6 ms·

Slightly off-topic, but has anyone managed to automate receiving and replying to so-called "flash SMS" or "Class 0 SMS"? In Norway, there is a thing called "Ba

by kaivi 5y ago

Slightly off-topic, but has anyone managed to automate receiving and replying to so-called "flash SMS" or "Class 0 SMS"? In Norway, there is a thing called "BankID on mobile", which is used for 2FA by government services, along with any companies requiring authentication with person's ID. Examples: banking, insurance, health and vehicle registration: you initiate a log in using either your personal ID or a combo of phone number+birthdate, and you receive this interactive, full-screen flash SMS asking you to ensure that a certain word combo matches, and to confirm the action with your PIN. To be clear, the interactive part does not come with some app, but it's a feature built into most smartphones. This thing drives me nuts when traveling: it is slow when abroad and costs money. What's worse, is that it only works with a physical SIM, so I can't easily use a local SIM abroad. There is an alternative way of authenticating using a code-generating unit, but it is not perfect - you can only have one of them at a time, they're really fragile and non-waterproof. What I'd like would be to leave my SIM at home, preferable inside of a hardware SIP gateway from Aliexpress, and proxy those prompts through a Telegram bot.

ponas 5y ago
You might want to take a look at the BankID app, which doesn't depend on functionality in the SIM card. Link in Norwegian: https://www.bankid.no/privat/bankid-app/ https://www.bankid.no/privat/bankid-app/
- kaivi 5y ago
  It doesn't work with my bank unfortunately, and it does not seem to replace "BankID on mobile".
  - sgt 5y ago
    Oh, thought all the banks supported that :)
  - codetrotter 5y ago
    If you get another bank to issue BankID to you, then you may be able to ask your current bank that you may log in using that BankID. And this way you may perhaps be able to use the app instead. Maybe.
sgt 5y ago
That is weird. I also have BankID but I never got a fullscreen SMS. It just gives me a normal iOS app notification on the top, which I click on, and then the app opens.
- kaivi 5y ago
  You must be using the new BankID app which sends push notifications, but I don't think it's supported by every site which uses BankID.
  - 0x0 5y ago
    Some BankID providers offer a regular bespoke ios/android app that replaces the physical dongle, which can operate in two modes, either by displaying the one-time code or by using the internet to autofill the code.
timvdalen 5y ago
Do you have a screenshot or an example? The only thing I can think of that sounds similar is the emergency alerting service in The Netherlands.
- kaivi 5y ago
  Here is what it looks like: https://youtu.be/zX3UJO4paxk?t=15 https://youtu.be/zX3UJO4paxk?t=15 iOS visuals have changed since 2012, but the process is the same in 2021: 1. full-screen message 2. another full-screen message with a numpad and buttons. I'm surprised that this feature is not massively used to scam people. Is it because sending service SMS is restricted to certain parties?
- gattilorenz 5y ago
  I don't think the emergency alerting service in NL is the same, that's "cell broadcast" messages, and is more recent: https://en.wikipedia.org/wiki/Cell_Broadcast https://en.wikipedia.org/wiki/Cell_Broadcast A flash SMS is kinda like a regular SMS (I remember receving them already on my Nokia 3310), and uses the same protocol. However, it will appear directly on the screen of the user and won't be saved in the received messages. You could also send one yourself, if you can send AT messages to your cell modem :) Some more technical info: http://web.archive.org/web/20080327112445/http://www.dreamfabric.com/sms/ http://web.archive.org/web/20080327112445/http://www.dreamfa... http://web.archive.org/web/20080325030443/http://www.dreamfabric.com/sms/alert.html http://web.archive.org/web/20080325030443/http://www.dreamfa...
spotijk 5y ago
If you don't mind paying for a solution you could try this with the Auron SMS Server. This probably won't work with a normal GSM modem though, since the flash SMS is not supposed to be stored in GSM memory. But it may work with the Auron SMS Agent for Android since that one uses the incoming SMS intend and forward to the PC based on that. With the SMS Server you can configure automatic forwarding from SMS to E-mail (SMTP) to receive your 2FA code through e-mail. You can download the free 30 day trial version of the SMS Server to try it out. So you can be sure that it works before making a decision. (Download link: https://www.auronsoftware.com/download/ https://www.auronsoftware.com/download/)
lstamour 5y ago
It looks like Flash SMS is handled differently. Here’s a post from 2020 on the differences within Android to handle flash SMS: https://github.com/moezbhatti/qksms/issues/1536#issuecomment-577678851 https://github.com/moezbhatti/qksms/issues/1536#issuecomment... Here’s an app, pre-4.3, for sending Flash SMS: https://github.com/romankh/gat-app https://github.com/romankh/gat-app There appear to be a couple online services that will let you send Flash SMS (Type 0) but Twilio is not one of them. Edit: The terminology is confusing! I wrote “type 0” above when in fact it’s a “class 0” sms. Type 0 means a silent SMS, Class 0 means an SMS that’s display-only and not stored. See also https://www.contextis.com/en/blog/binary-sms-the-old-backdoor-to-your-new-thing https://www.contextis.com/en/blog/binary-sms-the-old-backdoo... for a brief overview, though I’m sure there are other, better sources.
