4 ms·

So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. This is wrong. First of all

So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. This is wrong. First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. Second, as many pointed out already: This is not a problem of any carrier. So your peers are surprised if you send a text message from their mum's number? Sure, understandable and maybe that needs to be fixed. But your carrier is not responsible for that in my world, just as yahoo/google etc. cannot protect you from most spoofs in the mail world. And - gasp! - you can do similar things with a call (ever noticed that Skype offers to call 'from your number'?). If the article wouldn't hijack a real issue _and_ wouldn't blame the wrong target, then I think there's a valid point somewhere in there: We, the technical crowd, should find a way to educate people around us about inherent trust issues. But that should be a constructive project, not mud slinging.

jka 15y ago
Google and others can and do try to protect users from spoofing - in my opinion, every communication service provider should try to prevent their users from being misled by impersonators. I'm not sure educating all users about the spoofability or otherwise of all existing communication systems is the way forward as a tech community - there's more we can do in terms of bolstering existing security and trying to validate/flag existing messages. I've never enabled the ability to 'call from my number' for any services, so I would expect that others would be unable to spoof mine.
- richardburton 15y ago
  Could not agree more. People trust their phone network. I think the networks do not deserve that trust.
- darklajid 15y ago
  Google tries - but cannot. Ultimately it can only do the same dance that it does with spam. Learn, improve, tweak - and never succeed. I think a general project to explain encryption/signing would be awesome. I'd _love_ to send mails to my bank, to the government etc. and have them be legally binding. I'm sure it could help against quite some amount of spam as well, if you understand that an address isn't to be trusted by default. I .. don't get that last part. How do you think is the process of being able to authorize a 'from' number? Technically gazillion of services could probably do it. It's inherently simple if you are well-connected. Skype certainly doesn't need to ask you first and have a kind of exchange with you and your carrier that 'unlocks' their ability to use your number in an outgoing call. It's a policy that protects them from abuse (i.e. they care, because of legal implications and because of possible business impact if they'd abuse it). [1] They don't need to get your ok though, if they don't want to. 1: This is based on a limited experience in my past, where I had (legal) access to an asterisk server with a nice trunk connection to a mobile carrier in DE. I certainly don't have extensive telecom knowledge, but got a glimpse at least.
  - richardburton 15y ago
    Google tries - that is a good thing! The networks do not. Check this tweet from the mobile network 3: https://twitter.com/threeuksupport/status/162101700595957760 https://twitter.com/threeuksupport/status/162101700595957760
- noselasd 15y ago
  mail -r obama@whitehouse.gov my_user@gmail.com Done from my home computer on a DSL connection, and surely gmail shows I got a mail from obama.
  - richardburton 15y ago
    Does it? Screen-grab?
    - noselasd 15y ago
      here, http://i.imgur.com/MSKJN.png http://i.imgur.com/MSKJN.png
richardburton 15y ago
So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. Yes. This is wrong. I agree ;) First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. Unrelated in terms of technical differences but not in terms of the broader trend which is this: UK networks do not care enough about their customers' privacy and security. The Leveson enquiry, the O2 issue and the existence of SMS spoofing all prove that. Second, as many pointed out already: This is not a problem of any carrier. If Apple were a carrier, would they let this happen to their customers? I do not think so. just as yahoo/google etc. cannot protect you from most spoofs in the mail world. Yahoo maybe, Google tries pretty hard. And - gasp! - you can do similar things with a call (ever noticed that Skype offers to call 'from your number'?). Requires verification. This is not relevant. If the article wouldn't hijack a real issue _and_ wouldn't blame the wrong target, then I think there's a valid point somewhere in there: We, the technical crowd, should find a way to educate people around us about inherent trust issues. But that should be a constructive project, not mud slinging. In my opinion the real issue is that the networks do not care enough to fix lots of problems.
- darklajid 15y ago
  The Apple reference is weird.. Regarding 'requiring verification': See my other post. I was certainly able to call using other people's number as source in the past. Can everyone and his mum? I - don't know. I highly doubt that Skype _needs_ (disregarding laws etc) to ask anyone. But let's get to the bottom: How do you even fix this? See, you got a friend. His name's Bob. He has a girlfriend called Alice.. (okay, just kidding): Friend is on vacation in Siberia. Wants to send a text message to his girlfriend. There's a valid scenario where a message travels from a remote (sorry to all people from Siberia) part of Europe to the UK - using a very simple protocol and (probably) going through a few hops. Now your friend isn't in Siberia. Why is this now obviously spoofed? Because he is currently connected to your carrier? A kind of 'drop text messages from somewhere else if connected here' kind of policy? What if you know that he turns his phone off during the night? Store the last point of network access per user? Text messages have a maximum life time (they are stored until either the time expires or the recipient receives and acks the messages). How would you make sure that this still works, looking at the use case above? I just think that 'They don't care' is not a healthy thing to believe. You said elsewhere that you have to admit that you're not too familiar with the tech involved (and - I certainly don't claim to speak with authority either), but you outright claim that it can be fixed (I hope you agree that we're talking about 'with reasonable effort _and_ without breaking texting as it works today').
prof_hobart 15y ago
>First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. It's not unrelated. Take a forum where you've registered your details - many people are more than happy to give out real name, mother's maiden name etc, but won't give out their mobile number. The forum can capture that number without you knowing and use that along with the info you've chosen to provide to send a valid looking SMS, both in terms of sender and content. Text From O2 - Dear Mr Smith. We need to update your profile. Please go to http://reallyo2.com/logon.html http://reallyo2.com/logon.html and log on.
- darklajid 15y ago
  You try really hard to find a way to mix these (still unrelated) things in my opinion.. What would be the sender number of O2 here to make it look authentic? And if 'I can send you a text message spoofing to be O2 to collect your number' is related, should we now bash all mail providers (or - any particular?) because the very same connection can be artificially created for 'I can send you a mail spoofing to be from O2 to collect your number'? One issue is a real privacy breach, is currently looked into according to the company and will hopefully be fixed. The other thing is a problem of a technology that wasn't designed with this problem in mind and that grew beyond anyone's expectations. One is a bug, one is (for now and in most of this thread) a communication problem that obviously surprises a number of people.
  - richardburton 15y ago
    It is a big bug that evil people can use to their evil advantage too easily.
  - prof_hobart 15y ago
    I didn't try particularly hard at all. It's a pretty obvious consequence of the two. It is already a problem for email, but most people are getting much more savvy with this and are mostly at least aware of the risk. With SMS, it's not so common. So people are less likely to expec it, and (certainly in my experience) they are more trusting of an SMS that looks like it comes from a legit source, especially if it contains personal info about you. This is partly because people are usually more wary of giving out their mobile number - I know that I've given it out to very few places, and most of them are ones that I trust. The O2 issue massively impacts this, as there's thousands of sites who now potentially have my number (and many of those will be linked to some personal info about me). But it's also partly because most people don't realise that you can spoof SMS headers this way - if you get a text message that claims to be from a particular number, most people assume that it came from that number. I'm not making any comment on the cause of it (whether it's a bug or a design feature), or whether there's anyone to "blame" (and if so, who). I'm simply pointing out that there is quite a significant overap between the two, as the combination creates a potential spammers' paradise.

