6 ms·

If you think O2 headers are bad, check this out.

54 points by richardburton 15y ago

swinny 15y ago
SMS spoofing appears to be real, and acknowledged as a known 'feature' by the networks. Crazy!
hugh666 15y ago
testing
alexchamberlain 15y ago
As the tweet pointed out, this has been possible for years. You can also send emails from whoever you want.
- steve-howard 15y ago
  You can still set up ways to verify e-mail senders (e.g. DKIM). Can't imagine how you'd verify an SMS.
  - rmc 15y ago
    Or a GPG signed email.
- mootothemax 15y ago
  You can also send emails from whoever you want. Precisely - relying on someone's email address, phone number, name or physical address is not a reliable authentication measure.
- richardburton 15y ago
  I know. But that does not mean the networks should not try to stop it.
  - slig 15y ago
    I can also spoof network packages, but my ISP will discard them. Why can't they do the same?
    - viraptor 15y ago
      Only on your side. If someone was peering with your ISP and they sent some spoofed packets, there's a big chance they'll be accepted. If they get filtered, that's probably based on the ranges published by the peering partner. You can consider anycast to be something like spoofing - multiple hosts make you believe they have the same address. There's no way your ISP can verify they are.
  - viraptor 15y ago
    Stop it how exactly? It's the same thing as with phone calls. Unless we migrate to some technology which involves signed, verifiable sources, there's nothing they can do about things like that. Once your telco approves that you can send out any number as source, you can send out any number as your source - they're the highest authority atm. Everything that happens between telcos on the wire is trusted since telcos trust each other. There are valid use cases for that too of course - setting your presented id as the number of your company's reception, having a single number for incoming connections (or a group) but using multiple lines for calling out, etc. You can probably ensure the account sending the traffic is closed since it's likely to break multiple local laws, but on the receiving side, there's nothing left to do.
    - jka 15y ago
      I would have expected that the networks cross-reference the device an SMS was sent from (IMEI?) with the sender phone number claimed in the message. I don't think that's unreasonable, but Richard seems to have found that this basic check isn't being performed here. Are you so keen to see a system remain with this insecurity just because you have a fundamental belief that perfect security isn't possible? Most if not all security is a case of shades of gray, and there's clearly a lot that could be improved here by the network.
- rmc 15y ago
  But people don't know this. So they trust SMSs. Most banks will state "We will never email you", so people know not to trust emails from 'their bank'. However some banks use SMSs for authentication. SMSs have much higher trust factor. After all, we have spam filters on email, but not on SMS.
  - richardburton 15y ago
    Exactly. My friends are shocked when they see this working.
mootothemax 15y ago
This is not the fault of any one network; it's a fact of life when it comes to SMS. You can have all kinds of fun, whether it's messages that appear to be from you, your friend, or 11 characters of your choice, an SMS that will only display without being stored, or even a voicemail notification. There's a nice guide to the format here: http://www.dreamfabric.com/sms/ http://www.dreamfabric.com/sms/
- richardburton 15y ago
  Agreed. But they do not care at all. That is my complaint.
  - bad_user 15y ago
    To fix it, you'd have to reinvent the protocol. That's like reinventing email. Well good luck with that ;)
    - richardburton 15y ago
      My lack of knowledge on this subject is evident here I am afraid. Is there not a way the networks could, like Google, try and detect spam or spoof messages?
      - darklajid 15y ago
        Somewhere else in this discussion someone compared it to peering, which is quite a good example. You grant (read: sell) permission to other people to deliver text messages to your subscribers. The very same way you get a text message from carrier A while being a subscriber of carrier B. Now enter international territory. You interconnect with lots of networks, each of which can (in my experience services like that were often from/cheapest in eastern Europe) hand out access to more people to send on their behalf. Google can only try to protect you in limited cases. Check if the mail says it is originated from Google and notice that it isn't (flags a lot of false positives, if you are a valid sender, sending in a non-standard way). Checking headers (easily forged for most parts). Things like SPF [1] where you, as the admin of a domain, can tell the world that really only host X sends mails on your behalf. The world might not care though - and the burden is again not on your very own 'carrier' (Google here), but on everyone on this planet that runs a domain. There might be other ways, but inherently this problem is unsolved. Unless you went to a key signing party and verify that the data you got was signed by the key that you _know_ belongs to the sender (and you trust him not to give it away. And you trust him not to lose control of it or at least revoke it). 1: https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework
richardburton 15y ago
To be clear, I am well-aware this is not a new issue. However, in the context of the Leveson enquiry into phone "hacking" and O2's recent blunder, I think it is a great time to revisit this issue.
casca 15y ago
This is just silly. Anyone who has industry experience knows that it's trivially possible to spoof SMS phone numbers. Just like with email, it's possible to make the system more secure but given the margins associated with SMS, not likely. For a clear example, imagine that I'm roaming in Zimbabwe with my UK cellphone. I send an SMS through the Zimbabwe carrier. It (eventually) arrives to the UK recipient network, ready to be delivered. That network could do some form of verification, but as they only get the final billing tally a few days or weeks later from the Zimbabwe ISP, they don't have enough information to do so. It would not make any sense for the carriers to do SMS verification. And given that emails are far easier to get people to click on links to phishing and malware sites, spoofing SMSs has limited value. Also, did you know that I could phone you and claim to be someone else?
