The Mobile Marketing Blog - TellMyCell

How to Hack a Corvette with SMS

 

New research has shown that it’s entirely possible to hack a Corvette...with an SMS message. Four security researchers from the University of California San Diego recently presented a paper at the USENIX WOOT 2015 conference in Washington showing how they hacked a Corvette using mobile Telematic Control Units (TCUs). The units are more frequently referred to as tracking/insurance dongles. Researchers showed how these dongles, which are used by Uber and car insurance companies such as Metromile, are easily reversible and controllable via SMS.  

Such devices are connected to vehicles through the ODB-II port. This gives a person access to the vehicle’s CAN bus, which allows interaction with assorted features, such as brakes and windshield wipers. 

“We acquired some of these things, reverse engineered them, and along the way found that they had a whole bunch of security deficiencies,” said Stefan Savage, the computer security professor and project leader at University of California at San Diego. He noted that dongles “provide multiple ways to remotely…control just about anything on the vehicle they were connected to.”

 

What the Research Says 

Researchers discovered different methods of obtaining TCU details from online sources, such as the dongle’s correlating phone number and IP address. Once the Corvette’s number was found, researchers used special SMS messages to connect to the CAN bus. They then used the vehicle’s firmware vulnerabilities to control both the brakes and windshield wipers. And while these were the only two features tested, researchers could have easily accessed a slew of others, including door locks, transmission, dashboard data, etc.  

Unfortunately, TCUs are capable of receiving SMS messages while vehicles are in operation, resulting in serious risks to both drivers and passengers. The University of California security researchers subsequently recommended a number of actions, including improved key and password management, SMS authentication, and the disabling of WAN administration. 

"Metromile was concrete in its plans to disable all SMS access on its branded devices, consistent with our recommendation," said the researchers. 

The Corvette isn’t the only vehicle to be hacked successfully. Last month, researchers demonstrated how easily they could hack Jeeps featuring uConnect software. This means a staggering 471,000 US Jeeps are in danger of being controlled through IP addresses. Following the Jeep revelation, security researcher Samy Kamkar announced how a $100 gadget could be manipulated to control GM vehicle functions. 

Technological advancements may have helped vehicles and their drivers in regards to safety, however as with any advancement the opportunity to exploit vulnerabilities is present. The World Wide Web Consortium (W3C) has created a group to analyze the “security and privacy of Web-related technology” utilized by the automotive industry.

 

China Clarifies SMS Marketing Rules

 

New regulations governing how SMS marketing can and can’t be conducted will take effect in China next week. 

The move - which reinforces several pre-existing laws surrounding commercial communications - was announced last month by the Ministry of Industry and Information Technology (MIIT). These laws require companies engaging in SMS marketing to:

 

1. Comply with express requests from consumers not to send communications
2. Disclose the identity of the advertiser in electronic advertising
3. Provide a way for consumers to refuse future electronic advertising

 

Banded together, these measures have been dubbed ‘the Administrative Rules for Short Message Service’; they will take effect on June 30. 

The rules define SMS messages as ‘communications used for introducing or promoting goods, services, or business investment opportunities.’ They state that, in the event of consent to receive commercial text messages being given, the company must specify what kind of information will be sent and how often it will be sent, and provide a time limit on the duration of future contact. In an interesting diversion from most international legislation, a ‘no reply’ to this follow up message must be considered the same as an explicit rejection. 

Further, SMS service providers are compelled by law to keep records of commercial text messages, including time sent, time received, codes for the sending and receiving terminals, and information regarding subscriptions and un-subscriptions for at least five months (even if the service relationship is terminated).

Failure to comply with the requirements could result in a fine ranging from RMB 5,000 to RMB 30,000 (between $800 and $4800 USD). 

China’s new rules are thought to be a government response to the public outcry regarding SMS spam - a major problem in the world’s fastest growing economy.

 

How One Bank is Tightening Security with Mobile

 

In an effort to combat growing security risks throughout banks and other sensitive institutions, one bank in Greensboro, N.C. turned to an out-of-brand authentication method, which verifies users though a channel other than a user’s regular log in.  

