Document
Document
[edit] AT commands
Many mobile and satellite transceiver units support the sending and receiving of SMS using an
extended version of the Hayes command set, a specific command language originally developed
for the Hayes Smartmodem 300-baud modem in 1977.[citation needed]
The connection between the terminal equipment and the transceiver can be realized with a serial
cable (e.g. USB), a Bluetooth link, an infrared link, etc. Common AT commands include
AT+CMGS (send message), AT+CMSS (send message from storage), AT+CMGL (list
messages) and AT+CMGR (read message).[34]
However, not all modern devices support receiving of messages if the message storage (for
instance the device's internal memory) is not accessible using AT commands.
[edit] Vulnerabilities
The Global Service for Mobile communications (GSM), with the greatest worldwide number of
users, succumbs to several security vulnerabilities. In the GSM, only the airway traffic between
the Mobile Station (MS) and the Base Transceiver Station (BTS) is optionally encrypted with a
weak and broken stream cipher (A5/1 or A5/2). The authentication is unilateral and also
vulnerable. There are also many other security vulnerabilities and shortcomings.[36] Such
vulnerabilities are inherent to SMS as one of the superior and well-tried services with a global
availability in the GSM networks. SMS messaging has some extra security vulnerabilities due to
its store-and-forward feature, and the problem of fake SMS that can be conducted via the
Internet. When a user is roaming, SMS content passes through different networks, perhaps
including the Internet, and is exposed to various vulnerabilities and attacks. Another concern
arises when an adversary gets access to a phone and reads the previous unprotected messages.
[37]
In October 2005, researchers from Pennsylvania State University published an analysis of
vulnerabilities in SMS-capable cellular networks.[38] The researchers speculated that attackers
might exploit the open functionality of these networks to disrupt them or cause them to fail,
possibly on a nationwide scale.
[edit] SMS spoofing
Main article: SMS spoofing
The GSM industry has identified a number of potential fraud attacks on mobile operators that
can be delivered via abuse of SMS messaging services. The most serious of threats is SMS
Spoofing. SMS Spoofing occurs when a fraudster manipulates address information in order to
impersonate a user that has roamed onto a foreign network and is submitting messages to the
home network. Frequently, these messages are addressed to destinations outside the home
network – with the home SMSC essentially being “hijacked” to send messages into other
networks.
The only sure way of detecting and blocking spoofed messages is to screen incoming mobile-
originated messages to verify that the sender is a valid subscriber and that the message is coming
from a valid and correct location. This can be implemented by adding an intelligent routing
function to the network that can query originating subscriber details from the HLR before the
message is submitted for delivery. This kind of intelligent routing function is beyond the
capabilities of legacy messaging infrastructure.[39]
[edit] Emergency Services
In some countries SMS messages can be used to contact the emergency services. In the United
Kingdom, SMS text messages can be used to contact the local emergency services provider after
registering with the emergency SMS service. This service is primarily aimed at people who by
reason of disability are unable to make a voice call but has recently been promoted as a means
for walkers and climbers to call[40][41] emergency services from areas where a voice call is not
possible due to low signal strength. Such service is also available in Hong Kong.[42]