SMS "Network message" spoofing WTF

DaveK1

So me and a few mates discovered this entirely accidentally, while we were messing around down the pub last night:

epic lulz ftw!

Naturally, hilarity ensued, as people we know all over town started receiving messages telling them that their phone has crashed, please press Ctrl-Alt-Del to reboot, or has got a virus, please reinstall windows, or has been implicated in a drug deal, please hand yourself in to the police, etc., etc....

TRWTF, in this case, is in-band signalling mechanisms.

dhromed

What is a "genuine network message"?

I receive texts form Vodafone once in a while*, and they're just like normal messages, but from Vodafone. So I really don't know what a "genuine network message" is supposed to look like.

And why didn't you just take a picture of the phones, instead of scanning them?

*) Only very rarely. Things like "Special Offer XY! 5^10 SMS for just 1¢", or "Welcome to Country XYZ. Rates are A¢ and B¢". I kind of appreciate them in the light of saving phone costs.

Paddles

This is documented behaviour on at least one UK network. Based on threads like this it looks like it's specific to T-Mobile and maybe a few others, not a generally-on feature.

nexekho1

I just tried this between a Samsung D600 and a Nokia (fairly recent but a "dumbphone") on Virgin Mobile in the UK and it trimmed off the first exclamation mark. I think this might be a feature built into some phones, I've seen something about a "flash message".

So this is like the net send command from Windows 2000

@DaveK said:

The scanner could not pick them up

TRWTF -- Not taking a picture of the phones on a wooden table

Zemm

@El_Heffe said:

So this is like the net send command from Windows 2000

net send was well before 2000. I remember doing that at my high school's lab in 1994: 486s running DOS and Win 3.11 on Netware.

ubersoldat

Tried this in Spain's Orange network and no, it treats the sms as any other, no trimming, no nothing.

Did you get charged?

blakeyrat

I just want to "second" that I have no idea what a "genuine network message" is. It looks like your SMS network is capable of sending messages that are from "nobody?" ... I've never seen that in the US. Moreover, why would the network allow that?

Messages from my network always say they're from ATT, and IIRC are attached to a valid phone number as well.

@dhromed said:

And why didn't you just take a picture of the phones, instead of scanning them?

They were drunk.

First they tried to take a picture of each phone with its respective camera by trying to spin really fast.

Then, while laying on the floor, they said "Ah, screw this, let's just photoshop!"

Edit: this is even funnier when you realize those phones probably don't even have a camera.

Btw, the OP's anonymization sucks. I can still read the numbers.

dtobias

@Zemm said:

@El_Heffe said:
So this is like the net send command from Windows 2000

net send was well before 2000. I remember doing that at my high school's lab in 1994: 486s running DOS and Win 3.11 on Netware.

Heck, I was doing something similar with the printing Teletype-style terminals at my high school's lab in 1980, connected via 110/300-baud acoustic couplers to a mainframe at the state university. I think I may have first found out John Lennon was shot that way.

nexekho1

I remember a scary time (well it is now I'm old enough to know what was going on ;]) when a lack of firewalling and general common sense meant you could be sent a messagebox from any machine in the world :p

blakeyrat

@nexekho said:

I remember a scary time (well it is now I'm old enough to know what was going on ;]) when a lack of firewalling and general common sense meant you could be sent a messagebox from any machine in the world :p

Net Send was Novell's invention and it was only in Windows as part of the Novell compatibility. The only reason Microsoft got shit and not Novell is, per usual, Microsoft actually sold more than a couple dozen copies of their OS.

Renan

I remember a time when you could bluejack phones, so you could get funny messages appearing on them like "the devil has your soul now" (priceless when done inside a church).

As for making a message look like a network one, I think it's about making it look like it came from the carrier/service provider, which means that the OP could have sent messages which will appear with his name on them for people who have their lines provided by another carrier.

MiffTheFox

So I learned three things today:

1: This might not work in the US
2: This might not work with Android
3: It's possible to send a text message to yourself.

So I guess I learned one definite thing and two possibilities.

EDIT: By the way, T-Mobile messages in the US are just regular text messages from a number like "#40" or something.

ender

I remember back when I got my first cell phone (Nokia 3210), I had some program on my computer which connected to the phone through serial connection that could send "service messages" - SMSes, which the receiving phone wouldn't store, but would display on screen, and which would vanish when you dismissed them (I've only seen service messages used when checking status and adding credit to prepaid phones).