The $711 million-asset Carolina Bank began looking for better IT security when growth led to an increase in remote workers who required external access. The company’s Citrix and Outlook Web Access systems were particularly venerable; the CEO and IT department feared more security would make the log in process too cumbersome for most employees. 

However, the bank was able to solve this problem by utilizing an SMS based authentication technology, which works directly with a user’s cell phone to deliver a unique and time sensitive password to log in. 

The large data breach reported by JPMorgan Chase & Co. last summer is a good example of where this preemptive technology comes from. Eighty-three million customer records were compromised when a hacker was able to gain access through a computer being used by an employee working from their home office. 

Carolina Bank’s CEO Bob Braswell said this was not the only reason the bank needed to beef up its security. 

“We don’t know enough to know what our biggest worry is,” he said. “There’s a 15-year-old kid in Iowa somewhere who’s trying to hack into us. That’s our biggest worry.” 

The improved authentication process uses a text-message passcode sent directly to a user’s phone. The passcode is good for two minutes; otherwise the user has to begin again. This protection limits an intruder’s ability to save or pass off the information to someone else. 

There are other security feature including geofencing and adaptive authentication. People outside of the Carolina Bank’s market, those who would have little reason to gain access, can be denied or strictly monitored. The adaptive technology is able to maintain further levels of security by tracking logins from multiple devices. 

One distinct shortcoming is users will ultimately need their phone on hand to log in. Additionally, each company has to ensure that employee numbers are the only numbers being granted access to the authentication software. Should an ill-intentioned foreigner gain access this way, the technology would grant the foreigner’s mobile device the same privileges as a genuine employee. 

Despite these drawbacks, the Carolina Bank reports no problems thus far. It has been well received according to Braswell.

Australia Caps SMS and Call Fees Between Telcos

 

The Australian Competition and Consumer Commission has put a cap on fees telecommunications companies charge each other when handling calls and text messages from other networks. The consumer watchdog cut the telco fee by more than 50%, and capped the fee they can charge for receiving cross-network SMS messages. This decision comes on the heels of the 2013-14 inquiry into “mobile termination” prices.

Australia’s three major networks, Telstra, Optus and Vodafone, charge each other for connecting calls and text messages, such as a call from an Optus customer to a Vodafone customer. 

The ACCC proposed in its draft decision that the fee charged between operators for calls drop from 3.6 cents per minute to 1.61 cents per minute. They also proposed the price to receive a text be set 0.03 cents.

“The proposed rate reflects the cost of terminating calls on Australian networks and is based on benchmarking the costs of this service overseas,” said Commissioner Christine Cifuentes. “We would expect that the savings will be passed onto consumers either in the way of lower charges or through improved call and SMS inclusions in retail plans.”

A 2014 inquiry found major networks spent about 1 cent to send 100 text messages. Yet the consumer group Australian Communications Consumer Action Network (Accan) reported some telcos were charging customers about 15 cents per text. 

“This level of profit margin is astronomical,” Accan’s deputy chief executive, Narelle Clark, said at the time. 

High-cost SMS deals affect older and poor Australians the most, as many of these consumers don’t own smartphones and are therefore unable to enjoy relatively inexpensive data messaging services such as Viber and Whatsapp. This means older and poor consumers are left dealing with outlandish calling and texting prices.

“The proposed changes will have a positive effect on competition in the telco market which will also benefit consumers,” the team at Accan noted. 

The ACCC is expected to reach a final decision by July, and put the new cost into effect on January 1st, 2016.  

Not everyone is jumping on the bandwagon, however. A Telstra spokesperson said that while the company was “reviewing today’s decision and will be providing a response as part of the ACCC’s process,” the decision to regulate text message termination prices would “add unnecessary costs and complexity to our business.” 

“Mobile prices are continuing to trend down and the majority of mobile service plans now include unlimited SMS,” he said, noting “limited benefits” for customers. “Also consumers already have choice when it comes to messaging, with the emergence of smartphones, message applications and social media.”  

This range of choices combined with unlimited SMS plans is not cause for regulation, the spokesperson added. Telstra is Australia’s largest provider of fixed line services. 

Vodafone said regulations had to make certain Telstra put the money it saves into consumer wallets.

“Telstra has the highest fixed prices in the OECD. The standard price Telstra charges its customers to call from a fixed phone to a mobile has barely moved for a decade,” said Matthew Lobb, Vodafone’s general manager for public policy. 

