{"id":3240,"date":"2011-12-20T18:51:45","date_gmt":"2011-12-20T18:51:45","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3240"},"modified":"2015-09-09T19:37:02","modified_gmt":"2015-09-09T11:37:02","slug":"cybercrooks-may-be-able-to-force-mobile-phones-to-send-premium-rate-sms-messages","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2011\/12\/cybercrooks-may-be-able-to-force-mobile-phones-to-send-premium-rate-sms-messages\/","title":{"rendered":"Cybercrooks May Be Able To Force Mobile Phones To Send Premium-Rate SMS Messages"},"content":{"rendered":"<p>There have been a few stories about this in the past, I recall <a href=\"https:\/\/www.darknet.org.uk\/2011\/01\/china-facing-problems-with-android-handsets-pre-installed-trojans\/\">China Facing Problems With Android Handsets &#038; Pre-installed Trojans<\/a> that were draining people&#8217;s batteries and phone credit by sending messages to premium-rate numbers.<\/p>\n<p>The latest news is of a more technical nature, but it outlines ways in which cybercrooks may well be able to send out premium-rate SMS messages without the handset owner knowing due to weaknesses in the actual standard.<\/p>\n<blockquote><p>Cybercrooks may be able to force mobiles to send premium-rate SMS messages or prevent them from receiving messages due to security weaknesses in mobile telecoms standards.<\/p>\n<p>The weakness involves the handling of messages directed towards SIM Application Toolkits, applications preloaded onto SIM cards by mobile operators. The applications can be used for functions such as displaying available credit or checking voicemail, as well as handling value-added services, such as micro-payments.<\/p>\n<p>SIM Toolkits receive commands via specially formatted and digitally signed SMS messages. These messages are processed without appearing in a user&#8217;s inbox and without triggering any other form of alert. Some mobiles may wake from a sleeping state on receipt of such messages but that is about all that&#8217;s likely to happen.<\/p>\n<p>The encryption scheme deployed is robust but problems might arise because error messages are automatically sent out if a command cannot be executed. The SIM Toolkit service message can be configured so that responses are made via SMS to a sender&#8217;s number or to the operator&#8217;s message centre. This creates two possible attack scenarios.<\/p><\/blockquote>\n<p>It seems to be a theoretical attack right now, but seen as though it&#8217;s a flaw with the way the standard works (and it&#8217;s implemented this way on literally millions of phones) it could become a major issue.<\/p>\n<p>I would imagine it&#8217;s something vendors can fix on future handsets they sell, or on previous handsets via a firmware update &#8211; but that wouldn&#8217;t cover everyone.<\/p>\n<p>In all likelihood however, I see the most likely ath would be it stats as a purely theoretical attack.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<blockquote><p>In the first case, an attacker might use an SMS spoofing service to force the dispatch of an error message to a premium-rate number, potentially ringing up fraudulent charges against the account of a targeted phone owner in the process.<\/p>\n<p>Attackers can&#8217;t control the content of the automatic error responses, a potential stumbling block when it comes to signing up people up for these services simply because they&#8217;ve sent a message, but it&#8217;s easy to imagine this tactic will be effective enough times to make it potentially workable. A premium-rate number is restricted to signing up people to its services only in response to properly formatted requests rather than an any old message.<\/p>\n<p>In the second case, an SIM Toolkit error message is sent to the operator&#8217;s message centre, and this is interpreted as a message delivery failure. Operators usually attempt to resend the undelivered message: creating an error loop that prevents the delivery of legitimate SMS messages to a user&#8217;s handset until a bogus SIM Toolkit message times out, typically after 24 hours or so. Because of this, sending a series of bogus SIM Toolkit messages creates a means of running an SMS DoS attack.<\/p>\n<p>Independent security researcher Bogdan Alecu gave a presentation explaining the security shortcoming, and demonstrating how it might be exploited, at a recent DeepSec security conference in Vienna, Austria.<\/p>\n<p>Alecu tested the attack against phones from Samsung, Nokia, HTC, RIM and Apple. Only phones from Nokia have the option to ask users before confirming the dispatch of an SIM Toolkit response. However the the option &#8220;Confirm SIM Service Actions&#8221; is usually disabled by default. Operators could mitigate the attack by filtering SIM Toolkit messages and whitelisting numbers that are allowed to send them. However Alecu said he is yet to encounter an operator that applies such controls, even after testing the attack on mobile operators in Romania, Bulgaria, Austria, Germany and France, IDG reports<\/p><\/blockquote>\n<p>The SIM DoS attack is fairly interesting as it could prevent a user from receiving legitimate SMS responses almost indefinitely. There are various ways to mitigate against the attack and it seems like Nokia has the most secure handset as of now &#8211; even though the option to prevent these attacks is turned off by default &#8211; at least they have the option.<\/p>\n<p>The other way is to get the service providers to filter out the messages and use a whitelist for legitimate SIM Toolkit messages &#8211; I don&#8217;t think that&#8217;s very likely though.<\/p>\n<p>Source: <a href=\"http:\/\/www.theregister.co.uk\/2011\/12\/20\/sim_toolkit_attack\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>There have been a few stories about this in the past, I recall China Facing Problems With Android Handsets &#038; Pre-installed Trojans that were draining people&#8217;s batteries and phone credit by sending messages to premium-rate numbers. The latest news is of a more technical nature, but it outlines ways in which cybercrooks may well be [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[25,16],"tags":[],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3240"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3240"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3240\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}