Can We Stop Pretending SMS Is Secure Now?
Summary: Security researcher Lucky225 worked with Vice's Joseph Cox to intercept Cox's incoming text messages with his permission, using a $16 account at SMS marketing firm Sakari where users sign a letter of authorization for a number they do not own. Lucky225 said the method exploits authentication weaknesses in NetNumber's proprietary six-digit ALT SPID system, which VoIP wholesalers and SMS enablement providers use, and that he publicly disclosed the issue in 2018 with nothing done since to stop it.
What's compelling: Unit221B's Allison Nixon, who watched her own incoming texts appear on Lucky225's burner phone, said the only thing standing between anyone and the equivalent of a SIM swap is a forged letter of authorization, while the CTIA says no carrier has been able to replicate the attack and no customers were affected.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026