Apple Edges Out Samsung in Canadian Smartphone Market

 

The 2015 reports are in, and according to the international authority of leading internet technology company comScore, Canadians prefer Apple smartphones over competitors like Samsung and Blackberry. In comScore’s annual report, titled Canada Digital Future in Focus, the company outlines several metrics explaining how Canadian users navigate the digital world, and to what end. 

Like the rest of North America, Canadian users prefer smartphones to the feature phone predecessor. Eighty-one percent reported owning a smartphone; within that segment, Apple leads in market share at about 38%. Samsung follows in close second at 32.4%. What’s more, Canada’s own creation — the Blackberry — ranks third with less than 9%. 

In another mobile segment—the feature phone—Samsung leads the way with 36.8% market share; LG ranks second with a respectable 25%.  

As for the mobile operating systems, Android enjoys an incredible 50.5% market share; Apple’s iOS follows at about 38%.  

Among other findings, Canadians were shown to prefer mobile devices to desktops for nearly all online activities including: browsing the web, watching videos and playing games. Paralleling this data, tablet usage was shown to have increased as well.

comScore also reported on the activities of users and sited a few notable trends. From December 2013 to December 2014, social media interaction increased by 19% as a result of more smartphones and users increased daily usage of social networks. comScore reports 53% of Canadian users access social networking sites through their smartphones; 48% play games; almost 80% access and share photos; and 52% listen to streaming radio. 

Two notable trends of the report point to a large increase in app usage relating to retail and banking services. Canadians are also shown to use their smartphone or tablet while watching TV. comScore reports that 32.2% of Canadian smartphone users use their phone while watching television; 35% of Canadian tablet users do so while watching television.  

In December of last year, smartphone users equaled nearly 20 million users, a 19% jump from the year prior. But that’s nothing compared to the 56% increases in tablet subscribers, which is now estimated at just under 10 million users. From this critical information, insights and actions will be taken to maximize the digital investments of thousands of companies. But without digging too deep into the data, it’s plain to see that Canada is steadily increasing both its base of smartphone and tablet users. Further, both mobile devices are increasing the mobile access Canadians have to apps and social media.

If nothing else, the report shows clear indications that Canada users are wising up to the speed, ease and portability of mobile devices. 

 

AT&T’s Text Message Alerts are Too Easy to Mimic

 

AT&T Text Messages are a simple way for AT&T to communicate with its customers. The texts, however, are much too simple and easily duplicated, which presents a big problem for AT&T customers.  

Due to the simple technology of text messages, there is no way to authenticate the identity of the sender. Also, the body of these text messages contains only a brief message that can be mimicked by hackers and scammers. Consumers could be receiving bogus text messages that have links leading to dummy websites, which then steal the customers’ information. 

Essentially, it’s a classic phishing scheme akin to the ones we’ve seen in our email inboxes.

Computer programmer Dani Grant discovered the breach of security when she received a text message from AT&T. “If the official texts look like phishing, it’s impossible for the customer to distinguish between what’s phishing and what’s not,” she said in a recent interview with CNN Money.

Because AT&T’s text messages originate from a “short code” rather than a verifiable phone number, customers have no way of knowing exactly who is trying to alert them. Short codes are four or five digit numbers that can send and receive texts, and can be acquired by anyone – not just cell phone companies.

Furthermore, the links within these text messages are not always obvious links to AT&T’s official site. While AT&T will sometimes use the link “att.com” – clearly a link to their official website – sometimes they will use the URL “dl.mymobilelocate.com.” This creates confusion for the consumer: how is a customer to know if a strange URL will lead back to AT&T’s website, or some dummy site that a hacker created?

Dani Grant went ahead and created her own false website, as well as a fake text message to see if these official AT&T texts could be duplicated. As it turns out, her text message is identical to AT&T’s official alert. Grant then reported this error to AT&T as a security flaw, though they have declined to comment on the matter.

There is no easy solution to this problem. Cell phone companies prefer to use SMS for their alerts because it is inexpensive and has a broad scope in terms of reaching their customers. Clearly, this method of texting is open to security threats, though, so consumers should insist on greater security measures to be taken by their mobile carriers.

