Protect your devices from SMS blasters (ITSAP.00.104)

How SMS blasters work

SMS blasters can impersonate cellular towers to take advantage of inherent or unpatched vulnerabilities found in older second generation (2G) network standards that are still supported by modern devices. 2G network standards do not enforce authentication or encryption between the mobile device and the network.

SMS blasters can broadcast higher power network signals to trick nearby devices into connecting by broadcasting a stronger signal than the current connection. After the connection has been established, the SMS blaster will attempt to downgrade the device to 2G mode. This allows threat actors to send an SMS and bypass the protections and filters implemented by mobile network operators (MNOs) to protect their customers.

Threats posed by SMS blasters

SMS blasters pose many threats to devices within range of a compromised device. These threats include:

Smishing and fraud

Smishing is a scam in which threat actors send fraudulent messages that look legitimate to trick victims into clicking links and attachments or sharing sensitive information. SMS blasters allow threat actors to quickly send thousands of smishing messages to mobile devices within the coverage area of the device. The messages can be generic or tailored for a specific scenario, such as sporting events or conferences, or can be a notification to validate an action or your identity, such as bank authentication PINs.

Threat actors can also use this opportunity to send messages using spoofed short codes commonly used by organizations to send users notifications. This can make their malicious messages even more difficult to detect as fraudulent, since they appear to come from a common number you have received alerts from before.

Smishing scams can lead to fraud with compromised credentials, unauthorized transactions and identity theft. For more details on smishing, see the Cyber Centre’s Smishing: Protect yourself from SMS attacks (ITSAP.00.103).

Misinformation, disinformation and malinformation

By using blasters to conduct smishing and fraud, threat actors can spread misinformation, disinformation and malinformation (MDM). The threat can target all devices within the coverage area of the SMS blaster and spread MDM concerning a specific source or event. Spreading MDM in this context is a serious concern. It can cause harm by manipulating individuals and organizations into thinking there is a conflict or urgency.

Service disruption

SMS blasters can cause dropped calls, slow data speeds and strain mobile infrastructure by downgrading connected devices to the 2G network. This can affect emergency calls and connection to Internet of Things (IoT) devices.

Privacy and data loss

SMS blasters can collect sensitive data that includes identifiable information, such as:

• unique subscriber identification (international mobile subscriber identity (IMSI))
• unique device identification (international mobile equipment identity (IMEI))
• user locations

Threat actors can further use this information as entry points for more advanced cyber campaigns.

How to protect against SMS blasters

MNOs, device manufacturers and end users should consider the following mitigation strategies to protect mobile devices from SMS blasters.

Mitigation strategies for mobile network operators

• Detect and respond quickly:
  • Use tools that can spot fake cellular towers and monitor network logs for unusual activities, such as unknown neighbour cell towers, sudden handover failures and rapid disconnections and reconnections
  • Implement security tools to monitor the signaling layer to identify sudden spikes in signaling volume or abnormal registration patterns that indicate a rogue base station is active
  • Use analytics with spam reporting to catch abnormal SMS patterns or suspicious device identification
• Block insecure connections: Configure your network to prevent devices from being redirected to older insecure 2G connections
• Share intelligence: Feed real-time network data into fraud management systems, update blocklists or malicious Uniform Resource Locators (URLs) and share threat information with other operators and government authorities
• Coordinate across the industry: Collaborate with device makers and regulators to improve privacy features and strengthen defence mechanisms

Mitigation strategies for device manufacturers

• Offer users more security control:
  • Provide options for users to disable 2G network connections
  • Enforce the use of encryption with the mobile network
• Improve security features:
  • Offer clearly defined options for how users can select and restrict network connections
  • Alert users when messages come from unauthenticated connections
  • Disable 2G network usage by default

Mitigation strategies for end users

• Use phishing-resistant multi-factor authentication (MFA): Use passkeys or hardware security keys rather than SMS-based codes and one-time passwords
• Stop, verify and report:
  • Stop: Do not click on links or attachments in unsolicited SMS and do not respond to suspicious or unexpected messages
  • Verify: Contact the organization or individual directly through their official channels, such as the contact information listed on their official website
  • Report:
    • Forward the suspicious message to 7-7-2-6 (“SPAM”) or use the messaging application’s spam reporting function
    • Report the incident to the Royal Canadian Mounted Police via the Report cybercrime and fraud portal. This will notify the appropriate organizations to initiate an investigation and take appropriate actions
• Disable 2G:
  • Turn off 2G network connections in your phone’s settings, if the option is available
  • Contact your mobile provider if you don’t have the option to disable specific network connections
• Use end-to-end encryption applications: Protect the contents within messaging and data transfer communications with applications that support end-to-end encryption
• Be skeptical: Remember that legitimate organizations never ask for personal information, passwords or banking information through text messages
• Install applications safely:
  • Only download applications from official app stores or from developers with a verified reputation
  • Use an anti-virus software to scan newly downloaded and existing apps on your device for malware

As SMS-based authentication and notifications continue to be the default for many applications, threat actors will continue to exploit their vulnerable nature. To address these challenges, collaboration among the telecommunications industry is essential for raising awareness and implementing robust security measures.

Learn more

• Using your mobile device securely (ITSAP.00.001)
• Don't take the bait: Recognize and avoid phishing attacks - ITSAP.00.101
• How to identify misinformation, disinformation, and malinformation (ITSAP.00.300)
• Steps for effectively deploying multi-factor authentication (MFA) - ITSAP.00.105)
• Reporting spam text messages to 7726