sms – Terence Eden’s Blog

What's the optimal length for a 2FA code?

@edent — Thu, 18 Aug 2022 11:34:12 +0000

The other day, a company sent me a 2FA code which was only four digits long.

I'll admit, this weirded me out. Surely 4 is just far too short. Right? I think almost every 2FA code I've seen has been 6 digits long. Even back in the days of carrying one of those physical RSA fobs, 6 has been the magic number.

But why?

A 2FA code is meant to prevent a specific class of problem. If an attacker has got hold of something you are (your username⁰) and something you know (your password), you are still protected by something you have (your phone). Whether your second-factor is an app generating unique codes, a SIM card receiving SMS¹, or a cryptographic enclave producing signed transactions - it doesn't matter. The attacker can use your password but won't get the unique second code.

Suppose you received a 2FA code that was a single digit. Is that secure enough?

I think most reasonable people would say that wasn't secure. An attacker has a 10% chance of guessing the 2FA. If the system allows for a couple of retries before locking them out, they've got a 30% chance of getting in.

Similarly a 2 or 3 digit code probably doesn't provide sufficient protection.

A typical bank card PIN is 4 digits. So an attacker has a 1 in 10,000 chance of guessing. That might be slightly better as bank PINs usually don't allow repeated digits, palindromes, and a few other combinations.

I suppose that if an attacker had compromised tens of thousands of credentials, and the service allowed for a few incorrect entries, it is statistically likely that they might be able to compromise a few accounts if they were only protected by 4 digits.

As 2FA codes get longer, they begin to reach the limits of what humans can remember. Yes, I know you have an excellent memory - but not everyone does. And I know your fancy 2FA app automatically copies and pastes the codes - but not everyone does. We have to work to what the average user is capable of at a minimum.

I think most people would find it annoying - if not impossible - to remember a 10 digit one-time password.

If you're copying a code from your phone to type into your laptop, there's probably an upper limit on what people will be prepared to do. No one is going to manually transcribe 128 digits. And, if they did, they'd likely introduce several errors.

So the industry has seemingly settled on 6 digits. I've ranted before about the lack of standardisation in the OTP specification. But all of them seem to allow 6 - 8 digits.

I suspect 6 is the standard because that's what the original RSA SecurID tokens used by default.

An attacker would have to be incredibly lucky to randomly guess a 6 digit code - literally a one-in-a-million chance². Even if they had multiple retries, it's still statistically unlikely.

Once I logged in using my 4 digit code, I had full access to my account. But if I wanted to make any changes, I had to wait for another 2FA code to be sent. So I guess the effective length of code was actually 8 digits. Which seems excessive 🤣

Thoughts from the community

I asked my Twitter buddies for their wisdom:

What do you think?

Traditionally, the something you are is a biometric. However biometrics are static - they never alter. So they're poor for some choices of authentication. A username represents something you are. Everyone can see your username - just like everyone can see the fingerprints you leave on every touchscreen and the DNA you shed all over the place. ↩︎
Let's gloss over SMS being a bit vulnerable for now. ↩︎
Although, as per Terry Pratchett: "Million-to-one chances crop up nine times out of ten." ↩︎

Is this a banking scam SMS?

@edent — Sat, 17 Jul 2021 11:35:07 +0000

Earlier this week, my holiday was interrupted by a sophisticated SMS scam. Rude! Let's take a look at it.

Let's take a look at all the ways we can tell it is a scam.

Firstly, and most obviously, I am not a customer of Lloyds Bank! But these scammers send out to multiple people hoping to catch victims.

Secondly, I've not made a complaint to Lloyds! But, again, scammers know that plenty of people have. So this adds a touch of authenticity. If you were a Lloyds customer who had recently complained - you're now primed to accept the scammer's call and treat it as legitimate.

Thirdly, that phone number. If you call it, a recorded voice says "Welcome to customer services..." Whose customer services? It doesn't say "Welcome to Lloyds". This is likely a number that scammers put on texts claiming to be from HSBC, Lloyds, NatWest. Cheaper for them to have a single phone number.

Fourthly, the reference number. It is just my phone number! That's an unusual reference number for a bank.

There's some weird spacing between "Mr" and "Eden" - not what I'd expect from a professional message.

What do you think of the SMS? Would you flag it as spam? I asked my Twitter followers and their responses were unanimous.

A few minutes after receiving the SMS, I got a call from a Peterborough number - not the 0800 number. The phone number was flagged as suspicious (read the number's reviews).

