Subject: [stir] fyi: Characterizing the Security of, the SMS Ecosystem with Public Gateways

From: =JeffH <[email-masked]>
Date: Wed, 8 Jun 2016 13:45:36 -0700

of possible interest..

Sending out an SMS: Characterizing the Security of
the SMS Ecosystem with Public Gateways
http://www.ieee-security.org/TC/SP2016/papers/0824a339.pdf

Abstract

Text messages sent via the Short Message Service
(SMS) have revolutionized interpersonal communication. Recent
years have also seen this service become a critical component of
the security infrastructure, assisting with tasks including identity
verification and second-factor authentication. At the same time,
this messaging infrastructure has become dramatically more open
and connected to public networks than ever before. However, the
implications of this openness, the security practices of benign
services, and the malicious misuse of this ecosystem are not well
understood. In this paper, we provide the first longitudinal study
to answer these questions, analyzing nearly 400,000 text messages
sent to public online SMS gateways over the course of 14 months.
 From this data, we are able to identify not only a range of services
sending extremely sensitive plaintext data and implementing low
entropy solutions for one-use codes, but also offer insights into
the prevalence of SMS spam and behaviors indicating that public
gateways are primarily used for evading account creation policies
that require verified phone numbers. This latter finding has
significant implications for research combatting phone-verified
account fraud and demonstrates that such evasion will continue
to be difficult to detect and prevent.