- kaivi 5y ago
  What a nasty thing! Seems there's no other way but using dedicated hardware. BankID also needs to be tied to a specific SIM, so I suspect that they somehow store and validate SIM ID and IMEI on the other side.
  - donatzsky 5y ago
    Could also be that they install an applet on the SIM. This might also explain why eSIMs don't work.
  - kwhitefoot 5y ago
    That's rather the point of BankID. It helps prevent things like SIM jacking. Much more secure than using ordinary texts for 2FA.
  - Abishek_Muthian 5y ago
    Wallet/Banking apps in India incl. Google Pay requires the mobile number on the phone to match the bank records due to central bank regulations, I assume IMEI verification happens behind the scenes with direct telecom API. Wallet apps sends outgoing SMS randomly to verify this. Suddenly my wallet apps stopped functioning as SMS couldn't be sent and I presumed I had messed up with telephony services with some security settings and was searching radio logs to find the culprit where I found that SMS validity was nil. Searching further I found that our telecom oligopoly (soon to be duopoly) decided to remove outgoing SMS from low-tier plans. I don't do real-time communication, telephony services are only useful to me for receiving the 2FA OTP and so I had low tier plans. Goodbye wallet apps.
0x0 5y ago
This is more advanced than just a flash sms. It is probably implemented as a SIM Toolkit App on the SIM card. https://en.wikipedia.org/wiki/SIM_Application_Toolkit https://en.wikipedia.org/wiki/SIM_Application_Toolkit Some BankID providers lets you use a regular bespoke ios/android app as an online code generator. Then you only need regular internet access, for example over wifi.
- codetrotter 5y ago
  > This is more advanced than just a flash sms. It is probably implemented as a SIM Toolkit App on the SIM card. Yes. As I have understood it, it’s a Java applet that runs on the SIM card itself. And it probably being more than just flash sms is also evident from the fact that not all telcos are supported for use with BankID, even among Norwegian telcos. You can test it here https://www.bankid.no/privat/los-mitt-bankid-problem/test-din-bankid-pa-mobil/ https://www.bankid.no/privat/los-mitt-bankid-problem/test-di... but it probably only accepts Norwegian numbers. Found via https://www.bankid.no/privat/bankid-pa-mobil/ https://www.bankid.no/privat/bankid-pa-mobil/ which says that the link I said to test it at says that you can use that test to determine if your phone and subscription supports BankID. It’s also worth noting that many telcos will charge you every time you use BankID. This annoyed me a lot so I switched to a different telco that’s cheaper and doesn’t charge for BankID.
- kaivi 5y ago
  TIL, that's super interesting, never guessed that it could be a SIM application!
ohaal 5y ago
This guy has a project which deals with this: https://web.archive.org/web/20160328052858/limid.sitadella.com/ https://web.archive.org/web/20160328052858/limid.sitadella.c...
sleepyhead 5y ago
This is based on a custom SIM application that does crypto. You cannot just reply to the flash SMS by your self. It shouldn't cost you money abroad though, BankID Mobile is free on many networks but if you use a reseller like OneCall they are unable to differentiate SMS and BankID flash SMS so you will be charged for it. You could use the BankID iOS app which does the authentication crypto in the iOS app instead of using the SIM app.
dheera 5y ago
Leave your phone at home, plug an Arduino into the phone's OTG USB that behaves like a mouse and keyboard, and use that to send the necessary swipes. We really should ban SMS-based 2FA.
- sleepyhead 5y ago
  It is not regular SMS, it is PKI based with a custom SIM application that uses SMS (Flash). Intercepting these SMS would not help you (unless you have hacked their app). Also note that SIM app runs independently from the mobile OS.
  - dheera 5y ago
    Okay, then intercept them with an analog loophole. Keep one cheap phone mounted with a camera and robot arm poker, build the API on that, then get an additional SIM for your normal actually mobile use. Or eschew the camera by using LineageOS (which can ignore anti-screenshot measures) and screenshot over ADB. If you're in the US, it costs only $20/mo for an basic level Google Fi SIM (T-mo + Sprint network) or $25/mo for a Visible SIM (Verizon network), and they will be seen as an actually mobile number by the network. I imagine there are similarly cheap deals in most other countries as well.
darkhorn 5y ago
I believe you can communicate with the SIM card via AT commands. https://en.wikipedia.org/wiki/Hayes_command_set https://en.wikipedia.org/wiki/Hayes_command_set https://youtu.be/Rk3qpCwButU?t=359 https://youtu.be/Rk3qpCwButU?t=359
nabeards 5y ago
What does someone do who doesn’t have a mobile phone? Is there an alternative login procedure?

