skip to main content
research-article

Characterizing the Security of the SMS Ecosystem with Public Gateways

Published: 10 December 2018 Publication History

Abstract

Recent years have seen the Short Message Service (SMS) become a critical component of the security infrastructure, assisting with tasks including identity verification and second-factor authentication. At the same time, this messaging infrastructure has become dramatically more open and connected to public networks than ever before. However, the implications of this openness, the security practices of benign services, and the malicious misuse of this ecosystem are not well understood. In this article, we provide a comprehensive longitudinal study to answer these questions, analyzing over 900,000 text messages sent to public online SMS gateways over the course of 28 months. From this data, we uncover the geographical distribution of spam messages, study SMS as a transmission medium of malicious content, and find that changes in benign and malicious behaviors in the SMS ecosystem have been minimal during our collection period. The key takeaways of this research show many services sending sensitive security-based messages through an unencrypted medium, implementing low entropy solutions for one-use codes, and behaviors indicating that public gateways are primarily used for evading account creation policies that require verified phone numbers. This latter finding has significant implications for combating phone-verified account fraud and demonstrates that such evasion will continue to be difficult to detect and prevent.

References

[1]
Manal Adham, Amir Azodi, Yvo Desmedt, and Ioannis Karaolis. 2013. How to attack two-factor authentication internet banking. In Financial Cryptography and Data Security. No. 7859 in Lecture Notes in Computer Science. Springer, Berlin, 322--328.
[2]
Z. Ahmadian, S. Salimi, and A. Salahi. 2009. New attacks on UMTS network access. In Proceedings of the Wireless Telecommunications Symposium (WTS’09). 1--6.
[3]
F. Aloul, S. Zahidi, and W. El-Hajj. 2009. Two factor authentication using mobile phones. In Proceedings of the IEEE/ACS International Conference on Computer Systems and Applications (AICCSA’09). 641--644.
[4]
Apple Continuity 2015. Apple continuity. Retrieved from https://support.apple.com/en-us/HT204681.
[5]
Jeff Atwood. 2012. Make your email hacker proof. Coding Horror. Retrieved from http://blog.codinghorror.com/make-your-email-hacker-proof/.
[6]
Elad Barkan, Eli Biham, and Nathan Keller. 2007. Instant ciphertext-Only cryptanalysis of GSM encrypted communication. J. Cryptol. 21, 3 (Sep. 2007), 392--429.
[7]
Alex Biryukov, Adi Shamir, and David Wagner. 2001. Real time cryptanalysis of A5/1 on a PC. In Proceedings of the 7th International Workshop on Fast Software Encryption (FSE’00). Springer-Verlag, London, 1--18.
[8]
Boss Revolution 2015. Boss revolution. Retrieved from https://www.bossrevolution.ca.
[9]
Burner 2015. Burner app. Retrieved from http://www.burnerapp.com.
[10]
Kelsey Campbell-Dollaghan. 2014. How hackers reportedly side-Stepped Google’s two-factor authentication. Gizmodo. Retrieved from http://gizmodo.com/how-hackers-reportedly-side-stepped-gmails-two-factor-a-1653631338.
[11]
CardTechnology. 2007. UAE ID card to support iris biometrics. Retrieved from http://www.cardtechnology.com/article.html?id=20070423V0XCZ91L.
[12]
Carlos Castillo. 2011. Spitmo vs zitmo: Banking trojans target android. McAfee Labs Blog. Retrieved from http://blogs.mcafee.com/mcafee-labs/spitmo-vs-zitmo-banking-trojans-target-android.
[13]
Chia Yuan Cho, Juan Caballero, Chris Grier, Vern Paxson, and Dawn Song. 2010. Insights from the inside: A view of botnet management from infiltration. In Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET’10).
[14]
Nathan Crooks. 2015. Venezuela, the country with four exchange rates. Bloomberg Business. Retrieved from http://www.bloomberg.com/news/articles/2015-02-19/venezuela-the-country-with-four-exchange-rates.
[15]
Adrian Dabrowski, Nicola Pianta, Thomas Klepp, Martin Mulazzani, and Edgar Weippl. 2014. IMSI-Catch me if you can. In Proceedings of the 30th Annual Computer Security Applications Conference.
[16]
Alfredo De Santis, Aniello Castiglione, Giuseppe Cattaneo, Maurizio Cembalo, Fabio Petagna, and Umberto Ferraro Petrillo. 2010. An extensible framework for efficient secure SMS. In Proceedings of the International Conference on Complex, Intelligent and Software Intensive Systems (CISIS’10). IEEE, 843--850.
