3 ms·

is this known? It kinda sounds like the carrier might be the one doing this

by rtpg 5y ago

bluesign 5y ago
I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. Usually when you send bulk sms, it is changing many hands on the way. From your provider, to some aggregator, then to carrier in target country or some illegal termination with sim cards. SMS is not a secure platform. Here is an article about it: https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-monetisation/ https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-m...
- izacus 5y ago
  > I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. There are US carriers which inject their own banners into websites. Why do you think carrier wouldn't do this?
  - bluesign 5y ago
    Injecting your own vs someone else's is big liability difference. Especially on Twitter it was mentioned that link is pretty shady. Also why only on google SMS, I am sure he is also getting a lot of SMS from other companies.
- toast0 5y ago
  > I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. That would depend on the size of the original texts. If Google's verication messages are shorter than most, they might have room for ads where some other service doesn't. I agree that an intermediary adding something is likely. Maybe Google has enough scale to self-manage 100% direct routes, but in general it's hard to avoid aggregators, and it's hard to track message delivery. And if you need worldwide delivery, it's hard to avoid grey routes. As I used to tell people who wondered why I built a system to pick from multiple aggregators: All the aggregators will tell you they've got worldwide coverage and that they're the best; but they're all full of bs. I should also add that they'll tell you that they all say they have 100% direct routes and that they don't use aggregators. One of the most amusing things I remember was when aggregator X had a big outage, several hours of not accepting messages (let alone delivering them), aggregator Y's success dropped by about half. It was clear they were using that aggregator for a significant amount of traffic. But sometimes it costs less to pay Y to submit messages to X than to pay X directly. shrug
  - bluesign 5y ago
    Yeah I totally agree, but on Google scale and for OTP codes, using middleman is not good practice. Especially with MNO blacklists etc, as they are actively fighting grey routes. Also with direct carrier connections you have options like one-shot SMS. If it is not delivered it is not retried. (which is useful for delays) Delay is a big problem when you have many middleman, imagine you are sending OTP code, let's say route is delayed somehow, user didn't get the message, he requested another one, then first one is delivering, but you've already invalidated that, user enters wrong code, requests again, until he locks out :)
qwertox 5y ago
Could it technically be possible that a malicious app is reading the content of the original SMS, then deleting this original SMS, and then creating a new one with the modified content? Like SMS backup/restore apps could do?

is this known? It kinda sounds like the carrier might be the one doing this

by rtpg 5y ago

is this known? It kinda sounds like the carrier might be the one doing this

I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. Usually when you send bulk sms, it is changing many hands on the way. From your provider, to some aggregator, then to carrier in target country or some illegal termination with sim cards. SMS is not a secure platform. Here is an article about it: https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-monetisation/ https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-m...

izacus 5y ago
> I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. There are US carriers which inject their own banners into websites. Why do you think carrier wouldn't do this?
- bluesign 5y ago
  Injecting your own vs someone else's is big liability difference. Especially on Twitter it was mentioned that link is pretty shady. Also why only on google SMS, I am sure he is also getting a lot of SMS from other companies.
toast0 5y ago
> I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. That would depend on the size of the original texts. If Google's verication messages are shorter than most, they might have room for ads where some other service doesn't. I agree that an intermediary adding something is likely. Maybe Google has enough scale to self-manage 100% direct routes, but in general it's hard to avoid aggregators, and it's hard to track message delivery. And if you need worldwide delivery, it's hard to avoid grey routes. As I used to tell people who wondered why I built a system to pick from multiple aggregators: All the aggregators will tell you they've got worldwide coverage and that they're the best; but they're all full of bs. I should also add that they'll tell you that they all say they have 100% direct routes and that they don't use aggregators. One of the most amusing things I remember was when aggregator X had a big outage, several hours of not accepting messages (let alone delivering them), aggregator Y's success dropped by about half. It was clear they were using that aggregator for a significant amount of traffic. But sometimes it costs less to pay Y to submit messages to X than to pay X directly. shrug
- bluesign 5y ago
  Yeah I totally agree, but on Google scale and for OTP codes, using middleman is not good practice. Especially with MNO blacklists etc, as they are actively fighting grey routes. Also with direct carrier connections you have options like one-shot SMS. If it is not delivered it is not retried. (which is useful for delays) Delay is a big problem when you have many middleman, imagine you are sending OTP code, let's say route is delayed somehow, user didn't get the message, he requested another one, then first one is delivering, but you've already invalidated that, user enters wrong code, requests again, until he locks out :)

qwertox 5y ago

Could it technically be possible that a malicious app is reading the content of the original SMS, then deleting this original SMS, and then creating a new one with the modified content? Like SMS backup/restore apps could do?