SPOOF & SPAM BY OO GIN LEE

New Paper, Oo Gin Lee, 8 July 2005

Spoof & Spam

So far, your handphone has been spared from spam. That's because it costs money for the spammers to send you SMSes about Viagra or hair-loss solutions. But the bad news is these messages are coming. Spammers are now combining spam SMS with spoofing to make the phone networks think that the SMS was sent by a third party.
It works the way Internet worms wreak havoc on your PC address book. They infect your computer, start searching through your PC's address book and propagate themselves by mass-mailing to your contact list. To add flavour, they even make it look like they were sent, not by you, but by another contact in your huge address book.

Spoofing

On the phone network, spoofing is now on the rise. While they don't make use of mass-mailing worms to infect your phone, what spammers are doing now is to mask themselves and make the SMS look like it was sent by genuine users.
Not only does this fool the end-user, it also spoofs the phone networks. And that means that the spammers can get away with not paying for the SMS spams, as the vulnerable phone networks will see the SMS as sent by an innocent third party instead of the spammer.

Mr. Vince Kadar, CTO of airwide solutions, an international mobile infrastructure software provider, said that such SMS spam and spoofing combos are still in their infancy but has risen recently to noticeable proportions.
He said: 'Today, about 15 per cent of traffic on the SMS network in the world is spoofed. And we are only at the beginning of this trend. He said that while it is not as easy to masquerade as another on SMS as compared to the PC, the spammers have found a way, and they are exploiting the network vulnerability to spam without paying.

Mr Kadar added that this new trend started just a few months ago, but some telcos are already installing security solutions in their phone networks to prevent such fraud. airwide's own anti-spoofing solution has been deployed in more than 30 telcos' networks worldwide.
When its security solution is installed, the phone networks automatically verify the authenticity of the identity of the SMS sender.

There is little news about such SMS spoofing in Singapore right now, but that's possibly because nobody even knows enough about it. What is even more worrying is that the innocent end-user that is spoofed may end up paying for SMS traffic that he never sent. And he may never know, since most users have bundled SMS traffic and don't get to see a detailed bill at the end of the month.

Ignorance is bliss, they say, but in this case, it can really be costly.