- richardburton 15y ago
  Anyone who has industry experience knows that it's trivially possible to spoof SMS phone numbers. Exactly. My point is that the general public do not know. That is bad. What do you think?
  - corin_ 15y ago
    It simply isn't possible to prevent this, and your blog post just skates over that and blames the networks. All they could do is raise awareness, which realistically won't do a whole lot.
- nodata 15y ago
  > but given the margins associated with SMS Do you mean the margins that lead to a several hundred to several thousand percent markup?
  - richardburton 15y ago
    Almost infinite margins! Check this out for a good read: Anyone who has industry experience knows that it's trivially possible to spoof SMS phone numbers.
brador 15y ago
With this technique, replies go to the correct sender number sent not the spoofer, right?
- richardburton 15y ago
  Correct. But that can often make the pranks even better. Especially if you send simultaneously from two people to one-another.
adhipg 15y ago
The SMS service that I use to send messages has an option to send an SMS 'from' any number I choose and it works nicely. I can send messages 'from' anyone I want - and we actually use this feature to facilitate a user to easily get replies to her messages sent directly to her phone.
- richardburton 15y ago
  What service are you running?
  - adhipg 15y ago
    http://www.fastsms.co.uk/ http://www.fastsms.co.uk/
    - richardburton 15y ago
      You should police your service better. Not impressed.
      - adhipg 15y ago
        I don't run that service. I actually just use their API and do my best to ensure that you can't spoof someone's number (you verify your phone number with me before I can send an SMS as you).
        richardburton 15y ago
        I asked for your service that you were running that needed to do what you do. Thanks for the down-votes.
        adhipg 15y ago
        hehe, I just wanted to clarify my stand there. About downvotes - well, I don't even have the ability to downvote (atleast all I can see is just an upvote triangle) - so, not me!
darklajid 15y ago
So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. This is wrong. First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. Second, as many pointed out already: This is not a problem of any carrier. So your peers are surprised if you send a text message from their mum's number? Sure, understandable and maybe that needs to be fixed. But your carrier is not responsible for that in my world, just as yahoo/google etc. cannot protect you from most spoofs in the mail world. And - gasp! - you can do similar things with a call (ever noticed that Skype offers to call 'from your number'?). If the article wouldn't hijack a real issue _and_ wouldn't blame the wrong target, then I think there's a valid point somewhere in there: We, the technical crowd, should find a way to educate people around us about inherent trust issues. But that should be a constructive project, not mud slinging.
- jka 15y ago
  Google and others can and do try to protect users from spoofing - in my opinion, every communication service provider should try to prevent their users from being misled by impersonators. I'm not sure educating all users about the spoofability or otherwise of all existing communication systems is the way forward as a tech community - there's more we can do in terms of bolstering existing security and trying to validate/flag existing messages. I've never enabled the ability to 'call from my number' for any services, so I would expect that others would be unable to spoof mine.
  - richardburton 15y ago
    Could not agree more. People trust their phone network. I think the networks do not deserve that trust.
  - darklajid 15y ago
    Google tries - but cannot. Ultimately it can only do the same dance that it does with spam. Learn, improve, tweak - and never succeed. I think a general project to explain encryption/signing would be awesome. I'd _love_ to send mails to my bank, to the government etc. and have them be legally binding. I'm sure it could help against quite some amount of spam as well, if you understand that an address isn't to be trusted by default. I .. don't get that last part. How do you think is the process of being able to authorize a 'from' number? Technically gazillion of services could probably do it. It's inherently simple if you are well-connected. Skype certainly doesn't need to ask you first and have a kind of exchange with you and your carrier that 'unlocks' their ability to use your number in an outgoing call. It's a policy that protects them from abuse (i.e. they care, because of legal implications and because of possible business impact if they'd abuse it). [1] They don't need to get your ok though, if they don't want to. 1: This is based on a limited experience in my past, where I had (legal) access to an asterisk server with a nice trunk connection to a mobile carrier in DE. I certainly don't have extensive telecom knowledge, but got a glimpse at least.
richardburton 15y ago
Just so you know, this is what Orange had to say about the site http://www.hoaxmail.co.uk http://www.hoaxmail.co.uk: Hi Richard Although I can understand why you may be concerned over the potential misuse of the below site, this is a third-party service which is independent of Orange and we would have no control over its existence. If you have received an offensive or questionable message from this service, you can report this to them for investigation via http://www.hoaxmail.co.uk/help/faq.php?ref=H13 http://www.hoaxmail.co.uk/help/faq.php?ref=H13 . I hope this helps! Darren Orange Helpers
ukgent2 15y ago
Sorry but this is a null issue, I have Text message APIs that allow me to specify the sender ID. I understand your app is sexy in that it works off the phone but anyone with a few pounds can do this. Text message spoofing is easy, CLI spoofing is the "cool" thing todo, and if you can spoof the Passert ID then you are gold
zokier 15y ago
There is lots of people saying that filtering SMS would be impractical for carriers. Could you explain why that is? Wouldn't it be relatively trivial to check if the number in the SMS header matches the number of the SIM card sending the message?

