3 ms·

Intercepting SMS is incredibly easy. Not with this tool, but via other methods. SMS is broken and should never be used for any type of sensitive communication,

by aviv 9y ago

Intercepting SMS is incredibly easy. Not with this tool, but via other methods. SMS is broken and should never be used for any type of sensitive communication, be it 2fa or pics you don't want to see online.

abledon 9y ago
what other methods?
- Rjevski 9y ago
  Asking the host carrier nicely via SS7. > Hey I'm one of your roaming partners and this phone here is roaming on my network, can you send me their calls & texts? > Sure mate, here they are, enjoy!
  - bogomipz 9y ago
    >"Asking the host carrier nicely via SS7." Can you elaborate? SS7 is signaling. You can't request a Telecom provider to just start send you all someones calls and texts via SS7. The SMSC routes an SMS to the IMEI of the phone.
    - Rjevski 9y ago
      > Can you elaborate? SS7 is signaling. You can't request a Telecom provider to just start send you all someones calls and texts via SS7. I was simplifying, but how roaming works is that on every call a mobile number from the visited network is assigned to the SIM, and the host network is instructed to send the call there; in the case of an attacker I expect them to be able to use this mechanism to send calls anywhere they want. They could also most likely fake USSD which is I believe used behind the "Call forwarding" toggle in your phone's settings. There are plenty of SS7-related demos & presentations posted here on HN, I suggest you use the search and find them, the people making those have much more experience than me in the field and you're better off with then rather than my half-assed explanations, but the point is, call and text interception is possible, among other nasty things (silently tracking a phone' approximate location, DoS, etc).
- Slansitartop 9y ago
  I recall reading long ago that SMS messages were a hack built on top of the unencrypted "paging" channel in the protocol. They're received and "ignored" by all phones near the intended recipient. IIRC, the paging channel is a broadcast channel that was originally used to send short message to a handset to advise them of an incoming call and to request a private channel to receive it. It had lots of excess capacity so someone had the idea of pushing short text messages over it.
  - ptman 9y ago
    While that was originally true, I doubt it's true for 3G and 4G. Would appreciate it if someone who knew for a fact would comment.

by aviv 9y ago

abledon 9y ago

what other methods?

Rjevski 9y ago
Asking the host carrier nicely via SS7. > Hey I'm one of your roaming partners and this phone here is roaming on my network, can you send me their calls & texts? > Sure mate, here they are, enjoy!
- bogomipz 9y ago
  >"Asking the host carrier nicely via SS7." Can you elaborate? SS7 is signaling. You can't request a Telecom provider to just start send you all someones calls and texts via SS7. The SMSC routes an SMS to the IMEI of the phone.
  - Rjevski 9y ago
    > Can you elaborate? SS7 is signaling. You can't request a Telecom provider to just start send you all someones calls and texts via SS7. I was simplifying, but how roaming works is that on every call a mobile number from the visited network is assigned to the SIM, and the host network is instructed to send the call there; in the case of an attacker I expect them to be able to use this mechanism to send calls anywhere they want. They could also most likely fake USSD which is I believe used behind the "Call forwarding" toggle in your phone's settings. There are plenty of SS7-related demos & presentations posted here on HN, I suggest you use the search and find them, the people making those have much more experience than me in the field and you're better off with then rather than my half-assed explanations, but the point is, call and text interception is possible, among other nasty things (silently tracking a phone' approximate location, DoS, etc).
Slansitartop 9y ago
I recall reading long ago that SMS messages were a hack built on top of the unencrypted "paging" channel in the protocol. They're received and "ignored" by all phones near the intended recipient. IIRC, the paging channel is a broadcast channel that was originally used to send short message to a handset to advise them of an incoming call and to request a private channel to receive it. It had lots of excess capacity so someone had the idea of pushing short text messages over it.
- ptman 9y ago
  While that was originally true, I doubt it's true for 3G and 4G. Would appreciate it if someone who knew for a fact would comment.