jka 15y ago

Google and others can and do try to protect users from spoofing - in my opinion, every communication service provider should try to prevent their users from being misled by impersonators. I'm not sure educating all users about the spoofability or otherwise of all existing communication systems is the way forward as a tech community - there's more we can do in terms of bolstering existing security and trying to validate/flag existing messages. I've never enabled the ability to 'call from my number' for any services, so I would expect that others would be unable to spoof mine.

richardburton 15y ago
Could not agree more. People trust their phone network. I think the networks do not deserve that trust.
darklajid 15y ago
Google tries - but cannot. Ultimately it can only do the same dance that it does with spam. Learn, improve, tweak - and never succeed. I think a general project to explain encryption/signing would be awesome. I'd _love_ to send mails to my bank, to the government etc. and have them be legally binding. I'm sure it could help against quite some amount of spam as well, if you understand that an address isn't to be trusted by default. I .. don't get that last part. How do you think is the process of being able to authorize a 'from' number? Technically gazillion of services could probably do it. It's inherently simple if you are well-connected. Skype certainly doesn't need to ask you first and have a kind of exchange with you and your carrier that 'unlocks' their ability to use your number in an outgoing call. It's a policy that protects them from abuse (i.e. they care, because of legal implications and because of possible business impact if they'd abuse it). [1] They don't need to get your ok though, if they don't want to. 1: This is based on a limited experience in my past, where I had (legal) access to an asterisk server with a nice trunk connection to a mobile carrier in DE. I certainly don't have extensive telecom knowledge, but got a glimpse at least.
- richardburton 15y ago
  Google tries - that is a good thing! The networks do not. Check this tweet from the mobile network 3: https://twitter.com/threeuksupport/status/162101700595957760 https://twitter.com/threeuksupport/status/162101700595957760
noselasd 15y ago
mail -r obama@whitehouse.gov my_user@gmail.com Done from my home computer on a DSL connection, and surely gmail shows I got a mail from obama.
- richardburton 15y ago
  Does it? Screen-grab?
  - noselasd 15y ago
    here, http://i.imgur.com/MSKJN.png http://i.imgur.com/MSKJN.png

