A Silent SMS Denial of Service (DoS) Attack
N.J Croft and M.S Olivier
Information and Computer Security Architectures (ICSA) Research Group
Department of Computer Science
University of Pretoria
Pretoria
South Africa
Email: ringtingting@gmail.com

Abstract— Global System for Mobile communications (GSM)
is a popular mobile communications network. Short Message
Service (SMS) is an easily adopted person-to-person communications technology for mobile devices. The GSM architecture allows
for the insertion of mass application-generated SMS messages
directly into the network infrastructure. This is achieved througha SMS Mobile Switching Centre (SMSC) using a variety ofrequest-response protocols, for example Short Message Peer-ToPeer Protocol (SMPP).
Through protocol manipulation, an application may generate
an SMS which neither displays on the mobile handset nor
provides an acoustic signal. Known as a “Silent” SMS, this occurs
where the mobile handset must acknowledge receipt of the shortmessage but may discard its contents. A “Silent” SMS may help
police services detect the existence of a mobile handset without
the intended party knowing about the request. In contrast, amass continuous send of “Silent” SMS messages will constitute aninvisible Denial of Service (DoS) attack on a mobile handset. Sucha mobile handset DoS attack may be conducted for economic
advantage to elude another party from communicating.
This paper describes, from a technical perspective, how asilent application-generated denial of service (DoS) SMS attack
is conducted. We then investigate possible ways of thwarting
such an attack at a GSM network level. Furthermore we explore
related SMS attacks on the GSM network.

I. I NTRODUCTION
The Global System for Mobile communications (GSM) is
a popular digital circuit switched network [1]. GSM is acommon telecommunications standard originally issued by theEuropean Telecommunications Standards Institute (ETSI) [2].
GSM is an open standard which is currently developed by the
3rd Generation Partnership Project (3GPP) [3]. GSM provides
recommendations, not requirements. The GSM specifications
define the functions and interface requirements in detail but
do not address the hardware. The reason for this is to limit
the designers as little as possible but still to make it possible
for the operators to buy equipment from different suppliers.
The name GSM first comes from a group called GroupSpecial Mobile (GSM), which was formed in 1982 by theEuropean Conference of Post and Telecommunications Administrations (CEPT) to develop a pan-European cellular system that would replace the many existing incompatible cellular
systems already in place in Europe. However, when GSM
service started in 1991, the abbreviation ”GSM” was renamed
to Global System for Mobile Communications from GroupSpecial Mobile.

GSM has become an international cooperation and collaboration between people, companies and governments, creating
a truly global wireless communication network. At the time ofwriting, GSM service had surpassed the 2 billion people markand is currently available across more than 214 countries andterritories worldwide [4].
The initial Short Message Service (SMS) standard was first
discussed in the early 1980s but the world’s first commercial
SMS service was not introduced until 1992. SMS was createdas part of Phase I of the GSM standard. SMS is widely adopted
with approximately 1 billion SMS messages sent every day
worldwide [5].
The SMS message, as specified by the ETSI organizationin documents GSM 03.40 [6] and GSM 03.38 [7], can be
up to 160 characters long, where each character is 7 bits
according to the 7-bit default alphabet. Eight-bit messages(max 140 characters) are usually not viewable by the phones
as text messages; instead they are used for data in e.g. smart
messaging (images and ringing tones) and Over The Air (OTA)
provisioning of Wireless Application Protocol (WAP) settings(to be discussed in more detail later). 16-bit messages (max
70 characters) are used for Unicode (UCS2) text messages,
viewable by most phones. A 16-bit text message will on somephones appear as a Flash SMS (aka blinking SMS or alert
SMS).
The Short Message Peer-To-Peer Protocol (SMPP) [8], [9]is a telecommunications industry protocol for exchanging SMS
messages between SMS peer entities such as short message
service centres (SMSCs). It is often used to allow third parties
to submit messages at an application level, often in bulk.
Silent messages, often referred to as “Silent SMS” or“Stealth SMS” is indicated neither on the display nor by an
acoustic signal. GSM 03.40 [6] describes a short message oftype 0 which indicates that the ME must acknowledge receiptof the short message but may discard its contents. Such an
SMS is useful, in particular, for the police services to detect
the existence of a mobile handset without the intended party
knowing about the request. However, a “Silent” SMS may be
used for more sinister reasons.
Traditionally a denial-of-service (DoS) attack is an attempt
to make a computer resource unavailable to its intended users.
One such method is to flood a network, thereby preventing
legitimate network traffic. Typically the targets are high-profile
web servers, and the attack attempts to make the hosted web

