After e-mails and websites, your mobile phone’s SMS is the latest hot target of hackers. And the government seems to be concerned. The department of telecom (DOT) is planning to block all SMSes originating from overseas which don’t carry a +91 number.

It has also blocked sites which allowed such misuse. Currently, SMS hacking tools are freely available on sites like altalavista.digital.net and phreaking.com. These tools allow hackers to create an SMS and send it using any anonymous name in the header (sender’s name).

Here’s how it operates. You may get an SMS from the local bank’s original ID asking the person to call back and ‘confirm’ important details on a transaction. On calling back, you are put on an automated dialler which asks to confirm account details. Once you give out the details, you’re trapped.

“There are tools available on the internet through which you can change just the header of your SMS and it’s a major cause for concern,” regional head of network security firm RSA Security, Srikiran Raghavan, told ET.

COO, Hungama Mobile Saleem Mobhani adds, “SMSes can easily be spoofed by masking an IT address and getting access to a SMS gateway.” One can easily change header or content of an SMS by using SMS hacking tools. Thus, a user may get an SMS from his ‘boss’ asking for an important detail or figure.

The SMS, which may seem innocuous, could be spoofed by a hacker. And on replying, the answer may reach another number, most often overseas. Sensing the threat, the government has set up a committee to check such misuse of technology. The committee has submitted a report recently, which has been approved by DoT.

The committee recommends blocking of level +91; that is, SMSes received from overseas which don’t have party address starting with +91. It has also recommended strict access control to SMSCs (Short Message Service Centres) of mobile operators if provided over the internet.

“Currently SMSs are routed through application servers, SMS gateways, SMSCs and MSCs (Mobile Switching Centres). If the transfer protocol between SMS gateways and SMSCs is http based, it can be prone to misuse because it’s an open protocol,” says Milind Pathak of Buongiorno, a mobile VAS player.

The DoT has also blocked many sites which were allowing such misuse. “Using somebody else’s identity such as a phone number while communicating, amounts to forgery, which is a criminal offence and the person is liable for penal action,” the DoT maintains. Perhaps the best course of action to get around a suspicious SMS is to delete it, especially if you are not sure of its origin.

This entry was posted on Wednesday, August 22nd, 2007 at 3:53 am and is filed under Blogging, News. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.