[17]
D. DeFigueiredo. 2011. The case for mobile two-Factor authentication. IEEE Secur. Privacy Mag. 9, 5 (Sep. 2011), 81--85.
[18]
Sarah Jane Delany, Mark Buckley, and Derek Greene. 2012. SMS spam filtering: Methods and data. Expert Syst. Appl. 39, 10 (2012), 9899--9908.
[19]
Alexandra Dmitrienko, Christopher Liebchen, Christian Rossow, and Ahmad-Reza Sadeghi. 2014. On the (in)security of mobile two-factor authentication. In Proceedings of the Conference on Financial Cryptography and Data Security (FC’14). Springer.
[20]
Orr Dunkelman, Nathan Keller, and Adi Shamir. 2010. A Practical-time Related-key attack on the KASUMI cryptosystem used in GSM and 3G telephony. In Proceedings of the 30th Annual Conference on Advances in Cryptology (CRYPTO’10). Springer-Verlag, Berlin, 393--410.
[21]
Duo Mobile 2015. Mobile authentication. Duo Mobile. Retrieved from https://www.duosecurity.com/product/methods/duo-mobile.
[22]
eCall 2015. eCall. Retrieved from http://www.ecall.ch.
[23]
Jan-Erik Lothe Eide. 2015. SMS One-Time Passwords: Security in Two-Factor Authenication. Master’s Thesis. University of Bergen.
[24]
Adrienne Porter Felt, Matthew Finifter, Erika Chin, Steve Hanna, and David Wagner. 2011. A survey of mobile malware in the wild. In Proceedings of the ACM Workshop on Security and Privacy in Mobile Devices.
[25]
Brendan J. Frey and Delbert Dueck. 2007. Clustering by passing messages between data points. Science 315, 5814 (2007), 972--976.
[26]
Frim 2015. Frim. Retrieved from http://fr.im.
[27]
Nico Golde, Kevin Redon, and Ravishankar Borgaonkar. 2012. Weaponizing femtocells: The effect of rogue devices on mobile telecommunications. In Proceedings of the 19th Network and Distributed System Security Symposium.
[28]
Google Voice 2015. Google voice. Retrieved from http://www.google.com/voice.
[29]
Paul A. Grassi, James L. Fenton, Elaine M. Newton, Ray A. Perlner, Andrew R. Regenscheid, William E. Burr, Justin P. Richer, Naomi B. Lefkovitz, Jamie M. Danker, YeeYin Choong et al. 2016. DRAFT NIST special publication 800 63B digital identity guidelines. Retrieved from https://pages.nist.gov/800-63-3/sp800-63b.html.
[30]
Chris Grier, Lucas Ballard, Juan Caballero, Neha Chachra, Christian J. Dietrich, Kirill Levchenko, Panayiotis Mavrommatis, Damon McCoy, Antonio Nappa, Andreas Pitsillidis, Niels Provos, M. Zubair Rafique, Moheeb Abu Rajab, Christian Rossow, Kurt Thomas, Vern Paxson, Stefan Savage, and Geoffrey M. Voelker. 2012. Manufacturing compromise: The emergence of exploit-as-a-service. In Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS’12). ACM, New York, NY, 821--832.
[31]
Stephen Hilt and Philippe Lin. 2016. Leaking beeps: Unencrypted pager messages in the healthcare industry. In TrendLabs Research. Retrieved from https://documents.trendmicro.com/assets/threat-reports/wp-leaking-beeps-healthcare.pdf.
[32]
IBM Security Trusteer Rapport 2016. IBM security trusteer rapport. Retrieved from http://www-03.ibm.com/software/products/en/trusteer-rapport.
[33]
IdentityGuard 2015. IdentityGuard identity authentication platform. Entrust, Inc. Retrieved from https://www.entrust.com/products/entrust-identityguard/.
[34]
Nan Jiang, Yu Jin, Ann Skudlark, and Zhi-Li Zhang. 2013. Greystar: Fast and accurate detection of SMS spam numbers in large cellular networks using grey phone space. In Proceedings of the 22nd USENIX Security Symposium. USENIX Association, Washington DC.
[35]
Chris Kanich, Christian Kreibich, Kirill Levchenko, Brandon Enright, Geoffrey M. Voelker, Vern Paxson, and Stefan Savage. 2008. Spamalytics: An empirical analysis of spam marketing conversion. In Proceedings of the 15th ACM Conference on Computer and Communications Security. ACM, 3--14.
[36]
Chris Kanich, Nicholas Weaver, Damon McCoy, Tristan Halvorson, Christian Kreibich, Kirill Levchenko, Vern Paxson, Geoffrey M. Voelker, and Stefan Savage. 2011. Show me the money: Characterizing spam-advertised revenue. In Proceedings of the 2015 USENIX Security Symposium.
[37]
Karsten Nohl. 2016. SS7 attack update and phone phreaking. In GeekFest Berlin. Retrieved from https://www.youtube.com/watch?v=BbPLscWQ1Bw.
[38]
Reto E. Koenig, Philipp Locher, and Rolf Haenni. 2013. Attacking the verification code mechanism in the norwegian internet voting system. In E-Voting and Identity, James Heather, Steve Schneider, and Vanessa Teague (Eds.). Springer, Berlin, 76--92.