Remember, don’t be fooled by all “official” text messages from your service provider, because these messages could be coming from a clandestine source. Carefully monitor messages, and delete when it seems “phishy.” By practicing prudence when interacting over SMS, you can protect yourself from scammers.    

 

Single App Voice & Text Messaging Just Got a Bit Better

 

The Consumer Electronics Show took place in Las Vegas earlier this month. Scores of innovations, from smart homes to smart phones, were unveiled by designers from around the world. 

Text messaging took center stage. Six15 demonstrated their SMS glasses, which transmit text messages from your mobile device straight to the lens, without the need for using hands.  

But perhaps the most exciting new text message-related product was a new dual-purpose messaging app for both Android and iOS devices. UbiSpeak was developed by Unified Computer Intelligence Corporation (UCIC), the people behind The Ubi, a voice-controlled computer.

Using voice recognition software, it generates both a voice message and a text message. If the recipient also has the app, they’ll get both versions of the message; if they don’t have the app, they’ll get the SMS along with a link to the audio version. 

UbiSpeak isn’t the first of its kind - both Android and Apple have their own versions of something similar - but it is faster and more reliable. The makers say two mediums transmitting the same content gives users ‘a lot more confidence when… sending a quick message.’ 

Like a number of messaging apps, it automatically populates your contact list with the people who you text most often. Other features include a VIP contact option, which will automatically play messages from people you designate - even if the phone is locked.

The app marks a new chapter for UCIC. The Toronto-based startup made their name with The Ubi, a WiFi connected, voice operated computer that uses Android to process spoken commands. You can operate your lighting, for instance, so you can always get that basement light to go on when you’ve got your arms full. Their technology is pretty smart - and it gets better at understanding you over time. 

UbiSpeak (and it’s forbear) is far from perfect, because speech recognition technology is proving one of the hardest nuts to crack. Progress is slow, and it may be decades before truly accurate voice recognition hardware is available. But that’s why it’s even more important that pioneers like UCIC keep pushing boundaries. The more consumers use voice recognition apps and home computers, the more data we can draw on to find out how people use them. In the long run, that will expedite the slow progression towards flawless, 100% accurate voice recognition technology.

 

Text Messaging Glasses Unveiled at CES

 

The annual Consumer Electronics Show (CES) always throws up some exciting new innovations. One of the most talked about gadgets at this year’s event was a pair of glasses that displays incoming text messages without the recipient having to even look at their phone, let alone touch it. 

Unveiled to the public for the first time at CES in Las Vegas earlier this month, Six15’s concept is simple: a Bluetooth connection links a mobile device to the glasses, tracking the head and eye movements to navigate incoming or stored text messages, which are displayed on the lens. 

One battery cycle holds out for 1500 text messages, but Six15 promise future versions with greater capacity and extra features like thermal imaging. The final consumer product is not expected to market anytime soon, but judging by the reaction at CES, hopes are high.

The technology is pretty clever. A built-in head tracker allows augmented reality apps to communicate with the glasses, and patented ODIN see-through optics puts the lenses at around 6mm in thickness (around half that of the much-maligned Google Glass), capable of delivering a wider field of view and bona fide transparency. 

Iterations of the glasses could come with optional thermal and visible cameras for other business applications, and Six15 have announced their intention to devise features specifically for individual applications.

Most importantly in marketability terms, the device represents the first see-through display that’s compatible with existing operating systems. By doing away with an additional OS built into the glasses, a major stumbling block to a viable consumer product has been eliminated. 

The uses are obvious. Any situation that calls for a person to retrieve data whilst maintaining awareness of their environment - such as walking down the street - is ideal for the glasses. The makers say their device could improve warehouse safety, or be used to display GPS locations for first responders in medical emergencies. 

This is not Six15’s first foray into smart glass tech. They’ve been providing similar devices for the military, a pedigree that will stand them in good stead when it comes to winning over consumers. They’ve successfully merged the technology used for defense with some of the key demands made by the consumer market.

In a thinly-veiled slight on the aforementioned Google Glass, the makers say their glasses are ‘a more realistic and less obtrusive application to wearable tech and head-mounted displays, unlike other devices currently in the market…’ 

Six15’s product remains (intriguingly) nameless. But it was the talk of the town in Las Vegas, a genuine leap forward in terms of performance and wearability. We await the final consumer-ready version with excitement.