pages unavailable on the Internet. Such an attack is extendable
to any mobile environment. A mobile device is renderedineffective should a mobile device be flooded with this typeof SMS messages. Furthermore, should a “Silent” SMS DoS
attack takes place on the handset, the intended victim would be
oblivious to the attack. The only visible symptom would be anabnormal decline in battery charge capacity and the inability
to receive calls etc. This ineffectiveness of the handset is due
to SMS messages making use of the signalling layer, also usedin performing other network events.
Not only will a “Silent” SMS consume battery power but
it will clog the signalling channel. This may be the reasoning
behind the motivation in performing a “Silent” DoS attack.
Primarily it may be done for economic advantage to elude
another party to communicate, or may be used to ensure that agiven party is not notified of some events. As another example,
consider an Intrusion Detection System (IDS) that informs a
network administrator via mobile phone if an attack occurs.
By launching a DoS attack on the mobile phone, the network
intrusion may occur for much longer without the knowledgeof the network administrator.
In this paper we explore the technical detail in executing
a mobile application-generated Denial of Service (Dos) SMS
Attack. We investigate possible ways of thwarting such an
attack at a network level. Furthermore we explore related
attacks using SMPP and SMS on a GSM network.
This paper is structured as follows: Section II covers abrief overview of GSM. Section III covers in detail thecomposition of an SMS message. This includes both 7-bit
and 8-bit messaging. Section IV investigates the various
application generated SMS protocols with a specific focus on
the industry leader, SMPP. Section V illustrates the technicalaspects of sending a “Silent” 7-bit and 8-bit SMS using SMPP.
Section VI explores the possibilities of thwarting “Silent”
SMS DoS attacks. Section VII shows possible spin off attacks
aimed in particular at the SMSC itself. Finally Section VIII
concludes this paper.
Our decision to position our work in the GSM context isbased on the popularity of GSM and its wide spread adoption
in comparison to other mobile communication networks suchas Universal Mobile Telecommunications System (UMTS). In
addition, work reported on in this paper forms part of a larger
privacy and security project [10]–[14] set in the GSM andnext generation wireless communication context.
II. BACKGROUNDThe Global System for Mobile Communications (GSM)[15] [1] is a common standard issued by the European
Telecommunications Standards Institute (ETSI). The mostbasic service supported by GSM is telephony; however GSM
also allows data to be transported (both synchronous andasynchronous) as a bearer service [10]. The GSM standard isconsidered to be a “second generation” or 2G cellular system
and was designed to be secure, have strong subscriber authentication and Over The Air (OTA) transmission encryption[10]. In order to understand the origin and SMS applicationin GSM, the respective underlying architecture needs to beunderstood.

A. GSM Architecture
The GSM system has two major components: the fixedinstalled infrastructure (network) and the Mobile Station(MS) [16]. Mobile users make use of the serving GSM
network’s services by communicating over a radio interface.
Figure 1 illustrates the GSM architecture.

Fig. 1.