by kaivi 5y ago

ponas 5y ago

You might want to take a look at the BankID app, which doesn't depend on functionality in the SIM card. Link in Norwegian: https://www.bankid.no/privat/bankid-app/ https://www.bankid.no/privat/bankid-app/

kaivi 5y ago
It doesn't work with my bank unfortunately, and it does not seem to replace "BankID on mobile".
- sgt 5y ago
  Oh, thought all the banks supported that :)
- codetrotter 5y ago
  If you get another bank to issue BankID to you, then you may be able to ask your current bank that you may log in using that BankID. And this way you may perhaps be able to use the app instead. Maybe.

sgt 5y ago

That is weird. I also have BankID but I never got a fullscreen SMS. It just gives me a normal iOS app notification on the top, which I click on, and then the app opens.

kaivi 5y ago
You must be using the new BankID app which sends push notifications, but I don't think it's supported by every site which uses BankID.
- 0x0 5y ago
  Some BankID providers offer a regular bespoke ios/android app that replaces the physical dongle, which can operate in two modes, either by displaying the one-time code or by using the internet to autofill the code.

timvdalen 5y ago

Do you have a screenshot or an example? The only thing I can think of that sounds similar is the emergency alerting service in The Netherlands.

kaivi 5y ago
Here is what it looks like: https://youtu.be/zX3UJO4paxk?t=15 https://youtu.be/zX3UJO4paxk?t=15 iOS visuals have changed since 2012, but the process is the same in 2021: 1. full-screen message 2. another full-screen message with a numpad and buttons. I'm surprised that this feature is not massively used to scam people. Is it because sending service SMS is restricted to certain parties?
gattilorenz 5y ago
I don't think the emergency alerting service in NL is the same, that's "cell broadcast" messages, and is more recent: https://en.wikipedia.org/wiki/Cell_Broadcast https://en.wikipedia.org/wiki/Cell_Broadcast A flash SMS is kinda like a regular SMS (I remember receving them already on my Nokia 3310), and uses the same protocol. However, it will appear directly on the screen of the user and won't be saved in the received messages. You could also send one yourself, if you can send AT messages to your cell modem :) Some more technical info: http://web.archive.org/web/20080327112445/http://www.dreamfabric.com/sms/ http://web.archive.org/web/20080327112445/http://www.dreamfa... http://web.archive.org/web/20080325030443/http://www.dreamfabric.com/sms/alert.html http://web.archive.org/web/20080325030443/http://www.dreamfa...

spotijk 5y ago

If you don't mind paying for a solution you could try this with the Auron SMS Server. This probably won't work with a normal GSM modem though, since the flash SMS is not supposed to be stored in GSM memory. But it may work with the Auron SMS Agent for Android since that one uses the incoming SMS intend and forward to the PC based on that. With the SMS Server you can configure automatic forwarding from SMS to E-mail (SMTP) to receive your 2FA code through e-mail. You can download the free 30 day trial version of the SMS Server to try it out. So you can be sure that it works before making a decision. (Download link: https://www.auronsoftware.com/download/ https://www.auronsoftware.com/download/)

lstamour 5y ago

It looks like Flash SMS is handled differently. Here’s a post from 2020 on the differences within Android to handle flash SMS: https://github.com/moezbhatti/qksms/issues/1536#issuecomment-577678851 https://github.com/moezbhatti/qksms/issues/1536#issuecomment... Here’s an app, pre-4.3, for sending Flash SMS: https://github.com/romankh/gat-app https://github.com/romankh/gat-app There appear to be a couple online services that will let you send Flash SMS (Type 0) but Twilio is not one of them. Edit: The terminology is confusing! I wrote “type 0” above when in fact it’s a “class 0” sms. Type 0 means a silent SMS, Class 0 means an SMS that’s display-only and not stored. See also https://www.contextis.com/en/blog/binary-sms-the-old-backdoor-to-your-new-thing https://www.contextis.com/en/blog/binary-sms-the-old-backdoo... for a brief overview, though I’m sure there are other, better sources.

