Text/SMS messaging totally insecure

A LITTLE BIRD working for one of the major British GSM operators has revealed to us just how insecure the whole text/SMS messaging service really is.

In order to offer SMS (Short Message Service) - otherwise known as texting - operators install an SMSC (Short Message Service Centre). Many of these SMSCs come from software specialists such as LogicaCMG or Schlumberger SEMA.

In essence, an SMSC is like a giant store-and-forward email server.

Our canary maintains that the typical time a text message stays stored on the SMSC is around 15 days. Worryingly our bird says that text messages can actually be viewed by ANY customer services advisor. " There's no password or permissions or anything," the canary adds.

"Many advisors amuse themselves on slow days by picking numbers at random and reading the messages, and then following the trail to the sender and jumping from person to person like this. It's also possible to spoof text messages through the [SMSC], and make them look like they've come from anywhere or anyone, just like with email."

More to the point if a member of the public does want to take some sort of action regarding a nuisance SMS, the operator does genuinely possess the ability to interrogate the SMSC and discover all the requisite information.

Most operators won't actually admit this to the public, as it could easily generate masses of customer complaints which would be unprofitable to pursue. The good news, however, is that if you ask the customer services department of your mobile phone company very nicely indeed, they will reveal the number for a nuisance calls bureau which can investigate SMS complaints too. So now you know. µ