GSM Architecture (adapted from [10])The Mobile Station (MS) is the mobile phone or GSM compliant device. The MS provides access to the GSM network.
The MS consists of Mobile Equipment (ME) and a Subscriber
Identity Module (SIM) [17]. The Base Transceiver Station(BTS) is a radio tower or pico (single) cell with which the
Mobile Station communicates. The Base Station Controller(BSC) acts as a common node between multiple BTSs andthe network’s backbone. The Mobile Switching Centre (MSC)
performs the switching functions of the network. The MSC has
an interface to one or more BSCs and to external networks.
Signalling between functional entities in the network system
uses the Signalling System Number 7 [18]. Several databases
are available for control and network management. The following are usually considered to be part of the MSC: i) Home
Location Register (HLR) - contains permanent (user’s profile)and temporary (location information) data for all registeredusers with a network operator, ii) Visitor Location Register(VLR) - is responsible for a group of location areas andstores the data of those users who are currently in its areaof responsibility, iii) Authentication Centre (AuC) - provides
for authentication of an MS on the network and encryption ofcommunication transmissions, iv) Equipment Identity Register(EIR) - registers equipment data.
The Short Message Service (SMS) is a store and forward
service, in other words, short messages are not sent directlyfrom sender to recipient, but always via an SMS Centre(SMSC) instead. Each mobile telephone network that supports
SMS has one or more messaging centers to handle and manage
the SMS messages. The service center is responsible for thecollection, storage, and delivery of short messages, and isoutside the scope of GSM [1]. Thus the provider of the
SMS service does not necessarily have to be the serving
GSM operator. However, a default SMSC number is usuallyprovided by the network operator and this number is stored at
the Mobile Station (MS).
III. S HORT M ESSAGE S ERVICE (SMS)
Short Message Service (SMS), is a universal text messaging
system, allowing the transmission of messages up to 160alphanumeric characters to be sent to or from a GSM Mobile
Station (MS). SMS is characterized by an out-of-band packet
delivery and low-bandwidth message transfer, which results ina highly efficient means for transmitting short bursts of data.
Message delivery forms part of the GSM infrastructure where
every SMS has to pass via a Short Message Service Centre(SMSC).
The benefit of an SMS to a user centers around convenience, flexibility and the seamless integration of a complete
messaging solution. SMS works on a store-and-forward basis
and when received, is usually stored on the SIM card or on the
MS’s internal store. An SMS is transferred in a connectionlesspacket mode over the signalling channel of the serving GSM
network. Once a message is sent, it is received by a SMSC
(refer to Figure 1), which must then get it to the appropriate
recipient mobile device via the MSC.
An SMS comprises of the following elements, of which
only the User Data (the message) and originating address(mobile number) is displayed on the recipient’s mobile device:i) Header - identifies the type of message, ii) Service Center
TimeStamp, iii) Originating Address - mobile number of thesender, iv) Protocol Identifier, v) Data Coding Scheme, vi)User Data Length - the length of the message, vii) User Data
- the message (140 bytes: 160 7-bit characters, 140 8-bit
characters or 70 16-bit characters ).
SMS messages travel between several network nodes before
being delivered. The sender of a Mobile Terminating (MT)message is charged for the sending of the SMS. Usually the
charge for receiving an SMS is zero.
We now describe the process flow when an SMS message
is sent from one sender MS (handset) to a recipient MS [14].
1) The SMS message is submitted from the sender MS to
the SMSC
2) After the message is processed at the SMSC, it sends arequest to the HLR and receives routing information for
the recipient MS3) The SMSC sends the SMS to the MSC
4) The MSC retrieves the recipient’s information fromthe VLR. This may include an authentication operation
between the MSC and VLR
5) The MSC forwards the message to the recipient MS6) If delivered successfully, the SMS is stored on therecipient MS’s SIM card under USER-DATA
7) The MSC returns to the SMSC the outcome of the SMS
delivery status
8) If requested by the sending MS, the SMSC reports
delivery status of the SMS back to the sender
As described above, messages are sent to a Short Message
Service Centre (SMSC) which provides a store-and-forwardmechanism. It is a “best effort” attempt on the networks side
to send messages to the intended recipients. If a recipient
is not reachable, the SMSC queues the message for later
retry. The re-try process rules differ per SMSC. There may
be a fixed re-try upper bound transmission count or timeelapsed constraint, after which the message is discarded. Some
SMSCs merely provide a “forward and forget” option wheretransmission is tried only once. Both Mobile Terminated(MT), for messages sent to a mobile handset, and Mobile