After the customary pleasantries, the voice at the end of the phone said "Can you just confirm your name and address for me please?"

I replied that I didn't give that information out to cold callers.

"Completely understandable sir. If you check your messages, you'll see an SMS from us scheduling the call. Did you receive that?"

I replied that I get lots of spam texts and that I couldn't be sure it was legitimate.

We reached an impasse.

With a little subtle social engineering on my part, I found out the nature of the complaint. And then I realised... it was a legitimate call!

A few months ago, I'd complained to Halifax Bank that they were sending letters to someone who didn't live at my address.

The 0800 phone number is owned by Halifax

Halifax are part of Lloyds Bankings Group.

The geographic number I received a call from is the Lloyds outbound number.

In my defence - this did have most of the Hallmarks of a scam! Lloyds have tried to do the right thing by alerting me that the call is coming. They've provided a trusted phone number for me to call if I am concerned. They've given me the name of the caller, and a reference number.

But these are all things a scammer can do as well!

Lloyds could have made this better. Does the average user know that Halifax is part of Lloyds? I didn't. Why didn't the call come from the number that they'd sent in their text? Would a link to a simple URl like lloyds.com/contact have reassured me? How about lloyds.com/complaint/ref/123...?

Instead, several silly mistakes and my unhealthy paranoia collided and convinced me it was a scam.

What's the solution here? Sure, Lloyds can up their game - but a canny scammer can just tweak the wording and send out a convincing forgery. We can all abandon SMS and move to some cryptographically signed service which no one can use properly. We can hope that mobile networks crack down on SMS spam and only let legitimate messages through. Or users can dial down their paranoia - and hope for the best.

But, sadly, it seems that trusting messages from financial services are all but impossible right now.

Why do scammers love NameCheap?

@edent — Wed, 19 May 2021 11:33:19 +0000

The UK is facing an epidemic of SMS fraud. Scammers know that we're all at home eagerly waiting for deliveries. So they send out phishing messages saying "Sorry we missed you" or "You need to pay a delivery fee". If you click on the link they send, you'll go to a very convincing website which looks identical to the courier's page.

Whereupon the fraudsters will ask for your bank details, credit card number, mother's maiden name, and inside leg measurement.

There are many complex reasons why this fraud proliferates. But one thing underpins these scams - a domain name and hosting. Over the last few months, the vast majority of the fraud I've seen has come from domains registered by NameCheap.

OK, but that's anecdotal evidence. Is there anything more robust?

My friends in the UK's National Cyber Security Centre have released a report looking at phishing - amongst other things. Here's what they have to say about NameCheap:

Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020.By December 2020 we found that it hosted in excess of 60% of phishing in this category.

NameCheap appear to be the preferred supplier of domains and hosting to the criminal community.

OK, they can't easily control who registers domains. But I'm sure that they take reports of abuse seriously. Right?

Looking specifically at the number of campaigns hosted by NameCheap against its monthly median attack availability, we see that by mid-year the median takedown times were consistently in excess of 60 hours. This undoubtedly made NameCheap an attractive proposition to host phishing and may explain the rise in monthly hosted campaigns that followed for UK government-themed phishing.

Oh...

The problem is, these domains are designed to be "hit-and-run". The spammer sends as many phishing messages as possible, in as short a time as possible. They're expecting the domain to be taken down. Every minute counts.

The CEO of NameCheap is, unsurprisingly, defensive of his company's handling of the situation.

What can be done?

There are some proposals to restrict access to new domains - but I don't think that's effective. A spammer can register a domain, wait a month, then blast it out.

NameCheap could make it harder for people to register domains with them. They accept anonymous registration using crypto-currency. I want to live in a world where people can anonymously register web services - but I also don't want to be bombarded with spam.

Given that NameCheap want anonymous customers, and given the prices for hosting are cheap, perhaps they should be taking "good behaviour" deposits from anonymous customers? Take, say, a hundred pounds and refund it only if the account isn't suspended.

Perhaps Nominet could insist that its members take swifter action against spammers - and then remove the ability to resell domains for those that don't?

Maybe NameCheap should increase its prices so that it can afford to pay for the abuse staff that it so desperately needs?

There are no easy answers here. But NameCheap are obviously doing something to attract - and profit from - scammers. What can be done to make them take more responsibility?

That Time I Accidentally Invented Twitter

@edent — Mon, 31 Aug 2020 11:28:09 +0000

A curio from the archives. Waaaaaay back in 2003, I was working at Vodafone on their graduate training scheme. One of their fancy new ideas was a crowd-sourced employee suggestion box for new business proposals.