54 points by richardburton 15y ago

swinny 15y ago

SMS spoofing appears to be real, and acknowledged as a known 'feature' by the networks. Crazy!

hugh666 15y ago

testing

alexchamberlain 15y ago

As the tweet pointed out, this has been possible for years. You can also send emails from whoever you want.

steve-howard 15y ago
You can still set up ways to verify e-mail senders (e.g. DKIM). Can't imagine how you'd verify an SMS.
- rmc 15y ago
  Or a GPG signed email.
mootothemax 15y ago
You can also send emails from whoever you want. Precisely - relying on someone's email address, phone number, name or physical address is not a reliable authentication measure.
richardburton 15y ago
I know. But that does not mean the networks should not try to stop it.
- slig 15y ago
  I can also spoof network packages, but my ISP will discard them. Why can't they do the same?
  - viraptor 15y ago
    Only on your side. If someone was peering with your ISP and they sent some spoofed packets, there's a big chance they'll be accepted. If they get filtered, that's probably based on the ranges published by the peering partner. You can consider anycast to be something like spoofing - multiple hosts make you believe they have the same address. There's no way your ISP can verify they are.
- viraptor 15y ago
  Stop it how exactly? It's the same thing as with phone calls. Unless we migrate to some technology which involves signed, verifiable sources, there's nothing they can do about things like that. Once your telco approves that you can send out any number as source, you can send out any number as your source - they're the highest authority atm. Everything that happens between telcos on the wire is trusted since telcos trust each other. There are valid use cases for that too of course - setting your presented id as the number of your company's reception, having a single number for incoming connections (or a group) but using multiple lines for calling out, etc. You can probably ensure the account sending the traffic is closed since it's likely to break multiple local laws, but on the receiving side, there's nothing left to do.
  - jka 15y ago
    I would have expected that the networks cross-reference the device an SMS was sent from (IMEI?) with the sender phone number claimed in the message. I don't think that's unreasonable, but Richard seems to have found that this basic check isn't being performed here. Are you so keen to see a system remain with this insecurity just because you have a fundamental belief that perfect security isn't possible? Most if not all security is a case of shades of gray, and there's clearly a lot that could be improved here by the network.
rmc 15y ago
But people don't know this. So they trust SMSs. Most banks will state "We will never email you", so people know not to trust emails from 'their bank'. However some banks use SMSs for authentication. SMSs have much higher trust factor. After all, we have spam filters on email, but not on SMS.
- richardburton 15y ago
  Exactly. My friends are shocked when they see this working.