Originating (MO), for those that are sent from the mobile
handset, operations are supported. As message delivery is best
effort, there is no guarantee that a message will actually bedelivered to its recipient and delay or complete loss of amessage is not uncommon, particularly when sending between
networks. Users may choose to request delivery reports, which
can provide positive confirmation that the message has reached
the intended recipient, but notifications for failed deliveries areunreliable at best.
Transmission of the short messages between SMSC andphone can be done through different protocols such as SS7
within the standard GSM framework or TCP/IP within thesame standard. Messages, whose payload length is limitedby the constraints of the signalling protocol to precisely 140
bytes (140 bytes = 140 * 8 bits = 1120 bits). In practice, thistranslates to either 160 7-bit characters, 140 8-bit characters, or
70 16-bit characters. Characters in languages such as Arabic,
Chinese, Korean, Japanese or Slavic languages (e.g. Russian)must be encoded using the 16-bit UCS-2 character encoding.
When a mobile terminated message is class 0 and the MS
has the capability of displaying short messages, the MS shalldisplay the message immediately and send an acknowledgement to the SMSC when the message has successfully reached
the MS [7]. This effectively means that if the mobile isincapable of displaying a message it may simply be ignoredand discarded by the handset. The SMSC will still, however,receive a successful delivery receipt acknowledgement. This
forms the basis of a possible Denial of Service (DoS) attack
whereby the mobile handset is flooded with messages it simply
wont display and discard. In order to flood a MS (handset)
with “Silent” SMS messages, a mechanism is required to autogenerate mass messages which can be sent to the Mobile
Station continuously. We now investigate bulk SMS messaging
protocols which allow for the mass sending of SMS messages
providing the platform for a silent DoS mobile handset attack.
IV. A PPLICATION -G ENERATED SMS P ROTOCOLS
There are numerous protocols for the generation of application originating SMS messages. Industry protocols include
UCP/EMI, CIMD [19] and SMPP [8] amongst others. These
protocols provide third parties the capability of submitting
SMS messages, often in bulk and at reduced costs.
Computer Interface to Message Distribution (CIMD) is a
proprietary SMSC protocol developed by Nokia for their Artus
SMSC. The External Machine Interface (EMI), an extension
to Universal Computer Protocol (UCP), was developed by
LogicaCMG [20], the current SMSC market leader. The Short
Message Peer-To-Peer protocol (SMPP) is the most commonof industry protocols for exchanging SMS messages between
SMS peer entities such as SMSC. SMPP was originallydesigned by Aldiscon, a small Irish company that was laterbought by Logica, now LogicaCMG [20]. In 1999, SMPP
was formally handed over to the SMPP Developers Forum,
which was later renamed as The SMS Forum [21].
The most commonly used versions of SMPP are v3.3 andv3.4 [8] where the latter adds transceiver support functionality(single connections that can send and receive messages).

Data exchange may be synchronous, where each peer must
wait for a response for each PDU (protocol data units, orpackets) being sent, and asynchronous, where receiving andtransmitting execute independently with the use of buffers andtimers. The latest version of SMPP is v5.0 [9]. The protocol isbased on pairs of request/response PDUs exchanged over OSI
layer 4 (TCP session) connections. PDUs are binary encoded
for efficiency.
Using the SMPP protocol, an SMS application system called
the “External Short Message Entity” (ESME) may initiate anapplication layer connection with an SMSC over a TCP/IP or
X.25 network connection and may then send short messages
and receive short messages to and from the SMSC respectively[8]. Every SMPP operation must consist of a request PDU andassociated response PDU. The receiving entity must return theassociated SMPP response to an SMPP PDU request. As an
example, a Submit Sm PDU (refer to Table I) is used to send
an SMS message which expects a Submit SM Resp from an
SMSC or bulk messaging gateway.
Field
Name

Size
OctetsType

Descriptioncommand lengthcommand idcommand status
sequence number

4
4
4
4

Integer
Integer
Integer
Integer

Set to overall length of PDU
submit sm (0x00000004)
Not used
Unique sequence number

service typesource addr ton
source addr npi
source addr
dest addr ton
dest addr npi
dest addr
esm classprotocol idpriority flagschedule delivery time
validity period
registered delivery
replace if present flagregistered delivery
data coding
sm default msg id
registered delivery
sm length
short message

max 6
1
1
max 21
1
1
max 211
1
1
1 or 17
1 or 17
1
1
1
1
1
1
1
Var. 0-254

COctetStringInteger
Integer
COctet String
Integer
Integer
COctet String
Integer
Integer
Integer
COctet String
COctet String
Integer
Integer
Integer
Integer
Integer
Integer
Integer
Octet String

