4 ms·

>I thought KitKat was supposed to block apps from automatically sending SMS messages to premium numbers? From the analysis posted, it's trying to bypass that b

by ben1040 13y ago

>I thought KitKat was supposed to block apps from automatically sending SMS messages to premium numbers? From the analysis posted, it's trying to bypass that by not sending an SMS to a premium number. It's sending the phone number to a website, and whatever it is that is running on that website is subscribing the user to a premium service.

hansjorg 13y ago
It probably sends a non-premium message too then. There must be some kind of check in the network so that it's not possible to charge someone just by knowing their number.
- jdangu 13y ago
  No check, Premium SMS technically doesn't require any opt-in. Charging on SMS receipt is called "MT billing" [1] and this is how PSMS works in most countries including the US. PSMS is heavily regulated but the nature of the business today makes it unattractive for anything but fraud. [1] https://en.wikipedia.org/wiki/Reverse_SMS_billing https://en.wikipedia.org/wiki/Reverse_SMS_billing
  - hansjorg 13y ago
    That's an eye opener. Should be trivial to enforce this on a network level (requiring user initiation), but I guess that is not something network providers would just implement on their own. I wonder why the app requires SMS write permissions though. App stores like Google Play should reward apps which require the least amount of permissions by pushing them higher in the search results (and publicize that fact).
objclxt 13y ago
Yeah, it reverse bills the SMS. Android can only block your device from sending premium rate SMS, not receiving them (how could it? It's up to your network operator to handle that side of things). The original idea with reverse-billing was that users could subscribe to services such as weather updates, which would automatically send a message once a day/week, and the user be charged upon receipt. The problem with reverse billing is that it's clearly open to substantial abuse.
- fasteo 13y ago
  It is a Spanish premium subscription number. To subscribe you need to opt-in, either by web (getting a PIN code you need to enter to confirm the subscription) or by SMS (You need to confirm by replying to a free message from the short code). I guess this app is going through SMS opt-in, sending the reply behind the scenes.

by ben1040 13y ago

hansjorg 13y ago

It probably sends a non-premium message too then. There must be some kind of check in the network so that it's not possible to charge someone just by knowing their number.

jdangu 13y ago
No check, Premium SMS technically doesn't require any opt-in. Charging on SMS receipt is called "MT billing" [1] and this is how PSMS works in most countries including the US. PSMS is heavily regulated but the nature of the business today makes it unattractive for anything but fraud. [1] https://en.wikipedia.org/wiki/Reverse_SMS_billing https://en.wikipedia.org/wiki/Reverse_SMS_billing
- hansjorg 13y ago
  That's an eye opener. Should be trivial to enforce this on a network level (requiring user initiation), but I guess that is not something network providers would just implement on their own. I wonder why the app requires SMS write permissions though. App stores like Google Play should reward apps which require the least amount of permissions by pushing them higher in the search results (and publicize that fact).

objclxt 13y ago

Yeah, it reverse bills the SMS. Android can only block your device from sending premium rate SMS, not receiving them (how could it? It's up to your network operator to handle that side of things). The original idea with reverse-billing was that users could subscribe to services such as weather updates, which would automatically send a message once a day/week, and the user be charged upon receipt. The problem with reverse billing is that it's clearly open to substantial abuse.

fasteo 13y ago
It is a Spanish premium subscription number. To subscribe you need to opt-in, either by web (getting a PIN code you need to enter to confirm the subscription) or by SMS (You need to confirm by replying to a free message from the short code). I guess this app is going through SMS opt-in, sending the reply behind the scenes.