[39]
Radhesh Krishnan Konoth, Victor van der Veen, and Herbert Bos. 2016. How anywhere computing just killed your phone-based two-factor authentication. In Proceedings of the 20th International Conference on Financial Cryptography and Data Security.
[40]
Laurens Koot. 2012. Security of Mobile TAN on Smartphones. Master’s Thesis. Radboud University Nijmegen, Nijmegen.
[41]
Brian Krebs. 2014. Banks: Credit card breach at Home Depot. Krebs on Security. Retrieved from http://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/.
[42]
Brian Krebs. 2015a. Experian breach affects 15 million consumers. Krebs on Security. Retrieved from http://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/.
[43]
Brian Krebs. 2015b. Online cheating site ashleymadison hacked. Krebs on Security. Retrieved from http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/.
[44]
Charles Lever, Manos Antonakakis, Bradley Reaves, Patrick Traynor, and Wenke Lee. 2013. The core of the matter: Analyzing malicious traffic in cellular carriers. In Proceedings of the 20th Network and Distributed System Security Symposium.
[45]
John Leyden. 2008. Visa trials PIN payment card to fight online fraud. Retrieved from http://www.theregister.co.uk/2008/11/10/visa_one_time_code_card/.
[46]
Luca Melette. 2016. Effective SS7 protection. In Proceedings of the ITU Workshop on SS7 Security.
[47]
Hans Peter Luhn. 1960. Computer for verifying numbers. Retrieved from https://www.google.com/patents/US2950048 U.S. Patent 2,950,048.
[48]
Erika McCallister, Tim Grance, and Karen Scarfone. 2010. Guide to protecting the confidentiality of personally identifiable information (PII). Recommendations of the National Institute of Standards and Technology. Retrieved from http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf.
[49]
MightyText 2015. MightyText. Retrieved from http://mightytext.net.
[50]
Collin Mulliner, Ravishankar Borgaonkar, Patrick Stewin, and Jean-Pierre Seifert. 2013. SMS-based one-time passwords: Attacks and defense. In Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, 150--159.
[51]
Ilona Murynets and Roger Piqueras Jover. 2012. Crime scene investigation: SMS spam data analysis. In Proceedings of the 2012 ACM Conference on Internet Measurement Conference (IMC’12). ACM, New York, NY, 441--452.
[52]
Akshay Narayan and Prateek Saxena. 2013. The curse of 140 characters: Evaluating the efficacy of SMS spam detection on android. In Proceedings of the Third ACM Workshop on Security and Privacy in Smartphones 8 Mobile Devices (SPSM’13). ACM, New York, NY, 33--42.
[53]
Nexmo 2015. Nexmo. Retrieved from https://www.nexmo.com/.
[54]
OpenCNAM 2015. OpenCNAM. Retrieved from https://www.opencnam.com.
[55]
PayCenter 2015. PayCenter. Retrieved from https://www.paycenter.de.
[56]
Christian Peeters, Hadi Abdullah, Nolen Scaife, Jasmine Bowers, Patrick Traynor, Bradley Reaves, and Kevin R. B. Butler. 2018. Sonar: Detecting SS7 redirection attacks with audio-based distance bounding. In Proceedings of the IEEE Symposium on Security and Privacy (SP’18). 86--101.
[57]
Pinger 2015. Pinger. Retrieved from http://www.pinger.com.
[58]
Plivo 2015. Plivo. Retrieved from https://www.plivo.com/.
[59]
Pushbullet 2015. Pushbullet. Retrieved from http://pushbullet.com.
[60]
Bradley Reaves, Logan Blue, Dave Tian, Patrick Traynor, and Kevin R. B. Butler. 2016b. Detecting SMS spam in the age of legitimate bulk messaging. In Proceedings of the 9th ACM Conference on Security 8 Privacy in Wireless and Mobile Networks. ACM, 165--170.
[61]
Bradley Reaves, Nolen Scaife, Adam Bates, Patrick Traynor, and Kevin Butler. 2015. Mo(bile) money, mo(bile) problems: Analysis of branchless banking applications in the developing world. In Proceedings of the USENIX Security Symposium (SECURITY’15).
[62]
Bradley Reaves, Nolen Scaife, Dave Tian, Logan Blue, Patrick Traynor, and Kevin R. B. Butler. 2016a. Sending out an SMS: Characterizing the security of the SMS ecosystem with public gateways. In Proceedings of the IEEE Symposium on Security and Privacy (SP’16).
[63]
RedOxygen 2015. RedOxygen. Retrieved from http://www.redoxygen.com.
[64]
N. Saxena and N. S. Chaudhari. 2014. EasySMS: A protocol for end-to-end secure transmission of SMS. IEEE Trans. Info. Forens. Secur. 9, 7 (July 2014), 1157--1168.
[65]