mootothemax 15y ago

This is not the fault of any one network; it's a fact of life when it comes to SMS. You can have all kinds of fun, whether it's messages that appear to be from you, your friend, or 11 characters of your choice, an SMS that will only display without being stored, or even a voicemail notification. There's a nice guide to the format here: http://www.dreamfabric.com/sms/ http://www.dreamfabric.com/sms/

richardburton 15y ago
Agreed. But they do not care at all. That is my complaint.
- bad_user 15y ago
  To fix it, you'd have to reinvent the protocol. That's like reinventing email. Well good luck with that ;)
  - richardburton 15y ago
    My lack of knowledge on this subject is evident here I am afraid. Is there not a way the networks could, like Google, try and detect spam or spoof messages?
    - darklajid 15y ago
      Somewhere else in this discussion someone compared it to peering, which is quite a good example. You grant (read: sell) permission to other people to deliver text messages to your subscribers. The very same way you get a text message from carrier A while being a subscriber of carrier B. Now enter international territory. You interconnect with lots of networks, each of which can (in my experience services like that were often from/cheapest in eastern Europe) hand out access to more people to send on their behalf. Google can only try to protect you in limited cases. Check if the mail says it is originated from Google and notice that it isn't (flags a lot of false positives, if you are a valid sender, sending in a non-standard way). Checking headers (easily forged for most parts). Things like SPF [1] where you, as the admin of a domain, can tell the world that really only host X sends mails on your behalf. The world might not care though - and the burden is again not on your very own 'carrier' (Google here), but on everyone on this planet that runs a domain. There might be other ways, but inherently this problem is unsolved. Unless you went to a key signing party and verify that the data you got was signed by the key that you _know_ belongs to the sender (and you trust him not to give it away. And you trust him not to lose control of it or at least revoke it). 1: https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework

richardburton 15y ago

To be clear, I am well-aware this is not a new issue. However, in the context of the Leveson enquiry into phone "hacking" and O2's recent blunder, I think it is a great time to revisit this issue.

casca 15y ago

This is just silly. Anyone who has industry experience knows that it's trivially possible to spoof SMS phone numbers. Just like with email, it's possible to make the system more secure but given the margins associated with SMS, not likely. For a clear example, imagine that I'm roaming in Zimbabwe with my UK cellphone. I send an SMS through the Zimbabwe carrier. It (eventually) arrives to the UK recipient network, ready to be delivered. That network could do some form of verification, but as they only get the final billing tally a few days or weeks later from the Zimbabwe ISP, they don't have enough information to do so. It would not make any sense for the carriers to do SMS verification. And given that emails are far easier to get people to click on links to phishing and malware sites, spoofing SMSs has limited value. Also, did you know that I could phone you and claim to be someone else?

richardburton 15y ago
Anyone who has industry experience knows that it's trivially possible to spoof SMS phone numbers. Exactly. My point is that the general public do not know. That is bad. What do you think?
- corin_ 15y ago
  It simply isn't possible to prevent this, and your blog post just skates over that and blames the networks. All they could do is raise awareness, which realistically won't do a whole lot.
nodata 15y ago
> but given the margins associated with SMS Do you mean the margins that lead to a several hundred to several thousand percent markup?
- richardburton 15y ago
  Almost infinite margins! Check this out for a good read: Anyone who has industry experience knows that it's trivially possible to spoof SMS phone numbers.

brador 15y ago

With this technique, replies go to the correct sender number sent not the spoofer, right?

richardburton 15y ago
Correct. But that can often make the pranks even better. Especially if you send simultaneously from two people to one-another.

