5 ms·

I know. But that does not mean the networks should not try to stop it.

by richardburton 15y ago

slig 15y ago
I can also spoof network packages, but my ISP will discard them. Why can't they do the same?
- viraptor 15y ago
  Only on your side. If someone was peering with your ISP and they sent some spoofed packets, there's a big chance they'll be accepted. If they get filtered, that's probably based on the ranges published by the peering partner. You can consider anycast to be something like spoofing - multiple hosts make you believe they have the same address. There's no way your ISP can verify they are.
viraptor 15y ago
Stop it how exactly? It's the same thing as with phone calls. Unless we migrate to some technology which involves signed, verifiable sources, there's nothing they can do about things like that. Once your telco approves that you can send out any number as source, you can send out any number as your source - they're the highest authority atm. Everything that happens between telcos on the wire is trusted since telcos trust each other. There are valid use cases for that too of course - setting your presented id as the number of your company's reception, having a single number for incoming connections (or a group) but using multiple lines for calling out, etc. You can probably ensure the account sending the traffic is closed since it's likely to break multiple local laws, but on the receiving side, there's nothing left to do.
- jka 15y ago
  I would have expected that the networks cross-reference the device an SMS was sent from (IMEI?) with the sender phone number claimed in the message. I don't think that's unreasonable, but Richard seems to have found that this basic check isn't being performed here. Are you so keen to see a system remain with this insecurity just because you have a fundamental belief that perfect security isn't possible? Most if not all security is a case of shades of gray, and there's clearly a lot that could be improved here by the network.
  - viraptor 15y ago
    Why do you assume that SMS messages come only from phones having an IMEI? Not only IMEI can be changed at will and is not connected to the phone number, you can send messages from a service which has legitimate reason to send the message as you. That's possible by design. It's not that I believe that perfect security isn't possible. I believe that this issue cannot be fixed in any reasonable way without redoing most of how the current system works. I did some telephony-related work and I don't see any way this kind of limitation can be put on top of our current networks (both regarding sms and phone number spoofing).
    - jka 15y ago
      I'd imagine that most users only send SMS messages from their phones, not third party services. If the default was that users couldn't send from other services/devices, then that majority of users wouldn't be vulnerable to the spoofing, and those who opt-in to allow third-party sending would at least be aware somewhat of the implications. Unless I misunderstand the underlying technology?
      - viraptor 15y ago
        Companies would have to create a central authority saying what source numbers are allowed to be used in what way. Everyone would have to check this database before sending the message from their direct customer. Everyone would have to keep it up to date. Procedures for handing over control and allowing third-party modifications would have to be created. And when I say everyone, I mean every single provider in the world, not just ones in your country - there's nothing preventing people from Germany from sending "from number" +1..... And there's still an issue of how to authorise the third parties. If some bank says multiple sources can use its number for sending messages, how do you identify them? Still - it would take only a single provider ignoring this to break the whole scheme. It's a bit similar to spam really.
      - alexchamberlain 15y ago
        It would be much more realistic to implement a signing scheme. There are only a few mobile service providers, each of which would need a master certificate, which could be distributed.
wladimir 15y ago
You could put a lot of effort into adding stuff on top to make it more secure, for example public key authentication and encryption. But maybe it's time for SMS to go away. It's very limited compared to other communication methods, and there's only so much you can bolt on afterwards. And there are plenty of alternatives...

I know. But that does not mean the networks should not try to stop it.

slig 15y ago

I can also spoof network packages, but my ISP will discard them. Why can't they do the same?

viraptor 15y ago
Only on your side. If someone was peering with your ISP and they sent some spoofed packets, there's a big chance they'll be accepted. If they get filtered, that's probably based on the ranges published by the peering partner. You can consider anycast to be something like spoofing - multiple hosts make you believe they have the same address. There's no way your ISP can verify they are.

viraptor 15y ago

Stop it how exactly? It's the same thing as with phone calls. Unless we migrate to some technology which involves signed, verifiable sources, there's nothing they can do about things like that. Once your telco approves that you can send out any number as source, you can send out any number as your source - they're the highest authority atm. Everything that happens between telcos on the wire is trusted since telcos trust each other. There are valid use cases for that too of course - setting your presented id as the number of your company's reception, having a single number for incoming connections (or a group) but using multiple lines for calling out, etc. You can probably ensure the account sending the traffic is closed since it's likely to break multiple local laws, but on the receiving side, there's nothing left to do.

jka 15y ago
I would have expected that the networks cross-reference the device an SMS was sent from (IMEI?) with the sender phone number claimed in the message. I don't think that's unreasonable, but Richard seems to have found that this basic check isn't being performed here. Are you so keen to see a system remain with this insecurity just because you have a fundamental belief that perfect security isn't possible? Most if not all security is a case of shades of gray, and there's clearly a lot that could be improved here by the network.
- viraptor 15y ago
  Why do you assume that SMS messages come only from phones having an IMEI? Not only IMEI can be changed at will and is not connected to the phone number, you can send messages from a service which has legitimate reason to send the message as you. That's possible by design. It's not that I believe that perfect security isn't possible. I believe that this issue cannot be fixed in any reasonable way without redoing most of how the current system works. I did some telephony-related work and I don't see any way this kind of limitation can be put on top of our current networks (both regarding sms and phone number spoofing).
  - jka 15y ago
    I'd imagine that most users only send SMS messages from their phones, not third party services. If the default was that users couldn't send from other services/devices, then that majority of users wouldn't be vulnerable to the spoofing, and those who opt-in to allow third-party sending would at least be aware somewhat of the implications. Unless I misunderstand the underlying technology?
    - viraptor 15y ago
      Companies would have to create a central authority saying what source numbers are allowed to be used in what way. Everyone would have to check this database before sending the message from their direct customer. Everyone would have to keep it up to date. Procedures for handing over control and allowing third-party modifications would have to be created. And when I say everyone, I mean every single provider in the world, not just ones in your country - there's nothing preventing people from Germany from sending "from number" +1..... And there's still an issue of how to authorise the third parties. If some bank says multiple sources can use its number for sending messages, how do you identify them? Still - it would take only a single provider ignoring this to break the whole scheme. It's a bit similar to spam really.
    - alexchamberlain 15y ago
      It would be much more realistic to implement a signing scheme. There are only a few mobile service providers, each of which would need a master certificate, which could be distributed.

wladimir 15y ago

You could put a lot of effort into adding stuff on top to make it more secure, for example public key authentication and encryption. But maybe it's time for SMS to go away. It's very limited compared to other communication methods, and there's only so much you can bolt on afterwards. And there are plenty of alternatives...