NULL for default SMSC settings
Type of Number for source
Numbering Plan Indicator for source
Originating address
Type of Number for destination
Numbering Plan Indicator for destination
Destination address
Indicates Message Mode & Message Type
Protocol Identifier (refer to [6])Priority level of the message
NULL for immediate message delivery
NULL for SMSC default validity period
SMSC delivery receipt
Replace existing message
SMSC delivery receipt
Encoding scheme used (refer to [7])NULL for default SMSC msg id
SMSC delivery receipt
Length in octets of short message
Up to 254 octets of short message user data

TABLE ISMPP S UBMIT S M PDU

The command length, command id, command status andsequence number all form part of the PDU header while
the remaining field names constitutes the message body. The
data coding field indicates the data coding scheme and is used
to usually indicate if the SMS message is 7-bit, 8-bit or 16bit encoded. This field will play an important role during theattack to be described later. Further details are available in therelevant specification document [8].
An example of a 7-bit SMPP Submit Sm PDU is provided
for in Listing 1. SMS messages are binary encoded according
to the 7-bit GSM Default Alphabet table, found in GSM 03.38[7]. Listing 1 is GSM 03.38 encoded and represented in
Hexadecimal (Hex) as it is easier to read hexadecimal numbers
rather than a binary representation.
Listing 1.

Example of SMPP Submit Sm PDU Encoding

E n c o d i n g PDU H e a d e r . .
’ c om mand length ’ , ( 7 1 ) . . . 00 00 00 47’ command id ’ , ( 4 ) . . . 00 00 00 04’ c o m m a n d s t a t u s ’ , ( 0 ) . . . 00 00 00 00’ s e q u e n c e n u m b e r ’ , ( 1 ) . . . 00 00 00 01

E n c o d i n g PDU Body . .
’ s e r v i c e t y p e ’ , ( 0 ) . . . 30 00’ s o u r c e a d d r t o n ’ , ( 1 ) . . . 01 ∗∗’ s o u r c e a d d r n p i ’ , ( 1 ) . . . 01 ∗∗’ s o u r c e a d d r ’ , ( 2 7 8 2 9 2 3 9 8 1 2 ) . . . 32 37 38 32 39 32 33 39 38 31 32 00’ d e s t a d d r t o n ’ , ( 1 ) . . . 01 ∗∗’ d e s t a d d r n p i ’ , ( 1 ) . . . 01 ∗∗’ d e s t a d d r ’ , ( 2 7 8 2 9 2 3 9 8 1 2 ) . . . 32 37 38 32 39 32 33 39 38 31 32 00’ e s m c l a s s ’ , ( 0 ) . . . 00
’ p r o t o c o l i d ’ , ( 0 ) . . . 00
’ p r i o r i t y f l a g ’ , ( 0 ) . . . 00
’ s c h e d u l e d e l i v e r y t i m e ’ , ( 0 ) . . . 30 00’ v a l i d i t y p e r i o d ’ , ( 0 ) . . . 30 00’ r e g i s t e r e d d e l i v e r y ’ , ( 1 ) . . . 01
’ r e p l a c e i f p r e s e n t f l a g ’ , ( 0 ) . . . 00
’ d a t a c o d i n g ’ , ( 0 ) . . . 00
’ s m d e f a u l t m s g i d ’ , ( 0 ) . . . 00
’ s m l e n g t h ’ , ( 0 ) . . . 00
’ s h o r t m e s s a g e ’ , ( s a t n a c . o r g . z a ) . . . 73 61 74 6E 61 63 2E 6F 72 67 2E 7A 61
F u l l PDU ( 7 1 o c t e t s + + ) . . 00 00 00 47 00 00 00 04 00 00 00 00 00 00
00 01 30 00 01 01 32 37 38 32 39 32 33 39 38 31 32 00 01 01 32 37 38
32 39 32 33 39 38 31 32 00 00 00 00 30 00 30 00 01 00 00 00 00 73 61
74 6E 61 63 2E 6F 72 67 2E 7A 61∗∗ ( 0 ) i n d i c a t e s l o c a l n u m e r i c n u m b e r i n g f o r m a t t i n g( 1 ) i n d i c a t e s i n t e r n a t i o n a l n u m e r i c number f o r m a t t i n g++ O c t e t i s a g r o u p o f 8 b i t s , o f t e n r e f e r r e d t o a s a b y t e

