JPAAWG
Text Messaging Updates:
SMS Spam and RCS Safety
Jaclyn Abrams
VP Threat Intelligence
WMC Global
November 7, 2018

WMC GLOBAL Proprietary and Confidential | Do Not Distribute© 2018 WMC GLOBALTEXT MESSAGING ATTACKS
UpdateTHREAT TRENDS
Advancing Attack Types

PHISHING
Credential
acquisition

DNS
corruption,
redirection

PHARMING

Input
tracking

iFrame- or
extensionbased
downloads

Data
modification

KEYLOGGINGiFRAME &BHO

TRANSACTIONPOISONING

TROJANDELIVERYSCREENLOGGINGMITM
ATTACKS

Malicious
download,
installation

Image andinteraction
recordingDatainterception

3

MOBILE SHIFT
Advancing Attack Types
 Email is still the attack delivery vector of choice• Corporations use email every day• Push media• Can carry payloads• Easy to spoof

 However, text messages, OTT messaging, and social media are rapidly rising inpopularity• With the anticipated rise of RCS, text messaging takes on many of the characteristics thatmakes email so appealing for threat delivery

 Messages—regardless of platform—are only the initiation point for a threat; the real
danger occurs once a user engages with the content4

MOBILE-TARGETED MESSAGING ATTACKSSMS is the Gateway to Consumer’s LivesPervasiveness• Mobile accounts for 70% of consumers’ timespent with digital media• Mobile continues to surpass desktop usage
for web access worldwide
Accessibility• Widely available• Cross-platform-delivery capable• Accessible from disparate entry points• Easy first interaction for various exploits
Cost Effectiveness• Inexpensive infrastructure• Scalable• RepeatableAnonymity• Low risk of attribution• Low risk of retaliation
5

ATTACK ENTRY POINTS
Shared Codes and Over-the-Top Platforms
Unvetted and Shared Codes

Over-the-Top Platforms

 Grey route to ecosystem entry

 Entry via Over-the-Top (OTT) platforms
offering SMS forwarding options

 Multiple layers behind registered entities
enable obfuscation• Enables code swapping• Masks actual message senders• Enables snowshoeing In the last year, abuse on shared codes
has skyrocketed as blocking has become
more aggressive in other areas• Harder to track OTT account ownershipwithout direct engagement with OTT services• Circumvents upfront safeguards and percode volume caps• Facebook and Twitter SMS forwarding aremajor source of these attacks

6

ATTACK CATEGORIES
Popular Attack Types
Social Engineering

Malware Distribution

 Credential phishing Contributing factors

 Fake accounts set up on Facebook, LinkedIn,and Twitter impersonate known individuals
within an organization and engage with
employees as trusted entities
 Buying and selling scams, especially overCraigslist
 Event and issue-based attacks• Lottery jackpots• Holidays or major events (sports, elections, etc.)• Health care open enrollment periods• Kaspersky forecasted that espionage will beshifting heavily to mobile and apps
• Mobile banking has seen a rapid rise in popularity,and is thus a prime target

 SMS used as attack delivery vector, prompting
link and media interaction• Malware delivery sites• Side-loaded apps
• RCS file transfer

 Bespoke exploit kits can be created tocapture specific desired data (e.g., SpyEye)• SMS generation and receipt to defeat 2FA7

ANATOMY OF AN ATTACK
Core Components

Attack Message

 Variable text generation
 Variable URL generation

Redirects

 Variable redirectchain• Device • Location• OS• Access time

• Operator network

Landing PageSupporting
Infrastructure Interaction points

 Sites Identity

 Data collection

 Servers

 Location

 Malware installation

 Accounts

 Contact info

 IPs

 Relationships

Threat Actor
Information

8

US-TARGETED ATTACKS
Recent Attacks
 Political Messages• Not attacks, per se, but high complaint
volumes• Spikes during election lead-up andperiods of high political engagement

 Socially Engineered Swatting• Messaging sent to multiple recipients
threatening bodily harm and containing
another phone number, intending to
implicate the contained phone number
as an involved party Phish Hopper• Pervasive attack targeting major brands• Leverages a flexible phishing kit to hop between
major brands- Facebook- Wells Fargo- Bank of America- Chase• Shifts IPs

 Coinbase Phishing• Increased interest in phishing bitcoin accounts• Attacks ramp up over holidays to evade detection• Attack shifts domains, IPs, and sending accounts
continuously, phasing the transition between
infrastructure
9

JAPAN-TARGETED ATTACKS
Recent Attack Example
 Malware Distribution• Sagawa Express-branded attack- Urged users to download app-disguised malware- Some versions of the attack also collected user PII- Malware stole IDs, passwords, and credit card
information- Malware hijacked devices to send additionalsmishing messages

 Phishing• SMS, email, and fake app attacks targeting
LINE, Amazon, MyJCB, AppleID, BitCoin
credentials

10

RCS
Emerging Threats

RCS DEPLOYMENTJapan Leads the Way
64 Operators Across 45 Countries

Image courtesy of GSMA
https://www.gsma.com/futurenetworks/rcs/global-launches/
12

RCS CAPABILITIESEnhanced Experiences and Interactivity
 RCS brings app-like functionality to text messaging• Typing indicators• Interaction components• Read receipts• Embedded branding• Link interactions• Multi-device messaging• File transfers• Geolocation

 Introduces Messaging as a Platform (MaaP) functionality for A2P Messaging• Certified senders withbranding and logos• Chatbots• Purchase of items sold by chatbots• Privacy controls• Spam protections• Rich cards

13

RCS CAPABILITIESExamplesVerified Sender
Vetted and identified

Rich Cards
Images, videos, GIFs

Custom Branding
Names, colors, logos

QR CodesTickets, tracking,redemptions

Suggested Actions
URLs, maps, calendars,dialers

Suggested Replies
Customized response
options

Image courtesy of GSMA
14

RCS SAFETY
Areas for Planning Verified Sender Onboarding Abuse Reporting and Spam Control• Vetting requirements• Recipients• Verification procedures• Attack data sharing• Proof of identity/impersonation prevention• Systems and implementations

 Entity and Message Blocking

 Interactivity Management• Thresholds for blocking implementation• Redirection• Prohibited behaviors• Downloads• Abuse pattern establishment• File transfers• User-level vs. operator-level blocking
15

QUESTIONS?
CONTACT ME
Jaclyn Abrams
VP Threat Intelligence
WMC Global
jaclyn.abrams@wmcglobal.com