“There are many VoIP providers that offer ‘off net’ ‘text enablement’,” Lucky225 explained. But NetNumber also works directly with dozens of voice-over-IP or Internet-based phone companies which do not play by the same regulatory rules that apply to legacy telecommunications providers. NetNumber developed its six-digit ALT SPIDs (NetNumber IDs) to better organize and track communications service providers that were all using other numbering systems (and differing numbers of digits).

NetNumber developed its own proprietary system for mapping telecommunications providers that is used by Sakari and an entire industry of similar firms. More importantly, as part of this process no changes can happen unless the customer’s carrier has verified the changes with the existing customer.īut Lucky225 said the class of SMS interception he’s been testing targets a series of authentication weaknesses tied to a system developed by NetNumber, a private company in Lowell, Mass. That change request carries what’s known as an ALT-SPID, which is a four-digit number that enables NPAC to identify the telecommunications company currently providing service to the customer. When customers want to move their phone numbers - mobile or otherwise - that request is routed through NPAC to the customer’s carrier. Most large and legacy telecommunications providers validate transfer requests related to their customers by consulting NPAC, or the Number Portability Administration Center. The interception method that Lucky225 described is still dangerously exposed by a number of systemic weaknesses in the global SMS network, he said. “And the ‘fix’ put in seems to be temporary in nature.” “This basically means the only thing standing between anyone and the equivalent of a SIM swap is a forged LOA,” Nixon said. An expert on SIM-swapping attacks who’s been quoted quite a bit on this blog, Nixon said she also had Lucky225 test his interception tricks on her mobile phone, only to watch her incoming SMS messages show up on his burner phone. From there, the attacker can reset the password of any account which uses that phone number for password reset links.īut the attacks Lucky225 has been demonstrating merely require customers of any number of firms to sign a sworn “letter of authorization” or LOA stating that they indeed do have the authority to act on behalf of the owner of the targeted number.Īllison Nixon is chief research officer at Unit221B, a New York City-based cyber investigations firm. In a SIM swap, the attackers redirect the target’s phone number to a device they control, and then can intercept the target’s incoming SMS messages and phone calls. The most common way thieves hijack SMS messages these days involves “sim swapping,” a crime that entails bribing or tricking employees at wireless phone companies into modifying customer account information. There are many of these ‘SMS enablement’ providers.”

“It’s not a Sakari thing,” Lucky225 replied when first approached for more details. He said Sakari is just one part of a much larger, unregulated industry that can be used to hijack SMS messages for many phone numbers. Lucky225, who is chief information officer for Okey Systems, told KrebsOnSecurity that Sakari has since taken steps to block its service for being used with mobile telephone numbers. Sakari’s LOA says that the user should not conduct any unlawful, harassing, or inappropriate behavior with the text messaging service and phone number.īut as Lucky225 showed, a user can just sign up with someone else’s number and receive their text messages instead. While adding a number, Sakari provides the Letter of Authorization for the user to sign. Lucky225 provided Motherboard with screenshots of Sakari’s interface, which show a red “+” symbol where users can add a number. The cheapest plan, which allows customers to add a phone number they want to send and receive texts as, is where the $16 goes. Sakari offers a free trial to anyone wishing to see what the company’s dashboard looks like. It cost just $16, and there was precious little to prevent someone from stealing your text messages without your knowledge. The “how they did it” was sickeningly simple. Lucky225 showed how anyone could do the same after creating an account at a service called Sakari, a company that helps celebrities and businesses do SMS marketing and mass messaging. Security researcher “ Lucky225” worked with ’s Joseph Cox to intercept Cox’s incoming text messages with his permission. Now we’re learning about an entire ecosystem of companies that anyone could use to silently intercept text messages intended for other mobile users. SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else.

Does spoof sms sender work