N. Saxena, H. Shen, N. Komninos, K. K. R. Choo, and N. S. Chaudhari. 2018. BVPSMS: A batch verification protocol for end-to-end secure SMS for mobile users. IEEE Trans. Depend. Secure Comput. (2018), 1.
[66]
Bruce Schneier. 2005. Two-factor authentication: Too little, too late. Commun. ACM 48, 4 (Apr. 2005).
[67]
Scrapy 2015. Scrapy. Retrieved from http://scrapy.org.
[68]
SecurID 2015. RSA SecurID hardware tokens. EMC Security. Retrieved from http://www.emc.com/security/rsa-securid/rsa-securid-hardware-tokens.htm.
[69]
SiPix Imagining, Inc. 2006. World’s first ISO compliant payment displaycard using SiPix and SmartDisplayer’s flexible display panel. Retrieved from http://www.businesswire.com/portal/site/google/index.jsp?ndmViewId=news_view8newsId=200605100061938newsLang=en.
[70]
Ann Skudlark. 2014. Characterizing SMS Spam in a Large Cellular Network via Mining Victim Spam Reports. Retrieved from http://web2-clone.research.att.com/export/sites/att_labs/techdocs/TD_101435.pdf.
[71]
SMS Forum. 2003. Short message peer to peer protocol specification 5.0. Retrieved from http://opensmpp.org/specs/smppv50.pdf.
[72]
Anne-Birte Stensgaard. 2006. Biometric breakthrough—Credit cards secured with fingerprint recognition made feasible. Retrieved from http://www.ameinfo.com/58236.html.
[73]
Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski, Richard Kemmerer, Christopher Kruegel, and Giovanni Vigna. 2009. Your botnet is my botnet: Analysis of a botnet takeover. In Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS’09). ACM, New York, NY, 635--647.
[74]
Henry Tan, Nazli Goharian, and Micah Sherr. 2012. $100,000 prize jackpot. call now!: Identifying the pertinent features of SMS spam. In Proceedings of the 35th International ACM SIGIR Conference on Research and Development in Information Retrieval. ACM, New York, NY, 1175--1176.
[75]
The Open University. 2014. Text messaging usage statistics. Retrieved from http://www.openuniversity.edu/news/news/2014-text-messaging-usage-statistics.
[76]
Kurt Thomas, Danny Huang, David Wang, Elie Bursztein, Chris Grier, Thomas J. Holt, Christopher Kruegel, Damon McCoy, Stefan Savage, and Giovanni Vigna. 2015. Framing dependencies introduced by underground commoditization. In Proceedings of the 14th Annual Workshop on the Economics of Information Security.
[77]
Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier, and Damon McCoy. 2014. Dialing back abuse on phone verified accounts. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. ACM, New York, NY, 465--476.
[78]
Kurt Thomas, Damon McCoy, Chris Grier, Alek Kolcz, and Vern Paxson. 2013. Trafficking fraudulent accounts: The role of the underground market in Twitter spam and abuse. In Proceedings of the 2015 USENIX Security Symposium. 195--210.
[79]
Anna Tims. 2015. “SIM swap” gives fraudsters access-all-areas via your mobile phone. The Guardian (Sept. 2015). Retrieved from http://www.theguardian.com/money/2015/sep/26/sim-swap-fraud-mobile-phone-vodafone-customer.
[80]
Patrick Traynor. 2012. Characterizing the security implications of third-party EAS over cellular text messaging services. IEEE Trans. Mobile Comput. 11, 6 (2012), 983--994.
[81]
Patrick Traynor, William Enck, Patrick McDaniel, and Thomas La Porta. 2008. Exploiting open functionality in SMS-capable cellular networks. J. Comput. Secur. 16, 6 (2008), 713--742.
[82]
Patrick Traynor, William Enck, Patrick McDaniel, and Thomas La Porta. 2009. Mitigating attacks on open functionality in SMS-capable cellular networks. IEEE/ACM Trans. Netw. 17, 1 (2009), 40--53.
[83]
Patrick Traynor, Patrick McDaniel, and Thomas La Porta. 2007. On attack causality in internet-connected cellular networks. In Proceedings of the USENIX Security Symposium (SECURITY’07).
[84]
Patrick Traynor, Patrick McDaniel, and Thomas La Porta. 2008. Security for Telecommunications Networks. No. 978-0-387-72441-6 in Advances in Information Security Series. Springer.
[85]
Twilio 2015. Twilio. Retrieved from http://www.twilio.com.
[86]
U.S. Office of Personnel Management. 2015. Cybersecurity incidents. Retrieved from https://www.opm.gov/cybersecurity/cybersecurity-incidents/.
[87]
VirusTotal. 2015. VirusTotal—Free online virus, malware and URL scanner. Retrieved from https://www.virustotal.com/.
[88]
Yajin Zhou and Xuxian Jiang. 2012. Dissecting android malware: Characterization and evolution. In Proceedings of the IEEE Symposium on Security and Privacy (SP’12). 95 --109.