As an eager young grad I submitted dozens of ideas. Most of them were crap. But, as I looked back over them, this one struck me as being a lot less crap than others.

Yes, it's an appallingly written proposal. Full of brash arrogance. I hadn't really started blogging in earnest and didn't quite get what all the fuss was about. This was a year before Flickr was launched - and I was talking about sharing photos online using the nascent MMS service.

At the time, SMS was a cash-cows for mobile operators. But MMS was a laggard. It was expensive for operators to add it to their networks, and that cost was passed on to users. And those users needed an expensive phone - and for their friends to also have expensive phones.

Being able to post messages and photos to a group of people - via a "web log" - would have been an interesting way to drive usage. Or so I thought.

I don't remember if any discussions happened around it. And, in truth, I don't think Vodafone would have been able to make it work. They would have locked it down so that only Vodafone UK subscribers could use it, they'd have charged a fortune, and they'd probably have targetted it at salesmen wanting to update their teams.

Perhaps I should have tried to launch it myself? I didn't really know what a start-up was back then, and I had no entrepreneurial zeal. I wasn't a great coder - but neither were the team behind the Fail Whale.

But, just for a minute there, I saw the potential of micro-blogging to change the world.

PaddyPower SMS Spam Follow-up

@edent — Wed, 22 Jul 2015 15:14:34 +0000

Earlier this year, I received SMS Spam from Paddy Power. I went into full-on Taken mode! I have a very particular set of skills, skills I have acquired over a very long career. Skills that make me a nightmare for spammers like them ☺

It culminated with barrage of complaints and an interview on BBC Radio 4.

A few months on, it's time to see what my complaining has achieved. First up, a pretty good response from the Direct Marketing Commission.

May I thank you for raising your concerns about the supply of your mobile data which led to your receipt of an unwanted text message from Paddy Power.

The DMC has looked into this matter and we have liaised with each of the members involved in the supply chain leading to your receipt of the unwanted text. Our investigation has highlighted specific areas where we could see a concern around direct marketing practice which led to your receipt of the SMS message. Whilst you may have opted-in to have your data shared, the companies involved relied on a tolerance that is not in place today, to retain and use data long after consent was given. Additionally, a sub-contractor made errors when placing names onto the marketing list which meant you were not suppressed from further marketing.

GoldSixty7 (DataTrada) was responsible for the suppression of your data. They supplied your data to Datatonomy and received your data from DBS Data. They have confirmed that you were not suppressed as you should have been, and apologise to you for the error. We have reminded the company of their obligation under the rules of the DMA Code which asks that members operate and maintain a suppression system. Whilst they did have a system in place, an error meant that the feed of data which contained your record was not updated. The data in question was used only once and the error has been rectified but it should not have happened.

DBS Data had sourced your data from USM Digital in 2012. This we understood to have been ‘opted-in’ in 2007. We were concerned about the consents people have given to the use of their data and how long data is held and we questioned the due diligence undertaken by DBS Data. Changes to guidance in late 2013 had encouraged DBS to review their policies and procedures in relation to compliance and consents, and part of this was a review of opt-in and consent statements and ensuring that consents remained current and compliant. Additionally, DBS have further reviewed their due diligence and made other changes since the case was made known. We have reminded DBS of their obligations under the Code to ensure that data is properly sourced, permissioned and cleaned; that any personal data collected should be adequate, relevant and not excessive for the purpose for which it has been collected; and that they accept that in the context of the DMA Code that they are normally responsible for any action (including the content of commercial communications) taken on their behalf by their staff, sales agents, agencies, one-to-one marketing suppliers and others.

The issue with data journeys is a recurring one. We have flagged this with the DMA who are looking strategically at the safeguards that might be possible after data and general or very limited consent for its use is given, when it is checked or cleansed and when and how it can be shared with or sold to others for marketing purposes.

May I thank you again for your efforts to highlight a problem in the industry.

Ok, so they didn't rain down fire from above - but it looks like they did a thorough job of investigating. Hopefully it will have put the fear into the responsible companies.

Next up, the Advertising Standards Authority.

I’m sorry to tell you that we are unable to deal with your complaint directly on this occasion because text messages from Paddy Power are sent from their Head Office which is based and registered in Ireland. Our Codes can only be applied to advertisers based in the UK or using a UK platform to advertise; unfortunately, advertisers who are based abroad are under no obligation to act in accordance with the UK Codes of Advertising that we administer.

