4 ms·
You can't really intercept SMS with this, you know that, right? You can't just write any existing number and start to receive messages sent to that number. You
by pilsetnieks 9y ago
You can't really intercept SMS with this, you know that, right? You can't just write any existing number and start to receive messages sent to that number. You can only use this to receive messages sent to phone numbers assigned to Mailinator, and frankly, if you're using their numbers as a 2nd auth factor, you kinda deserve what you get. It's no different than signing up for any service with a Mailinator email address.
The only bad scenario was if they somehow got hold of real mobile numbers that real people were actually using before but that were lapsed and got recycled, without those people removing the numbers from, say, their Gmail accounts.
- deleted 9y ago[deleted]
- tehlike 9y agoNot with this, but intercepting sms's do exist. https://en.wikipedia.org/wiki/Stingray_phone_tracker#Interception_of_communications_content https://en.wikipedia.org/wiki/Stingray_phone_tracker#Interce...
- aviv 9y agoIntercepting SMS is incredibly easy. Not with this tool, but via other methods. SMS is broken and should never be used for any type of sensitive communication, be it 2fa or pics you don't want to see online.
- abledon 9y agowhat other methods?
- Rjevski 9y agoAsking the host carrier nicely via SS7. > Hey I'm one of your roaming partners and this phone here is roaming on my network, can you send me their calls & texts? > Sure mate, here they are, enjoy!
- bogomipz 9y ago>"Asking the host carrier nicely via SS7." Can you elaborate? SS7 is signaling. You can't request a Telecom provider to just start send you all someones calls and texts via SS7. The SMSC routes an SMS to the IMEI of the phone.
- Rjevski 9y ago> Can you elaborate? SS7 is signaling. You can't request a Telecom provider to just start send you all someones calls and texts via SS7. I was simplifying, but how roaming works is that on every call a mobile number from the visited network is assigned to the SIM, and the host network is instructed to send the call there; in the case of an attacker I expect them to be able to use this mechanism to send calls anywhere they want. They could also most likely fake USSD which is I believe used behind the "Call forwarding" toggle in your phone's settings. There are plenty of SS7-related demos & presentations posted here on HN, I suggest you use the search and find them, the people making those have much more experience than me in the field and you're better off with then rather than my half-assed explanations, but the point is, call and text interception is possible, among other nasty things (silently tracking a phone' approximate location, DoS, etc).
- Slansitartop 9y agoI recall reading long ago that SMS messages were a hack built on top of the unencrypted "paging" channel in the protocol. They're received and "ignored" by all phones near the intended recipient. IIRC, the paging channel is a broadcast channel that was originally used to send short message to a handset to advise them of an incoming call and to request a private channel to receive it. It had lots of excess capacity so someone had the idea of pushing short text messages over it.
- ptman 9y agoWhile that was originally true, I doubt it's true for 3G and 4G. Would appreciate it if someone who knew for a fact would comment.
- exabrial 9y agoThe point I was trying to make is one SMS number does not equal a phone with a paid, credit checked, account behind it. Making it easy to create SMS numbers will help expose the weaknesses of using them for 2fa. Many people have access to your SMSs. One bad actor at your phone provider, the sms gateway, spoofing your sim, a bad app, or someone casually observing your lock screen are a couple I can think off have, but I'm sure the security experts know many more ways than I do.