Short messages can also be used to send binary content
such as ringtones, logos, or WAP Push messages as well asOver The Air (OTA) programming or configuration data. A
WAP Push message provides a direct link to an Internet web
reference (URL) via an SMS message. An OTA message isusually used to send handset specific settings via an SMS
message. Such SMS messages are sometimes vendor-specificextensions of the GSM specification. A WAP push is a binary
SMS message consisting of a header, a URL and a message.
WAP push messages are 8-bit encoded messages and are
therefore limited to 140 octets. It is important to note that
not all phones on the world market support WAP pushes andmay be discarded by the handset upon receipt.
Listing 2 illustrates a 8-bit WAP push template represented
in Hexadecimal (Hex).
Listing 2.

WAP Push template

HEADER<STRING><SI><INDICATION><PROTOCOL INDICATOR/><STRING>URL</STRING></INDICATION><STRING>MESSAGE</STRING></INDICATION></SI>
Now r e p l a c e t h e WAP Push Tags a s f o l l o w s :HEADER . . . 06 05 04 0B 84 23 F0 DC 06 01 AE 02 05 6A 00<STRING> . . . 03</STRING> . . . 00
<SI> . . . 45
<INDICATION> . . . C6
<PROTOCOL INDICATOR> . . . 0C f o r h t t p : / / , 0D f o r h t t p : / / www.
</INDICATION> . . . 01</SI> . . . 01
URL . . . 73 61 74 6E 61 63 2E 6F 72 67 2E 7A 61 ( s a t n a c . o r g . z a )F u l l PDU ( 4 0 o c t e t s + + ) . . ∗∗0605040 B8423F0DC0601AE02056A0045C60C037361746E61632E6F72672E7A610001036869000101∗∗ p l a c e FULL PDU i n s h o r t m e s s a g e f i e l d o f Submit Sm PDU++ O c t e t i s a g r o u p o f 8 b i t s , o f t e n r e f e r r e d t o a s a b y t e

If an application encodes GSM User Data Header Information (UDHI) in the short message user data, it must set
the UDHI flag in the esm class field [8]. In other words,
we must indicate that this message is a 8-bit binary message(WAP Push SMS). This is achieved in SMPP by setting theesm class field to 64 (0x40). Likewise, the encoding of themessage must be set to represent 8-bit binary encoding. Thisis achieved by setting the data coding field to 4 (0x04) (refer
to [7], [8]).

V. S ENDING A “S ILENT ” SMS
This section considers strategies to launch a silent SMS
attack. A successful attack strategy will be one that i) sends
an SMS to an MS without displaying the SMS on the MS andii) is useable on as many SMPP gateways as possible.
In order to find possible attack strategies the SMS specifications were scrutinized and bulk SMS providers questioned
regarding the sending of a “Silent” SMS. Once possible
strategies have been found, it would be necessary to test a“Silent” SMS in principle. Furthermore, to identify the numberof bulk SMS providers providing “Silent” SMS capabilities.
We have currently found two known ways to send a “Silent”
SMS. There are however, countless ways to malform an SMS
PDU which may cause the handset to malfunction or SMSC
to crash.

B. Manipulating Timing in a WAP Push Message
Another example of a “Silent” SMS is to manipulate thescheduled delivery time or validity period when sending a
WAP push SMS. However, this approach was not transparent
through all gateways we tested and warrants investigation.
By setting the scheduled delivery time or validity period
before today’s date, we were able to achieve similar results.
The format of the scheduled delivery time and validity period
is in the form (YYMMDDhhmmsstnn). Figure 4 illustrates a
WAP Push “Silent” SMS example by calling an exposed web
service method again at an SMPP supported SMS gateway.

A. Manipulating the Data Coding Scheme
Using GSM 03.38 [7], we set the data coding to 192(0xC0) (11000000). This sets the Message Waiting Indication
Group identifier, which translates to “Discard Message”. With
bits 7..4 set to 1100, the mobile may discard the contents ofthe message [7]. Figure 2 shows a “Silent” SMS example bycalling an exposed web service method at an SMPP supported
SMS gateway.
Fig. 4.

