4 ms·
Ask HN: What is the attack vector of this iOS location sharing scam?
In the last couple of weeks I’ve had four messages from new numbers containing only a ‘has shared their location with you’ type message [1]
Curiosity got the better of me and I clicked on one and it shows the same iOS page about a shared location as a valid one would. It seems therefore to be either an actual location share or a reasonably sophisticated other method.
I’m running the iOS 18 beta, and wonder if this is something to do with the new addition of RCS into messaging. I don’t know anything about the way this works but I wondered whether if a non-iMessage SMS system sent a correctly formatted location string to an iMessage recipient it would be assumed to have originated from iMessage and formatted into a proper looking location page. Just a thought.
The message is marked RCS at the top but with the reply by SMS thing at the bottom as you would see on non-iMessage replies.
The only other thing of note might be that all four numbers have been the kind that are fairly easy to remember, what we might have called gold or silver numbers here in the UK back when memorable numbers mattered :) but that might just be an unrelated coincidence.
It seems to me that it must be a scam of some sort, so my main question is what is the attack vector? (and I suppose follow up, has any harm already come of me clicking on the location..)
I have read receipts off at least.
I have put a screenshot here in case anyone wants to look at it although there isn’t much to it (except the RCS label I already mentioned) and I have cropped the number off.
[1] https://imgur.com/a/clNW5oI
- uberman 2y agoJust a heads up that once you click on spam you pass the first step of the game "Who can I spam/scam next"
- macrolla 2y agoYeah. Assuming there is any way for that feedback to get there which if it’s actually just a location then there isn’t, I don’t think (correct me, I don’t know much about this part of iOS). But if it’s a link then I agree that’s different. Certainly when I clicked on it loaded a native iOS page about the location like it would do for my friends - not something in a browser.
- mikequinlan 2y agoThis is a guess but they might just be fishing for valid phone numbers, as well as focusing on those who respond. https://www.welivesecurity.com/en/scams/scammers-phone-number/ https://www.welivesecurity.com/en/scams/scammers-phone-numbe...
- macrolla 2y agoI too wondered this. Then I wondered if this kind of message is only possible with RCS - in which case will there be lots of this spam once it’s out of beta?