Hacker News

points by yellow_lead 21 hours ago | 0 comments

> The attack is remote, needs only the victim's number, and shows them nothing.

err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?

Little hard reading through the vibe slop here

I've sent weird SMS messages through my (rooted) phone before. Silent SMS messages (useful for police trying to activate your phone for triangulation) still returned delivery reports a year or two ago, allowing someone to find out if someone else's phone is on without the target ever noticing.

I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.

Carrier firewalls will probably filter these messages out but I wouldn't rely on it.

[–] lesspassiveobse 20 hours ago

They do accept/forward messages without checking if they are special carrier-only ones. ~10 years ago I had some fun sending a "voicemail received" message to people, which caused android phones to display a notification which couldn't ever be dismissed. IIRC it only worked on HTC phones and required root/xposed. SS7 in general is built with total trust in connected systems. Edit: I think it was called "HushSMS"

[–] 1116574 19 hours ago

Back in the day you could send logos, ringtones, and bunch of other random crap thru carrier APIs, provided you signed a blood contract with them lol

Those APIs are probably still online, and still require to nail your ass to the contract, but technically I would assume it's possible.

[–] Good4boothee 14 hours ago

Direct Carrier Billing is (was) also a thing. It had crazy silent mode where site can charge you (adding new item to your normal phone bill) just by serving special HTTP header - that your mobile internet provider picked up. As ripe for abuse as it sounds.

[–] rustyhancock 21 hours ago

Looks like the website offers an APK.

But not all SMS are text messages for the user.

[–] snitch182 20 hours ago

carriers can reset access points via messages for example. Learned it the hard way when my 1st grader suddenly had internet...

[–] LtWorf 20 hours ago

I think you need better network equipment at home.

My provider had given me a remotely managed router. It was trivial to change the configuration and have it work normally.

[–] jeroenhd 19 hours ago

Phones take APN configuration through special kinds of SMS messages. This isn't just about routers.

[–] cowlevel 13 hours ago

Access points are a phone network thing specifying which IP gateway the phone network routes your internet packets to. Not sure if they're still a thing in LTE which is natively IP-based.