richardburton 15y ago

So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. Yes. This is wrong. I agree ;) First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. Unrelated in terms of technical differences but not in terms of the broader trend which is this: UK networks do not care enough about their customers' privacy and security. The Leveson enquiry, the O2 issue and the existence of SMS spoofing all prove that. Second, as many pointed out already: This is not a problem of any carrier. If Apple were a carrier, would they let this happen to their customers? I do not think so. just as yahoo/google etc. cannot protect you from most spoofs in the mail world. Yahoo maybe, Google tries pretty hard. And - gasp! - you can do similar things with a call (ever noticed that Skype offers to call 'from your number'?). Requires verification. This is not relevant. If the article wouldn't hijack a real issue _and_ wouldn't blame the wrong target, then I think there's a valid point somewhere in there: We, the technical crowd, should find a way to educate people around us about inherent trust issues. But that should be a constructive project, not mud slinging. In my opinion the real issue is that the networks do not care enough to fix lots of problems.

darklajid 15y ago
The Apple reference is weird.. Regarding 'requiring verification': See my other post. I was certainly able to call using other people's number as source in the past. Can everyone and his mum? I - don't know. I highly doubt that Skype _needs_ (disregarding laws etc) to ask anyone. But let's get to the bottom: How do you even fix this? See, you got a friend. His name's Bob. He has a girlfriend called Alice.. (okay, just kidding): Friend is on vacation in Siberia. Wants to send a text message to his girlfriend. There's a valid scenario where a message travels from a remote (sorry to all people from Siberia) part of Europe to the UK - using a very simple protocol and (probably) going through a few hops. Now your friend isn't in Siberia. Why is this now obviously spoofed? Because he is currently connected to your carrier? A kind of 'drop text messages from somewhere else if connected here' kind of policy? What if you know that he turns his phone off during the night? Store the last point of network access per user? Text messages have a maximum life time (they are stored until either the time expires or the recipient receives and acks the messages). How would you make sure that this still works, looking at the use case above? I just think that 'They don't care' is not a healthy thing to believe. You said elsewhere that you have to admit that you're not too familiar with the tech involved (and - I certainly don't claim to speak with authority either), but you outright claim that it can be fixed (I hope you agree that we're talking about 'with reasonable effort _and_ without breaking texting as it works today').

prof_hobart 15y ago

>First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. It's not unrelated. Take a forum where you've registered your details - many people are more than happy to give out real name, mother's maiden name etc, but won't give out their mobile number. The forum can capture that number without you knowing and use that along with the info you've chosen to provide to send a valid looking SMS, both in terms of sender and content. Text From O2 - Dear Mr Smith. We need to update your profile. Please go to http://reallyo2.com/logon.html http://reallyo2.com/logon.html and log on.

darklajid 15y ago
You try really hard to find a way to mix these (still unrelated) things in my opinion.. What would be the sender number of O2 here to make it look authentic? And if 'I can send you a text message spoofing to be O2 to collect your number' is related, should we now bash all mail providers (or - any particular?) because the very same connection can be artificially created for 'I can send you a mail spoofing to be from O2 to collect your number'? One issue is a real privacy breach, is currently looked into according to the company and will hopefully be fixed. The other thing is a problem of a technology that wasn't designed with this problem in mind and that grew beyond anyone's expectations. One is a bug, one is (for now and in most of this thread) a communication problem that obviously surprises a number of people.
- richardburton 15y ago
  It is a big bug that evil people can use to their evil advantage too easily.
- prof_hobart 15y ago
  I didn't try particularly hard at all. It's a pretty obvious consequence of the two. It is already a problem for email, but most people are getting much more savvy with this and are mostly at least aware of the risk. With SMS, it's not so common. So people are less likely to expec it, and (certainly in my experience) they are more trusting of an SMS that looks like it comes from a legit source, especially if it contains personal info about you. This is partly because people are usually more wary of giving out their mobile number - I know that I've given it out to very few places, and most of them are ones that I trust. The O2 issue massively impacts this, as there's thousands of sites who now potentially have my number (and many of those will be linked to some personal info about me). But it's also partly because most people don't realise that you can spoof SMS headers this way - if you get a text message that claims to be from a particular number, most people assume that it came from that number. I'm not making any comment on the cause of it (whether it's a bug or a design feature), or whether there's anyone to "blame" (and if so, who). I'm simply pointing out that there is quite a significant overap between the two, as the combination creates a potential spammers' paradise.