adhipg 15y ago

The SMS service that I use to send messages has an option to send an SMS 'from' any number I choose and it works nicely. I can send messages 'from' anyone I want - and we actually use this feature to facilitate a user to easily get replies to her messages sent directly to her phone.

richardburton 15y ago
What service are you running?
- adhipg 15y ago
  http://www.fastsms.co.uk/ http://www.fastsms.co.uk/
  - richardburton 15y ago
    You should police your service better. Not impressed.
    - adhipg 15y ago
      I don't run that service. I actually just use their API and do my best to ensure that you can't spoof someone's number (you verify your phone number with me before I can send an SMS as you).
      - richardburton 15y ago
        I asked for your service that you were running that needed to do what you do. Thanks for the down-votes.
        adhipg 15y ago
        hehe, I just wanted to clarify my stand there. About downvotes - well, I don't even have the ability to downvote (atleast all I can see is just an upvote triangle) - so, not me!

darklajid 15y ago

So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. This is wrong. First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. Second, as many pointed out already: This is not a problem of any carrier. So your peers are surprised if you send a text message from their mum's number? Sure, understandable and maybe that needs to be fixed. But your carrier is not responsible for that in my world, just as yahoo/google etc. cannot protect you from most spoofs in the mail world. And - gasp! - you can do similar things with a call (ever noticed that Skype offers to call 'from your number'?). If the article wouldn't hijack a real issue _and_ wouldn't blame the wrong target, then I think there's a valid point somewhere in there: We, the technical crowd, should find a way to educate people around us about inherent trust issues. But that should be a constructive project, not mud slinging.

jka 15y ago
Google and others can and do try to protect users from spoofing - in my opinion, every communication service provider should try to prevent their users from being misled by impersonators. I'm not sure educating all users about the spoofability or otherwise of all existing communication systems is the way forward as a tech community - there's more we can do in terms of bolstering existing security and trying to validate/flag existing messages. I've never enabled the ability to 'call from my number' for any services, so I would expect that others would be unable to spoof mine.
- richardburton 15y ago
  Could not agree more. People trust their phone network. I think the networks do not deserve that trust.
- darklajid 15y ago
  Google tries - but cannot. Ultimately it can only do the same dance that it does with spam. Learn, improve, tweak - and never succeed. I think a general project to explain encryption/signing would be awesome. I'd _love_ to send mails to my bank, to the government etc. and have them be legally binding. I'm sure it could help against quite some amount of spam as well, if you understand that an address isn't to be trusted by default. I .. don't get that last part. How do you think is the process of being able to authorize a 'from' number? Technically gazillion of services could probably do it. It's inherently simple if you are well-connected. Skype certainly doesn't need to ask you first and have a kind of exchange with you and your carrier that 'unlocks' their ability to use your number in an outgoing call. It's a policy that protects them from abuse (i.e. they care, because of legal implications and because of possible business impact if they'd abuse it). [1] They don't need to get your ok though, if they don't want to. 1: This is based on a limited experience in my past, where I had (legal) access to an asterisk server with a nice trunk connection to a mobile carrier in DE. I certainly don't have extensive telecom knowledge, but got a glimpse at least.

richardburton 15y ago

Just so you know, this is what Orange had to say about the site http://www.hoaxmail.co.uk http://www.hoaxmail.co.uk: Hi Richard Although I can understand why you may be concerned over the potential misuse of the below site, this is a third-party service which is independent of Orange and we would have no control over its existence. If you have received an offensive or questionable message from this service, you can report this to them for investigation via http://www.hoaxmail.co.uk/help/faq.php?ref=H13 http://www.hoaxmail.co.uk/help/faq.php?ref=H13 . I hope this helps! Darren Orange Helpers

ukgent2 15y ago

Sorry but this is a null issue, I have Text message APIs that allow me to specify the sender ID. I understand your app is sexy in that it works off the phone but anyone with a few pounds can do this. Text message spoofing is easy, CLI spoofing is the "cool" thing todo, and if you can spoof the Passert ID then you are gold

zokier 15y ago

There is lots of people saying that filtering SMS would be impractical for carriers. Could you explain why that is? Wouldn't it be relatively trivial to check if the number in the SMS header matches the number of the SIM card sending the message?