38

During a talk from a vendor, the speaker mentioned that their product used a "little known feature" of SMS in order to overwrite the last text message received from them. This feature was being used to send a one-time token, so it was quite useful. He didn't demonstrate it at the time, but I recently noticed that my mobile phone provider does the same thing with special offer tokens. Every time I receive a new token, it overwrites the old SMS message. I've since verified that this works on other phones - even really old ones.

I can see this posing a security risk. For example, someone might send me an threat, then have the second SMS erase (redact) the message later, leaving me with no proof. There are also social engineering implications.

What feature of SMS allows this overwriting? What security measures are in place to prevent this feature from being abused, especially in combination with SMS spoofing?

Polynomial
  • 132,208
  • 43
  • 298
  • 379

1 Answers1

28

This is built in to SMS and is implemented in the Protocol Identifier (TP-PID):

For MT short messages, on receipt of a short message from from the SC, the MS shall check to see if the associated Protocol Identifier contains a Replace Short Message Type code.

If such a code is present, the the MS will check the originating address and replace any existing stored message having the same Protocol Identifier code and originating address with the new short message and other parameter values. If there is no message to be replaced, the MS shall store the message in the normal way. The MS may also check the SC address as well as the Originating Address. However, in a network which has multiple SCs, it is possible for a Replace Message type for a SM to be sent via different SCs and so it is recommended that the SC address should not be checked by the MS unless the application specifically requires such a check.

If a Replace Short Message Type code is not present then the MS will will store the message in the normal way.

In the SMPP protocol specification this is REPLACE_SM:

This command is issued by the ESME to replace a previously submitted short message that isstill pending delivery. The matching mechanism is based on the message_id and source addressof the original message.Where the original submit_sm ‘source address’ was defaulted to NULL, then the source addressin the replace_sm command should also be NULL

And in EMI this is Type of Service 08, code 01:

This Type of Service requests to replace a previously submitted message. It is only present when an update is requested. By default a message is assumed to be a new message.

The reason that this exists is so that services that send lots of SMS messages can avoid consuming the mobile phone's memory. There is no security built in as far as I know; if you can spoof the source id, then you can tell the phone to overwrite previous messages from that same source.

Mark Beadles
  • 3,932
  • 2
  • 20
  • 23