Does SMS spoofing require as much effort as email spoofing?

SMS text message spoofing demands a little more technical knowledge than email spoofing. But not much, says information security threat expert Ed Skoudis. In this Q&A, Skoudis explains how that technical know-how has now been embedded in easy-to-use, Web-based software.

Ed Skoudis, Counter Hack

Why is it easier to fake the sender of an email message than to fake the sender of a message that uses the SMS protocol?

Spoofing an email message sender is trivial. The Simple Mail Transfer Protocol (SMTP) does not include verification of source email addresses. Thus, an attacker can simply telnet to a mail server's TCP port 25 and type in a message using any source address that he or she wants. Most mail servers will dutifully deliver the mail.

Some mail servers do a check with forward and reverse DNS lookups, verifying that the source email address appears...

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please log in.

You have exceeded the maximum character limit.

Please provide a Corporate Email Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

to be coming from a mail server in that environment. If a message from [email protected] doesn't have a DNS record, and forward and reverse lookups can't match bogussourcename.com with a proper IP address, then the message might be spoofed. Unfortunately, such checks are often inaccurate, and that's why a lot of servers don't perform them.

Short Message Service (SMS) spoofing is more complex, but far from impossible. The various SMS message providers -- typically cell phone service providers -- have integrated their SMS messaging with the Internet, allowing users to send messages by surfing to a Web site and simply typing one in (the user is also allowed to enter a source email address and phone number). Some SMS providers check these numbers to make sure they are accurate, but others do not.

Also, there are flaws in these SMS message-sending Web applications that can easily be exploited to bypass any attempt at verification. In fact, there are both free and commercial software applications available that will generate enormous numbers of spoofed SMS messages. So, SMS spoofing requires a little more technical savvy, but even that technical know-how has been embedded in easy-to-use, Web-based software.

More information:

It's not just SMS text messaging spam that's heading to your mobile devices. See what other mobile malware is on the way.

Learn how to defend mobile devices from viruses and spyware.

This was last published in July 2007

Prevent email spoofing from wreaking havoc on contact lists

Google Android smartphones hijacked by spam botnet

Can an IP spoofing tool be used to spam SPF servers?

Black Hat researchers unveil killer mobile phone hack via. spoofed MMS messages

Dig Deeper on Malware, virus, Trojan and spyware protection and removal

Prevent email spoofing from wreaking havoc on contact lists

Google Android smartphones hijacked by spam botnet

Can an IP spoofing tool be used to spam SPF servers?

Black Hat researchers unveil killer mobile phone hack via. spoofed MMS messages

Related Q&A from Ed Skoudis

How to combat the top 5 enterprise social media risks in business

Can a hacker actually post malicious scripts to any server using a drop-down list?

What tools can a hacker use to crack a laptop password?