 

Forwarding Text Messages from iPhone to iPad

 

OS X Yosemite isn’t a new-fangled name for Yosemite National Park, but rather the newest version of Mac’s operating system. Besides featuring a new look, the system offers a plethora of special features, including iCloud Drive file storage, streamlined design for Safari, an expanded notification system with widgets, mail and message enhancements, and more. Immediately available to all Mac users for no cost as of October 16, 2014, Apple is improving continuity between devices with this new system (although not, as a number of defectors have discovered, between Apple and Android devices...)

The new set of continuity features connect iOS devices to the Mac several ways, including allowing users to make and answer calls with Macs and iPads when such devices are forwarded through their iPhones. Macs and iPads are now able to receive SMS messages, including those sent from non-iOS devices. Before OS X Yosemite and iOS 8.1 launched, iPads and Macs could only receive iMessages, which are part of the company’s proprietary messaging system designed for the iPad, iPhone and Mac.

SMS messages, usually intended for mobile phone communications only, are getting their turn thanks to OS X Yosemite, as users can send texts to any device via Macs and iPads. Now known as “Text Message Forwarding” in the Settings app, it was originally called “SMS Relay” before the launch of iOS 8.1. Being able to answer SMS messages and calls on a Mac is highly convenient, especially when a phone is charging or otherwise unavailable. 

iOS 8.1 and OS X Yosemite is required to forward messages and phone calls from an iPhone to a Mac or iPad. The Mac and iPhone also must be logged into the same iCloud account, and the WiFi feature needs to be off to allow for call forwarding.

Separate steps are (obviously) required to enable text message and phone call forwarding. For text message forwarding, users must turn on their Mac and iPhone’s WiFi. Note that SMS forwarding works even if each device is logged into a different WiFi system. The next step is to open the Messages app on the Mac and scroll to Menu Bar -> Messages -> Preferences -> Accounts -> Click on iMessage account -> and then check the boxes next to phone and email. If the email is not already listed, the user needs to click Add Email and enter an address. 

The email address is subsequently added to iMessage on the iPhone via Settings -> Messages -> Send & Receive. Note a registered email is necessary for enabling text message forwarding. To turn on Text Message Forwarding on the iPhone, the user needs to go to  Settings -> Messages -> Text Message Forwarding -> Turn Text Message Forwarding On. This results in a prompt requesting an activation code, which will appear in the Mac’s Messages app. The code is entered into the iPhone, and is required for every device the user wants included in the messaging service.

Any incoming message can now be answered on the Mac, and iPhone will automatically appear as a push notification on the Mac in the upper-right corner. Click ‘reply’ to answer a text, with messages also appearing in the Mac’s Messages app.

 

Grandmother Texts Family Three Years After Death

 

With Halloween upon us, supernatural text messages are buzzing between handsets. It’s one of the easiest pranks in the book: use a third party service or buy a PAYG phone, send a friend (or enemy) an SMS purporting to be from beyond the grave, and listen with barely-concealed glee as they relate their terrifying experience. 

But what if you received a text message from a relative who died years ago? And what if you had buried them with their phone because they were such a prolific texter?

Spooky, but that’s exactly what happened to a British family who lost their matriarch three years ago and decided to place her phone in the coffin as a way of commemorating her love of SMS. The family even sent periodic text messages to inform her of the latest family news. Then the unthinkable happened.

Three years after the funeral, the woman’s granddaughter sent one of her usual family updates. Her blood curdled when she immediately received a reply saying ‘I’m watching over you, you’ll get through this.’

The 22-year-old – who is not superstitious and doesn’t believe in paranormal events - sent a response demanding to know who was behind the text. An unidentified man eventually responded, apologizing for his text and saying he had been given the number a few weeks prior after signing up for a new contract. He said he had been receiving text messages from unknown phone numbers and, thinking they were pranks from friends, decided to turn hoaxer himself – not realizing the true identity of his victims.

The family learned granny’s number had been reallocated after she died. The original network – O2 – are attempting to retrieve the number from the new owner so the family can continue texting their dear departed without fear of reply.