4 ms·

As the tweet pointed out, this has been possible for years. You can also send emails from whoever you want.

by alexchamberlain 15y ago

steve-howard 15y ago
You can still set up ways to verify e-mail senders (e.g. DKIM). Can't imagine how you'd verify an SMS.
- rmc 15y ago
  Or a GPG signed email.
mootothemax 15y ago
You can also send emails from whoever you want. Precisely - relying on someone's email address, phone number, name or physical address is not a reliable authentication measure.
richardburton 15y ago
I know. But that does not mean the networks should not try to stop it.
- slig 15y ago
  I can also spoof network packages, but my ISP will discard them. Why can't they do the same?
  - viraptor 15y ago
    Only on your side. If someone was peering with your ISP and they sent some spoofed packets, there's a big chance they'll be accepted. If they get filtered, that's probably based on the ranges published by the peering partner. You can consider anycast to be something like spoofing - multiple hosts make you believe they have the same address. There's no way your ISP can verify they are.
- viraptor 15y ago
  Stop it how exactly? It's the same thing as with phone calls. Unless we migrate to some technology which involves signed, verifiable sources, there's nothing they can do about things like that. Once your telco approves that you can send out any number as source, you can send out any number as your source - they're the highest authority atm. Everything that happens between telcos on the wire is trusted since telcos trust each other. There are valid use cases for that too of course - setting your presented id as the number of your company's reception, having a single number for incoming connections (or a group) but using multiple lines for calling out, etc. You can probably ensure the account sending the traffic is closed since it's likely to break multiple local laws, but on the receiving side, there's nothing left to do.
  - jka 15y ago
    I would have expected that the networks cross-reference the device an SMS was sent from (IMEI?) with the sender phone number claimed in the message. I don't think that's unreasonable, but Richard seems to have found that this basic check isn't being performed here. Are you so keen to see a system remain with this insecurity just because you have a fundamental belief that perfect security isn't possible? Most if not all security is a case of shades of gray, and there's clearly a lot that could be improved here by the network.
    - viraptor 15y ago
      Why do you assume that SMS messages come only from phones having an IMEI? Not only IMEI can be changed at will and is not connected to the phone number, you can send messages from a service which has legitimate reason to send the message as you. That's possible by design. It's not that I believe that perfect security isn't possible. I believe that this issue cannot be fixed in any reasonable way without redoing most of how the current system works. I did some telephony-related work and I don't see any way this kind of limitation can be put on top of our current networks (both regarding sms and phone number spoofing).
      - jka 15y ago
        I'd imagine that most users only send SMS messages from their phones, not third party services. If the default was that users couldn't send from other services/devices, then that majority of users wouldn't be vulnerable to the spoofing, and those who opt-in to allow third-party sending would at least be aware somewhat of the implications. Unless I misunderstand the underlying technology?
- wladimir 15y ago
  You could put a lot of effort into adding stuff on top to make it more secure, for example public key authentication and encryption. But maybe it's time for SMS to go away. It's very limited compared to other communication methods, and there's only so much you can bolt on afterwards. And there are plenty of alternatives...
rmc 15y ago
But people don't know this. So they trust SMSs. Most banks will state "We will never email you", so people know not to trust emails from 'their bank'. However some banks use SMSs for authentication. SMSs have much higher trust factor. After all, we have spam filters on email, but not on SMS.
- richardburton 15y ago
  Exactly. My friends are shocked when they see this working.

As the tweet pointed out, this has been possible for years. You can also send emails from whoever you want.

steve-howard 15y ago

You can still set up ways to verify e-mail senders (e.g. DKIM). Can't imagine how you'd verify an SMS.

rmc 15y ago
Or a GPG signed email.

mootothemax 15y ago

You can also send emails from whoever you want. Precisely - relying on someone's email address, phone number, name or physical address is not a reliable authentication measure.

richardburton 15y ago

I know. But that does not mean the networks should not try to stop it.

slig 15y ago
I can also spoof network packages, but my ISP will discard them. Why can't they do the same?
- viraptor 15y ago
  Only on your side. If someone was peering with your ISP and they sent some spoofed packets, there's a big chance they'll be accepted. If they get filtered, that's probably based on the ranges published by the peering partner. You can consider anycast to be something like spoofing - multiple hosts make you believe they have the same address. There's no way your ISP can verify they are.
viraptor 15y ago
Stop it how exactly? It's the same thing as with phone calls. Unless we migrate to some technology which involves signed, verifiable sources, there's nothing they can do about things like that. Once your telco approves that you can send out any number as source, you can send out any number as your source - they're the highest authority atm. Everything that happens between telcos on the wire is trusted since telcos trust each other. There are valid use cases for that too of course - setting your presented id as the number of your company's reception, having a single number for incoming connections (or a group) but using multiple lines for calling out, etc. You can probably ensure the account sending the traffic is closed since it's likely to break multiple local laws, but on the receiving side, there's nothing left to do.
- jka 15y ago
  I would have expected that the networks cross-reference the device an SMS was sent from (IMEI?) with the sender phone number claimed in the message. I don't think that's unreasonable, but Richard seems to have found that this basic check isn't being performed here. Are you so keen to see a system remain with this insecurity just because you have a fundamental belief that perfect security isn't possible? Most if not all security is a case of shades of gray, and there's clearly a lot that could be improved here by the network.
  - viraptor 15y ago
    Why do you assume that SMS messages come only from phones having an IMEI? Not only IMEI can be changed at will and is not connected to the phone number, you can send messages from a service which has legitimate reason to send the message as you. That's possible by design. It's not that I believe that perfect security isn't possible. I believe that this issue cannot be fixed in any reasonable way without redoing most of how the current system works. I did some telephony-related work and I don't see any way this kind of limitation can be put on top of our current networks (both regarding sms and phone number spoofing).
    - jka 15y ago
      I'd imagine that most users only send SMS messages from their phones, not third party services. If the default was that users couldn't send from other services/devices, then that majority of users wouldn't be vulnerable to the spoofing, and those who opt-in to allow third-party sending would at least be aware somewhat of the implications. Unless I misunderstand the underlying technology?
wladimir 15y ago
You could put a lot of effort into adding stuff on top to make it more secure, for example public key authentication and encryption. But maybe it's time for SMS to go away. It's very limited compared to other communication methods, and there's only so much you can bolt on afterwards. And there are plenty of alternatives...

rmc 15y ago

But people don't know this. So they trust SMSs. Most banks will state "We will never email you", so people know not to trust emails from 'their bank'. However some banks use SMSs for authentication. SMSs have much higher trust factor. After all, we have spam filters on email, but not on SMS.

richardburton 15y ago
Exactly. My friends are shocked when they see this working.