kaivi 5y ago
What a nasty thing! Seems there's no other way but using dedicated hardware. BankID also needs to be tied to a specific SIM, so I suspect that they somehow store and validate SIM ID and IMEI on the other side.
- donatzsky 5y ago
  Could also be that they install an applet on the SIM. This might also explain why eSIMs don't work.
- kwhitefoot 5y ago
  That's rather the point of BankID. It helps prevent things like SIM jacking. Much more secure than using ordinary texts for 2FA.
- Abishek_Muthian 5y ago
  Wallet/Banking apps in India incl. Google Pay requires the mobile number on the phone to match the bank records due to central bank regulations, I assume IMEI verification happens behind the scenes with direct telecom API. Wallet apps sends outgoing SMS randomly to verify this. Suddenly my wallet apps stopped functioning as SMS couldn't be sent and I presumed I had messed up with telephony services with some security settings and was searching radio logs to find the culprit where I found that SMS validity was nil. Searching further I found that our telecom oligopoly (soon to be duopoly) decided to remove outgoing SMS from low-tier plans. I don't do real-time communication, telephony services are only useful to me for receiving the 2FA OTP and so I had low tier plans. Goodbye wallet apps.

0x0 5y ago

This is more advanced than just a flash sms. It is probably implemented as a SIM Toolkit App on the SIM card. https://en.wikipedia.org/wiki/SIM_Application_Toolkit https://en.wikipedia.org/wiki/SIM_Application_Toolkit Some BankID providers lets you use a regular bespoke ios/android app as an online code generator. Then you only need regular internet access, for example over wifi.

codetrotter 5y ago
> This is more advanced than just a flash sms. It is probably implemented as a SIM Toolkit App on the SIM card. Yes. As I have understood it, it’s a Java applet that runs on the SIM card itself. And it probably being more than just flash sms is also evident from the fact that not all telcos are supported for use with BankID, even among Norwegian telcos. You can test it here https://www.bankid.no/privat/los-mitt-bankid-problem/test-din-bankid-pa-mobil/ https://www.bankid.no/privat/los-mitt-bankid-problem/test-di... but it probably only accepts Norwegian numbers. Found via https://www.bankid.no/privat/bankid-pa-mobil/ https://www.bankid.no/privat/bankid-pa-mobil/ which says that the link I said to test it at says that you can use that test to determine if your phone and subscription supports BankID. It’s also worth noting that many telcos will charge you every time you use BankID. This annoyed me a lot so I switched to a different telco that’s cheaper and doesn’t charge for BankID.
kaivi 5y ago
TIL, that's super interesting, never guessed that it could be a SIM application!

ohaal 5y ago

This guy has a project which deals with this: https://web.archive.org/web/20160328052858/limid.sitadella.com/ https://web.archive.org/web/20160328052858/limid.sitadella.c...

sleepyhead 5y ago

This is based on a custom SIM application that does crypto. You cannot just reply to the flash SMS by your self. It shouldn't cost you money abroad though, BankID Mobile is free on many networks but if you use a reseller like OneCall they are unable to differentiate SMS and BankID flash SMS so you will be charged for it. You could use the BankID iOS app which does the authentication crypto in the iOS app instead of using the SIM app.

dheera 5y ago

Leave your phone at home, plug an Arduino into the phone's OTG USB that behaves like a mouse and keyboard, and use that to send the necessary swipes. We really should ban SMS-based 2FA.

sleepyhead 5y ago
It is not regular SMS, it is PKI based with a custom SIM application that uses SMS (Flash). Intercepting these SMS would not help you (unless you have hacked their app). Also note that SIM app runs independently from the mobile OS.
- dheera 5y ago
  Okay, then intercept them with an analog loophole. Keep one cheap phone mounted with a camera and robot arm poker, build the API on that, then get an additional SIM for your normal actually mobile use. Or eschew the camera by using LineageOS (which can ignore anti-screenshot measures) and screenshot over ADB. If you're in the US, it costs only $20/mo for an basic level Google Fi SIM (T-mo + Sprint network) or $25/mo for a Visible SIM (Verizon network), and they will be seen as an actually mobile number by the network. I imagine there are similarly cheap deals in most other countries as well.

darkhorn 5y ago

I believe you can communicate with the SIM card via AT commands. https://en.wikipedia.org/wiki/Hayes_command_set https://en.wikipedia.org/wiki/Hayes_command_set https://youtu.be/Rk3qpCwButU?t=359 https://youtu.be/Rk3qpCwButU?t=359

nabeards 5y ago

What does someone do who doesn’t have a mobile phone? Is there an alternative login procedure?