Category Archives: Security

Where SMS messages go to die

Years ago I had a bit of a tiff with my cell phone carrier. I was getting spam via SMS and they bluntly told me they had never heard of such a thing and had no idea how to stop it from happening. Since I was charged a fee per message, I assumed this problem would take a long time to resolve itself, and so I just lodged a formal complaint to my carrier and was forced to disable SMS and wait.

Here’s a guy who has an even bigger issue:

Bubrouski, a computer science major at Northeastern University in Boston, is the proud owner of ‘Null@vtext.com,’ an account on the popular Verizon text messaging service that allows Internet users to send e-mail and IM messages directly to his cell phone as SMS text messages.

Bubrouski said he was just being clever when he signed up for a Verizon vText account with the user name ‘null,’ after his parents bought him his first mobile phone during his freshman year at Northeastern, in 2001.

Ooops. Now he receives loads of unroutable SMS messages on his phone including information from people who forget to fill out the “to” field:

That data has become more sensitive in recent months, as companies rush to deliver everything from SAT test scores to medical information and automobile diagnostics to cell phones and PDAs.

Bubrouski’s experience, while unusual, could be a sign of growing pains in the wireless industry, as companies rush to provide wireless data services, overlooking steps that could secure the data in transit, according to one security expert.

Unbelievable, really, that the “null” account would be assigned to an end user in the first place, but even more shocking that messages can be sent without proper routing information.

The eWeek article is a fun overview on why SMS still needs a lot of security to be bolted on and perhaps even why it will require a major redesign or replacement in the near future.

If we oppose drilling, why do we do it?

Let’s say the public is polled, and they say they oppose something; perhaps something like drilling for oil in the Arctic Wildlife Refuge:

Question: Should oil drilling be allowed in America’s Arctic National Wildlife Refuge?

— 53 percent — Do Not Allow Oil Drilling

— 38 percent — Allow Oil Drilling

The poll found a remarkable gap in intensity of feeling about drilling: 44 percent of respondents strongly oppose drilling, while just 25 percent strongly support it. Only about 10 percent were undecided on this issue.

What then could be driving some representatives in government to press ahead with plans to drill for oil in the Arctic Wildlife Refuge? Hard to say what motives are, but that is exactly what a website is trying to figure out. Granted they have a rather heavy-handed approach, and their data is not exactly transparent, but it does show some pretty nice capabilities for collecting and presenting data.

I guess the real question is can this site demonstrate a that contributions have led to pro-drilling votes. It is odd to me that they do not have that figured out, yet they suggest you tell everyone to stop taking money. And even if they did show a trend of payments and pro-drilling votes they would still have to account for the usual correllation/causation issues…

What better serves the cause of national security?

Common Sense Budget Act sponsor Lynn Woolsey (D-CA) had some interesting things to say about government spending and security:

What better serves the cause of national security? Investment in first responders, energy independence and global nutrition … or billions that we’re still pouring into the F-22A Raptor, which was designed to outpace Soviet fighter jets?

Dr. Lawrence J. Korb, former Assistant Secretary of Defense to Ronald Reagan for Manpower, Installations, and Logistics, gave more detail on the proposal in a report titled “A Realistic Defense for America”:

Without diminishing America’s ability to fight extremists, American can save $60 billion by eliminating Cold War-era weapons systems and programs designed to thwart the former Soviet Union – weapons and programs that are not useful in defending our country from extremists or the other threats we now face.

SMS campaigns and voting

First I read about the Saudi Arabia crackdown on service providers that resulted a block on SMS voting for certain “objectionable” television shows. Now I see that California has decided to ban political “advertisements” via SMS, according to Assembly Bill 582 from 2005:

This bill would, subject to certain exceptions, generally prohibit a person, entity conducting business, candidate, or political committee in this state from transmitting, or causing to be transmitted, a text message advertisement, including a political advertisement, to a mobile telephony services handset, a pager, or a 2-way messaging device that is equipped with short message or similar capability. By creating a new crime, this bill would impose a state-mandated local program.

Compare that with the news about last year’s campaigns in Ethiopia:

Two political parties contesting in Ethiopia’s May 15 national elections have been making effective use of mobile phone short message service to campaign.

The ruling Ethiopian People’s Revolutionary Democratic Front ( EPRDF) and the opposition Coalition for Unity and Democracy (CUD) have been campaigning via mobile short message service (SMS), calling people to vote for them.

I’ve heard through the grapevine that SMS sending and receiving is now blocked in Ethiopia, perhaps as a result of the run-up to the election last May. However, I can’t find any mention of it in the mainstream media. Until I can confirm the block, it makes for an interesting comparison to other ideas about policies and controls. For example, I believe the California law is based at least in part on the principle that cell-phone owners should not have to pay fees for incoming political advertisements. Yet rather than try to get service providers to make SMS political advertisements free, they prohibit the messages from being sent. And rather than put liability on the service providers to develop/implement spam filters for SMS, it seems the burden is now being shifted to the cell owners who will have to file a complaint or perhaps sue the originator (if they can figure out who it is).