@nexekho said:

I think this might be a feature built into some phones, I've seen something about a "flash message".

@ender said:

I remember back when I got my first cell phone (Nokia 3210), I had some program on my computer which connected to the phone through serial connection that could send "service messages" - SMSes, which the receiving phone wouldn't store, but would display on screen, and which would vanish when you dismissed them (I've only seen service messages used when checking status and adding credit to prepaid phones).

My Nokia 6103 has this as a built-in feature. It's indeed called a "flash message" and it behaves like [b]ender[/b] describes. Dunno if it's the same as what the OP has discovered, though.

cdietrich

So I learned three things today:

"Last night at the pub" ends just after 1:03 PM
A test on a single UK cell network constitutes a test on all UK cell networks
A genuine network message begins with "Message:"

Oh, what fun we had when some of us discovered that the mainframe at our university, to which all the public access terminals were connected, that were provided for students to read their mails (there was not much more than that do to yet with the internet back in the day, except maybe irc and newsgroups) had the /dev/tty world-writable...

So all it took for making mysterious messages appear on another student's terminal was figuring out his tty number...

Douglasac

They probably are flash messages. All the messages I've gotten from Telstra have either shown up with the sender as Telstra for things relating to my account*, 101 for voicemail messages, and some other number for data usage alerts, etc.

Exhibit A:

The last one was them apologising for saying that I'd used 80% of my 2.1TB of monthly data. I wish I had that much data to use per month.

* Even though they're not in my Contacts they come up as Telstra. My union comes up as sdaunion as well: same thing, not in my contacts, obviously something set somewhere that makes it do that.

derula

Doesn't work for me either. And I'm sure that my cell phone can display on-screen messages; for example, if I typed *100# I used to get an on-screen message for how my prepaid card's balance is. Lately I'll only get it as a regular short message though.

DaveK1

@dhromed said:

What is a "genuine network message"?

It's a priority message that comes from your network provider, and that pops up straight on your main menu, rather than appearing in your standard SMS inbox; it also automatically deletes itself after you read it, and on at least some smartphones doesn't show you the envelope headers, making it impossible to see that it's come from a number you already know.

@dhromed said:

And why didn't you just take a picture of the phones, instead of scanning them?

I tried the scanner first because it has a load more resolution than my crappy webcam, and I hoped it might be able to shine through the LCD and reflect off the back, but no luck. Then I used the crappy webcam for close-ups of the screens and pasted them on top because if I used it to frame the whole phone, there would have been too little detail in the area of the display.

DaveK1

@cdietrich said:

So I learned three things today:

Good going! Tomorrow, I suggest you learn about false inferences...

@cdietrich said:

1. "Last night at the pub" ends just after 1:03 PM

What, you think I take a USB scanner to the pub with me? Mind you, I am flattered by your implication that I have sufficient psychic powers to realise that something unexpected was going to happen before it happened and to therefore think to take a snap of the message before sending it...

@cdietrich said:

2. A test on a single UK cell network constitutes a test on all UK cell networks

You need to get your eyes checked. You appear to have hallucinated that the word "all" appears in that image.

@cdietrich said:

3. A genuine network message begins with "Message:"

On that particular network and model of phone, yes. But don't falsely extrapolate beyond that. On a couple of Android smartphones that we tested, it just pops up as a dialog on the 'desktop', with no trace of sender or any other information about what it is or where it came from.

dhromed

@DaveK said:

It's a priority message that comes from your network provider, and that pops up straight on your main menu, rather than appearing in your standard SMS inbox; it also automatically deletes itself after you read it, and on at least some smartphones doesn't show you the envelope headers, making it impossible to see that it's come from a number you already know.

Oh, perhaps just like the prepaid status message when I dial the special #* number. That appears as text distinct from a normal SMS, like an alert() box.

DaveK1

@dhromed said:

@DaveK said:
It's a priority message that comes from your network provider, and that pops up straight on your main menu, rather than appearing in your standard SMS inbox; it also automatically deletes itself after you read it, and on at least some smartphones doesn't show you the envelope headers, making it impossible to see that it's come from a number you already know.

Oh, perhaps just like the prepaid status message when I dial the special #* number. That appears as text distinct from a normal SMS, like an alert() box.

Yeh, that's the one.

SMS &quot;Network message&quot; spoofing WTF

SMS "Network message" spoofing WTF