Web Service “Silent” SMS Call (WAP Push) using [22]Figure 5 shows the PDU dump of a WAP Push “Silent”
SMS and the delivery receipt notification received. The SMS
message status is DELIVRD, however the message neverdisplays on the mobile handset.

Fig. 5.
Fig. 2.

Figure 3 shows the PDU dump of a “Silent” SMS andthe delivery receipt notification received. The SMS message
status is DELIVRD, however the message never displays on
the mobile handset.

Fig. 3.

PDU dump of WAP Push “Silent” SMS from [22]Web Service “Silent” SMS Call using [22]PDU dump of “Silent” SMS from [22]The “Silent”SMS defined by manipulating the data coding scheme worked on every SMPP enabled gateway wetested (six different SMPP gateways in total). SMPP gateways
are stringently built according GSM standards [8]. Thiseffectively guarantees the sending of a “Silent” SMS via
manipulating the Data Coding Scheme through any SMPP
gateway.

C. Cost of the attack
Now that we have established how to send both 7-bit
and 8-bit messages using SMPP, how much would it costto send a message? Purchasing SMS messages in large prepaid volume bundles, from messaging providers or network
operators, results in substantial cost reductions. A few years
ago, some operators were not charging for the sending ofbulk SMS messages. Although rare, some network operators
still provide for this free messaging service. Message costs
may further be reduced if the application is assigned a fixednumber sender identifier. This effectively means that a message
will always arrive on a handset from the application witha predetermined number. A base cost of 0.01 Euro cents is
not unobtainable per message. Then for example the costassociated in sending one “Silent” SMS every second for one
hour will amount to Euro 36 (1 x 60 x 60 x 0.01 = Euro 36).
This shows that a “Silent” SMS DoS attack is economicallyfeasible.

VI. T HWARTING “S ILENT ” D O S SMS ATTACKS
We have proved a “Silent” SMS attack is indeed a reality
and cheap enough to the detriment of all mobile GSM subscribers. The most obvious solution to this form of attack, or
any bulk SMS attack, would simply be to check each message
and discard it based on a predetermined set of criteria. One
such criteria is to simply discard any identical messages (samecontent and recipient). With the current volumes [5] of SMS
messages sent worldwide, a real-time check on each message
is impracticable and will no doubt have an adverse effect on
network performance.
The market leader in terms of SMS Fraud Management
Systems (FMS) is WhiteCell [23]. Such a FMS counters
threats by providing the mobile network operator with anadditional security layer on top of its existing SMS infrastructure. This security program identifies potential threats, andprevents unwanted traffic from passing through the network.
Although such technologies do exist, implementing this across
GSM worldwide is a near impossible task given the global
complexity of the GSM infrastructure. Added to this, there is
the network profit motive. This insight to network operators
thinking can be summed up in the following comment: “aslong as messages are being sent, someone is being charged
for it!”.
Thwarting a bulk SMS attack may prove difficult, identifying and preventing a “Silent” SMS attack seems even lesslikely.
VII. SMS R ELATED ATTACKS
A. SMSC Attacks
The first attacks is aimed specifically at the SMSC. The
SMSC is flooded with malformed SMS PDUs or SMS PDUs
are manipulated to never exit the SMSC re-try queue. This may
effect the stability of the SMSC, overloading it and eventuallycausing it to crash.
B. Charged for Receiving SPAM
In the United States the GSM billing model includes billingthe subscriber who receives an SMS message. Through thesending of mass SMS messages, the subscriber is charged
for unsolicited messages (SPAM). This effectively means that
subscribers are legitimately charged for receiving SPAM. In
the case of a “Silent” SMS attack, the end user will be charged
for messages that were never even displayed on the handset.
VIII. C ONCLUSION
In this paper we described, from a technical perspective,
how a silent application-generated denial of service (DoS)SMS attack is conducted. We illustrated through real-world
examples how such an attack is conducted. We began byproviding a detailed description of SMS messages, how they
are composed and sent. We made use of the SMPP protocol
for the sending of “Silent” SMS messages which may be usedin performing a Denial of Service (DoS) attack on a mobile
handset. We then investigated possible ways of thwarting suchan attack at a GSM network level. Furthermore we explored
related SMS attacks on an SMSC and billing of a subscriber
within the GSM network.

