Abstract:Mobile Internet is becoming the norm. With more personalized mobile devices in hand, many services choose to offer alternative, usually more convenient, approaches to authenticating and delivering the content between mobile users and service providers. One main option is to use SMS (i.e., short messaging service). Such carrier-grade text service has been widely used to assist versatile mobile services, including social networking, banking, to name a few. Though the text service can be spoofed via certain Internet text service providers which cooperated with carriers, such attacks haven well studied and defended by industry due to the efforts of research community. However, as cellular network technology advances to the latest IP-based 4G LTE, we find that these mobile services are somehow exposed to new threats raised by this change, particularly on 4G LTE Text service (via brand-new distributed Mobile-Initiated Spoofed SMS attack which is not available in legacy 2G/3G systems). The reason is that messaging service over LTE shifts from the circuit-switched (CS) design to the packet-switched (PS) paradigm as 4G LTE supports PS only. Due to this change, 4G LTE Text Service becomes open to access. However, its shields to messaging integrity and user authentication are not in place. As a consequence, such weaknesses can be exploited to launch attacks (e.g., hijack Facebook accounts) against a targeted individual, a large scale of mobile users and even service providers, from mobile devices. Current defenses for Internet-Initiated Spoofed SMS attacks cannot defend the unprecedented attack. Our study shows that 53 of 64 mobile services over 27 industries are vulnerable to at least one threat. We validate these proof-of-concept attacks in one major US carrier which supports more than 100 million users. We finally propose quick fixes and discuss security insights and lessons we have learnt.

Commercial Anti-Smishing Tools and Their Comparative Effectiveness Against Modern Threats

A Quantitative Study of SMS Phishing Detection

Smishing Dataset I: Phishing SMS Dataset from Smishtank.com

Detecting and Characterizing SMS Spearphishing Attacks.

Preliminary Results from a U.S. Demographic Analysis of SMiSh Susceptibility

On-Device Smishing Classifier Resistant to Text Evasion Attack

Phishing Techniques in Mobile Devices

Multilayer Approach to Defend Phishing Attacks

Investigating Evasive Techniques in SMS Spam Filtering: A Comparative Analysis of Machine Learning Models

Analysis of Phishing Attacks and Countermeasures

Assessing AI vs Human-Authored Spear Phishing SMS Attacks: An Empirical Study Using the TRAPD Method

An Empirical Analysis of SMS Scam Detection Systems

Mitigating Smishing: Challenges and Future Work

A Persuasion-Based Prompt Learning Approach to Improve Smishing Detection through Data Augmentation

Analyzing the risk and financial impact of phishing attacks using a knowledge based approach

Why Johnny can't rely on anti-phishing educational interventions to protect himself against contemporary phishing attacks?

New Threats to SMS-Assisted Mobile Internet Services from 4G LTE: Lessons Learnt from Distributed Mobile-Initiated Attacks towards Facebook and Other Services

Discover and Automate New Adversarial Attack Paths to Reduce Threat Risks for The Security of Organizations

Systematic Literature Review: Anti-Phishing Defences and Their Application to Before-the-click Phishing Email Detection

Phishing - A Growing Threat to E-Commerce

Personalized Security Indicators to Detect Application Phishing Attacks in Mobile Platforms