the originating address and replace ...


24

The telecommunications service provider (your cell phone company) has to transmit the SMS and MMS messages to their recipients; so yes, the provider has to store them, however briefly. Most providers retain messages for varying, not-so-brief, periods of time. Search [sms carrier retention period].


21

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in the ...


20

Why can't you use TOTP or HOTP which is standard and supported by most authenticator apps? When people register for your service they need to enroll their authenticator app by scanning a QR code which contains the secret seed used to generate codes. On subsequent visits the site prompts them to enter codes generated by the app, without any network access ...


17

If a phone is not on the network messages must be stored until they can be delivered, so SMSCs and MMSCs have storage capabilities. SMS and MMS messages can be retained indefinitely on the system or they can be exported to an archive if the carrier chooses. If governments are storing phone call records they are almost certainly retaining SMS and MMS messages....


17

Call is safer, for reading your sms you only need a simple program whereas for monitoring your calls, you need an actual person, thereby increasing the effort needed by a lot. Reading sms is something you can do on as many phones as you want whereas listening to that many calls at the same time is impossible (unless you're the NSA I guess). Even if you ...


17

I'm going to say no. While SMS is a generally accepted 2nd factor, there have been a number of cases where an attacker has used social engineering to break into a user's carrier account and pick up the verification code and use it. So to answer your question, is it 100% secure aside from guessing, no. EDIT: To add to this information, even NIST is removing ...


16

it's fairly standard to separate the username and password into multiple instances or (better) multiple forms of communication. Some send two separate emails (lol), some send an email and a phone call for the password, you'll find all sorts of methods for separating these. But a couple things should be kept in mind. 1) any password written anywhere or sent ...


16

Make a demonstration video. I have found that demonstration videos are an incredibly powerful way to communicate security issues, capturing the attention of managers who would otherwise dismiss this as "geeks talking geek". Try to make the video as real life as possible. Include an example that is not just "oh look, this shouldn't happen" but actually ...


15

Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective. Most stuff, including every new system that comes up every few months and that completely obsoletes everything else is usually based on personal financial interests, dogma, belief, and snake oil. ...


14

GSM Network is encrypted. But that doesn't make it bullet-proof of course. It can be compromised. However, the attacks Rook (and later in much more detail Thomas Pornin) described are very localized and requires significant effort to accomplish. They are not impossible, but very difficult. It requires breaking the GSM network in proximity of the mobile phone ...


14

It really will depend on your threat model. SMS may be easier to sniff, or to be intercepted by an malicious app on your phone. So if you are worried about those kind of attack, it may be the better to use the call option. However, most phones will not require a device unlock to accept a call, so if you leave your phone unattended, ex on your desk, (or it ...


13

Don't play cops and robbers, just report the issue to Google and they will take care of it. Google and the authorities have better tools and people who are paid to deal with these criminals. That being said, one way to identify someone online via chat or sms is to get them to visit a URL. This could load a page that logs the IP address, and then you can ...


13

Like any other secured communication, it could be possible to decode the GSM/CDMA wireless traffic; question is how tough it is and how much infrastructure cost is required to decode them. Coming to a simple answer though much details and analysis have already been posted here, it is difficult to intercept them because: There exist a secure element in the ...


12

What you describe is absolutely not a secure approach. SMS messages are broadcast over the air without guarantee of encryption. They can be intercepted and recorded. In addition, your SMS messages are only as secure as your provider. Hackers can execute a social engineering attack: such as convincing a cellular carriers tech support to send messages ...


11

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices. The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch. I'll try to translate the commands for you #...


11

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


10

"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability and risk against cost and inconvenience. A different question you could ask is whether SMS 2FA is sufficient mitigation against criminal teams working on mass ...


9

While discussions about encryption are interesting, I think the key question is: are the carriers incented to care about security? I fear the answer is "no". What is their incentive to spend money securing their SMS systems? Do they even manage them or is it out-sourced? What guarantees of security do they offer? How much do you trust the people ...


9

If done properly, time-based one-time passwords will be reasonably secure. That's a bigger "if" than usually assumed. What would work would be the following: Decide about your time granularity, e.g. 5 minutes. All dates considered here will be a multiple of that granularity (i.e. 8:05:00, 17:25:00... but not 16:34:00). Generate a secret symmetric key K of ...


9

If I were in your position, I would grab complete image(s) of the individual mobile device(s) to forensically analyze the images using another, independent system because… You do not have to install anything on the related mobile devices as you can analyze the device image(s) on your other system with any tool you like/want/need. You can modify (in the ...


9

Yes, it is a slight security risk, for the reason Conor Mancone points out. But no, it does not mean that LastPass stores your master password on their servers, and would-be hackers need to do more than just obtain the recovery SMS. To use SMS recovery, you must have access to a computer and browser where you have previously used LastPass. LastPass ...


8

you're right, wireless communications are all around us. We can detect them, but they are encrypted. 3G security seems to be based around the concepts of secure authentication and encrypted communication. Here's an interesting article on the subject. 3G Security Architecture There are five different sets of features that are part of the architecture: ...


Only top voted, non community-wiki answers of a minimum length are eligible