R EFERENCES[1] M. Rahnema, “Overview of the gsm system and protocol architecture,”
IEEE Communications Magazine, vol. 31, no. 4, pp. 92–100, April 1993.
[2] Recommendation GSM 02.09; Security related network functions, European telecommunications Standard Institute, ETSI, June 1993, tech.
Rep.
[3] 3rd Generation Partnership Project, “3gpp,” Web Reference:
http://www.3gpp.org, accessed October 2006.
[4] GSM
Association,“homepage,”
Web
Reference:
http://www.gsmworld.com/index.shtml, accessed April 2006.
[5] ——, “SMS (Short Message Service),” Web reference,
http://www.gsmworld.com/yechnology/sms. Accessed May 2005.
[6] Digital cellular telecommunications system (Phase 2+); Technical realization of the Short Message Service (SMS); Point to Point (PP)(GSM
03.40 version 6.0.0), European telecommunications Standard Institute,
ETSI, March 1998.
[7] Digital cellular telecommunications system (Phase 2+); Alphabets andlanguage-specific information (GSM 03.38 version 7.0.0 Release 1998),
European telecommunications Standard Institute, ETSI, July 1998.
[8] Short Message Peer to Peer Protocol Specification v3.4, The SMS
Forum, October 1999.
[9] Short Message Peer to Peer Protocol Specification v5.0, The SMS
Forum, February 2003.
[10] N. Croft, “Secure Interoperations of Wireless Technologies,” Masters
Dissertation, University of Pretoria, School of Computer Science, October 2003.
[11] N. Croft and M. Olivier, “Using compatible keys in achieving subscriber
privacy channelling for billing in GSM Networks,” in Proceedings ofthe Fifth International Network Conference, S. Furnell, P. Dowland, andG. Kormentzas, Eds., 2005, pp. 245–252.
[12] ——, “Using a Trusted Third Party Proxy in achieving GSM
Anonymity,” in South African Telecommunication Network and Applications Conference. SATNAC, September 2004.
[13] ——, “Codec-Hopping: Secure and Private Voice Communication in
Bandwidth Constrained Networks,” in SecPerU, Workshop on Security
an Privacy in Pervasive Ubiquitous Computing, Santorini, Greece, April
2005.
[14] ——, “Using an approximated one-time pad for securing Short Message
Service (SMS),” in South African Telecommunication Network andApplications Conference. SATNAC, September 2005.
[15] M. Mouly and M. Pautet, The GSM System for Mobile Communications.
Telecom Publishing, 1992, foreword By-Thomas Haug.
[16] E. T. . 929, “Digital cellular telecommunications system (Phase 2); Security related network functions,” European Telecommunications Standards
Institute, November 1999.
[17] European digital cellular telecommunications system (Phase 2); Specification of the Subscriber Identity Module - Mobile Equipment (SIMME) interface (GSM 11.11), European Telecommunications Standards
Institute, Sophia Antipolis, France, 1998.
[18] Y. B. Lin, “Signaling System Number 7,” IEEE Potentials, pp. p. 5–8,
August 1996.
[19] CIMD Interface Specification, Nokia SMS Center 7.0, Nokia, December
2004.
[20] LogicaCMG, Web reference, http://www.logicacmg.com. Accessed
March 2007.
[21] The SMS Forum, Web Reference: http://www.smsforum.net, accessed
April 2007.
[22] SMS
BUG
COMMUNICATIONS,
Web
reference,https://www.smsbug.com/api/webservice.asmx. Accessed April 2007.
[23] WhiteCell, Web reference,http://www.white-cell.com. Accessed April
2007.

Neil Croft Neil Croft is a final year PhD Computer Science student at
the University of Pretoria. His research interests include security and privacy in current and next generation wireless communication networks. He
completed his Masters degree at the University of Pretoria in October 2003
and undergraduate studies at the Rand Afrikaans University in 2001. Hecurrently operates an SMS company called SMS BUG COMMUNICATIONS(www.smsbug.com).

NJ Croft and MS Olivier, "A silent SMS denial of service (DoS) attack," Proceedings of
the Southern African Telecommunication Networks and Applications Conference 2007
(SATNAC 2007), Sugar Beach Resort, Mauritius, September 2007 (Publishedelectronically)
Source: http://mo.co.za© The authors