Summary of SMS history

In1990 the European Telecommunication Standards Institute public specifications of the then new GSM system. In this specification was introduced to a sub-protocol, initially little known because little publicized.


None of the experts, in the early '90s, he never imagined that a service for sending short text messages (Short Message Service, SMS precisely) would have been so successful in the future.
Designed initially as a service for the distribution of broadcast information, it also had the ability to send short messages between terminals: no one believed it, because it seemed too complicated and exhausting Write a message using only the buttons on a phone and T9 was not even on the horizon.


What then is an SMS? This is a simple text message of up to 160 characters, 7 bit format.
Are exchanged between mobile phone and SMSC (Short Message Service Center) and between SMSC, are delivered using the signaling channel, thus allowing reception even when the channel voice / data are already committed.


SMS are received from the terminal with a set of data 'accessories': well (of course) to the text of the message, the SMSC sends the mobile phone among other things, the number of the sender and the number of the gateway used. In the Protocol, however, not enter any authentication system, so you can be sure that the number of the sender is really the one received, the sender is in fact sent by the terminal itself all SMSC, and there actually a way to change it.

SMS Spoofing - falsified the sender's SMS

Several years ago, everybody amused themselves by sending e-mails as bill.gates @ microsoft.com. Today, the majority of the society quick exchange of messages is associated rather with SMS, not e-mail. Unfortunately, the new communication protocols used in GSM networks are just as vulnerable as the old and worn-out SMTP. Today we look at the falsification of the sender field in SMS messages and threats that this brings. We will learn also how to recognize fake SMS messages.

How to fake a sender field in the SMS?

The easiest way is to use one of the sites goals. Virtually none of them is now available free services, but they are not especially expensive.

Attacks (smashing and threats)

Please note that by sending SMS with a false sender does not have a return channel (any attempt to answer the sacrifice of our SMS will be forwarded to the original owner of the number, and not to us). Thus, all attacks consist mainly was to get the victim to perform some action (phishing, threats).

Doubling as the number of technical director can instruct the employee such as the IT department to open port on your company's firewall. Pretending to be a person close to the victim can ask to transfer money to the specified in the SMS account number ... Finally, you can send yourself a text message with the number of the boss (wife), containing information on the increase (an invitation to dinner), and strongly demand the promise.

ID theft websites

another group of attack is the possibility of identity theft and publishing content on behalf of another user on one of the websites where the attacked user has an account (if the service allows you to add content via SMS / MMS). In Poland, it can be: Our-Class, Blip and Flakers (and probably many others). If you have a website associated with that phone number to sending fake SMS to a service access number will update the content in the profile of the victim. Service thought that the author of SMS is its user (and not the gateway).