Cited By

View all
  • (2024)On SMS Phishing Tactics and Infrastructure2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00169(1-16)Online publication date: 19-May-2024
  • (2024)The Governance LandscapeFrom Encryption to Quantum Computing10.1007/978-94-6265-635-2_3(85-147)Online publication date: 1-Sep-2024
  • (2023)Freaky Leaky SMSProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620358(2151-2168)Online publication date: 9-Aug-2023
  • Show More Cited By

Index Terms

  1. Characterizing the Security of the SMS Ecosystem with Public Gateways

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Transactions on Privacy and Security
    ACM Transactions on Privacy and Security  Volume 22, Issue 1
    February 2019
    226 pages
    ISSN:2471-2566
    EISSN:2471-2574
    DOI:10.1145/3287762
    Issue’s Table of Contents
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 10 December 2018
    Accepted: 01 August 2018
    Revised: 01 June 2018
    Received: 01 April 2017
    Published in TOPS Volume 22, Issue 1

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. Multifactor authentication
    2. SMS
    3. SMS abuse
    4. SMS spam

    Qualifiers

    • Research-article
    • Research
    • Refereed

    Funding Sources

    • U.S. National Science Foundation

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)36
    • Downloads (Last 6 weeks)0
    Reflects downloads up to 15 Sep 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)On SMS Phishing Tactics and Infrastructure2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00169(1-16)Online publication date: 19-May-2024
    • (2024)The Governance LandscapeFrom Encryption to Quantum Computing10.1007/978-94-6265-635-2_3(85-147)Online publication date: 1-Sep-2024
    • (2023)Freaky Leaky SMSProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620358(2151-2168)Online publication date: 9-Aug-2023
    • (2023)Decision Making by Applying Machine Learning Techniques to Mitigate Spam SMS AttacksKey Digital Trends in Artificial Intelligence and Robotics10.1007/978-3-031-30396-8_14(154-166)Online publication date: 17-Apr-2023
    • (2020)BlueDoorProceedings of the 18th International Conference on Mobile Systems, Applications, and Services10.1145/3386901.3389025(286-298)Online publication date: 15-Jun-2020

    View Options

    Get Access

    Login options

    Full Access

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    HTML Format

    View this article in HTML Format.

    HTML Format

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media