This currently works on all iPhones and one known android phone as of today, a f
ID: 655934 • Letter: T
Question
This currently works on all iPhones and one known android phone as of today, a formal complaint has been filed with the carrier and the FCC. I doubt they will do anything about it though since this is SMS protocol working as intended, and any particular spoofing technique is not (from what I can tell) interesting, and not a valid bug report.
I also am not a security expert by any means and would like any references to research materials to help me write a formal report on how this is actually working, but I have very little expertise and kind of just stumbled on this. Any known suite of tools also to help me do this would be great.
The exploit is purely software in nature, there is no use of hardware except the phone obviously, I have a feeling that it may be an issue with the carriers email -> SMS gateway, which to me is something they could probably fix.
If I know a currently working exploit to spoof SMS on a major carrier, what should I do?
Explanation / Answer
Make a demonstration video.
I have found that demonstration videos are an incredibly powerful way to communicate security issues, capturing the attention of managers who would otherwise dismiss this as "geeks talking geek".
Try to make the video as real life as possible. Include an example that is not just "oh look, this shouldn't happen" but actually gives a plausible real world scenario where this would be a serious issue.
Do not include technical detail in the video. If there's a technical step, just show someone running some commands on a computer - maybe even blur the screen to hide the commands. The video is to show WHAT can happen, not HOW it happens. This also means the video is less sensitive, as it doesn't contain technical details of the vulnerability.
If it is only some carriers that are vulnerable, include an example of attempting the same attack on a non-vulnerable carrier - to show that it doesn't succeed.
Share the video with the carrier privately at first, and tell them that if you don't get an adequate and timely response you will share the video more widely.