Security Wise: Protecting SMS messages used in retail and critical business processes

21 Sep 2022

SMS (commonly called and known as text messages) is a convenient way for businesses to communicate with customers, staff and others and SMS messages are also frequently used to send highly sensitive data. This can include one-time passcodes and services as part of a multi-factor authentication (MFA) system.

SMS has several qualities which make it attractive for business use:

• familiarity – consumers understand SMS
• timely – SMS messages get delivered (even globally), usually within a few seconds
• inexpensive – relatively low cost to implement and use
• ever-present – most mobile phones globally support the SMS protocol, making it easy and relatively cheap to develop services around the use of it

Many businesses use SMS for the following purposes:

• to send information to customers
• to send one-time passcodes to customers
• to confirm a questionable transaction

While the main qualities of SMS make it a valuable business tool, the technology was never intended to be used to transmit “high risk content” and there are several inherent weaknesses in the ecosystem which support SMS.

These weaknesses mean that, where the value of the message content is of interest to bad actors, they are increasingly attempting to exploit SMS.

The Short Messaging Service (SMS) was originally developed as an engineering signalling system. It was not designed as a method for transmitting secure messages. Mobile telecoms companies are aware of the problems with SMS and are actively working to close vulnerabilities, but it may be impossible to fully compensate for the inherent weaknesses of the system. So, for any business using SMS, they must understand how and where the technology is used and take steps to mitigate or reduce associated risks, where appropriate.

Security advice (recommended by the NCSC):

1. Know your estate

Before you can determine which protections you should put in place, you must first understand exactly where and how your business uses SMS. You should then assess the level of risk associated with these business process.

You should create and maintain a formal record of how and where your organisation uses SMS. Even if the risks are deemed to be low, this inventory is vital to rapidly assess the impacts of new or increased attacks against SMS.

2. Consider alternatives to SMS

There are many ways by which SMS can be compromised and full defence against such attacks is not possible. In some cases, there may be alternatives to SMS, such as the Push Notifications offered by the iOS and Android ecosystems.

3. Protect the integrity of customer phone numbers

Whilst many attacks against SMS are complex and technical in nature, it's also possible to subvert SMS-reliant tasks by targeting the underlying database.

For example, access to the database which holds customer’s genuine mobile numbers would allow an attacker to alter records, diverting SMS messages to a number under their control. Before allowing phone numbers to be
amended, there should always be a robust process of customer authentication, ensuring that only the legitimate owner of that number can change it.

We recommend that you should take steps to understand how your business uses SMS and determine whether to put in place additional controls.

Visit SecurityWise

Source: SecurityWise