Uchikura & Co., LLC

The system where authentication codes are sent via SMS to mobile phones is widely used by banks, e-commerce sites, and social networks as a means of verifying user identity. For users, it is a very convenient method since it does not require installing any additional applications, and virtually everyone can receive messages on their mobile phone number.

 

However, did you know that this convenient method has an unexpected vulnerability? SMS is not transmitted over the internet but instead relies on the telecommunications networks operated by mobile carriers. The foundation of this network is a protocol called SS7 (Signaling System 7).

 

SS7 was designed in the 1970s, based on the assumption that “telecom operators can trust one another.” As a result, it lacks modern security features. Experts have pointed out that if someone knows your phone number, there is a possibility they could intercept your communications or redirect your SMS messages. In fact, there have been reported cases overseas where SMS-based banking authentication was exploited to gain unauthorized access to accounts.

 

Many people assume that “SMS must be safe because it is handled by phone companies,” but that is not always the case. It is important to recognize that the SMS authentication we rely on in everyday life carries inherent structural weaknesses.