However, you may be interested to know that we have an agreement with a European-wide (and beyond) alliance of advertising regulators, EASA, and will therefore refer the matter to our counterparts in Ireland for consideration.

Ah, national regulators always seem to have a problem with international businesses! Well, let's see what the ASA Ireland have to say...

The function of the Advertising Standards Authority for Ireland is to ensure that advertisers comply with the requirements of the Code of Standards for Advertising, Promotional and Direct Marketing in Ireland and to investigate complaints concerning advertisements that may be considered to be in breach of the Code.

We have reviewed your complaint referred to us by the ASA in the UK. The Code applies to advertisements carried in the media (e.g. press, radio, television, cinema, brochures, direct mail, etc.) and to promotions and promotional material. Our Code does not cover data protection issues. These issues are covered by the Data Protection Commissioner in Ireland. The Data Protection Commissioner has responsibility for enforcing legislation which deals with unsolicited marketing. If you wish we can refer your complaint to them directly ...

Ok... being passed from pillar to post here. Nevertheless, I've asked them to refer the complain to the DPC in Ireland.

In the meantime, let's see what the UK's Information Commissioners Office has to say...

I fully appreciate your concern regarding this, especially that you are still receiving the spam after two years.

The emails that you are receiving are covered by regulation 22 of Privacy and Electronic Communications Regulations 2003(PECR). In regulation 22 of PECR, an organisation cannot transmit, or instigate the transmission of, unsolicited marketing material by electronic mail to an individual subscriber unless they have previously notified them, the sender, that they consent, for the time being, to receiving such communications.

The data protection act 1998(DPA) gives rights to individuals. One of the rights is that an individual can request an organisation to stop using their details for direct marketing, this is covered by section 11 of the DPA. This is known as a section 11 notice. To exercise this right an individual needs to write to an organisation to advise under the DPA they wish for their personal data not to be used for direct marketing. We expect that in normal circumstances electronic communications should stop within 28 days of receiving the notice. If, after a reasonable time, the email do not stop, you are able to enforce your right via a Court of Law, on your own behalf. You can also ask this office to look into the matter.

If an individual wishes to report a concern to the Information Commissioners Office(ICO), the individual must bring the concern to the ICO within 3 months of receiving the final response from the organisation the concern is about.

For us to consider a concern we would need a completed report a concern form, a copy of your letter to the organisation, and their response, (if they have responded), and a copy of any other supporting evidence in relation to the issues you have raised.

sigh OK, time to fill in yet another form!

I hope you appreciate all this hard work, dear reader - I do these things so you don't have to ?

Talking about SMS Spam with Radio 4

@edent — Tue, 05 May 2015 10:49:09 +0000

Earlier this week I appeared on BBC Radio 4's "You And Yours" to talk about the scourge of SMS Spam.

You can listen to it on their website - or, if it has expired, I've grabbed an audio clip for your listening pleasure.

🔊

💾 Download this audio file.

I've asked the Direct Marketing Associate to create a "Do Not Text" list - so that people can opt-out of spam SMS. They already operate the Mail Preference Service and the Telephone Preference Service for opting out of junk mail and calls.

The DMA argues that there's no need for such a service because spam SMS are already illegal. That strikes me as odd. It is quite clear that there are networks of personal data brokers who are careless with your personal data. Creating a universal suppression file would allow text marketers to be sure that they are not inadvertently breaking the law.

The DMA know that there's a problem with SMS Spam - they have a whole page dedicated to it!

The DMA offers a service to opt-out of spam faxes! Surely it can't be beyond their wit to create a similar system for text messages, can it?

If you've received a Spam SMS, please complain to the DMA and ask them to add SMS to their list of preference services.

Dealing with SMS Spam from @PaddyPower

@edent — Wed, 29 Apr 2015 10:04:03 +0000

This is a cautionary tale of how my personal details have been repeatedly sold and resold by a British network of spammers - each of them turning a blind eye to the provenance of their data. I'm calling on the Direct Marketing Association to create a universal opt-out file - just like they do with junk mail and nuisance calls - to prevent people receiving spam via SMS.

Like lots of people, I awoke on Sunday morning to a spam SMS seemingly sent on behalf of the gambling firm Paddy Power

So, being the fearless spambuster that I am, I decided to investigate from where they sourced my name and number.

Who Sent This?

I spoke to Paddy Power on Twitter and via their complaints team. They were adamant that it was not sent from them.

The SMS shortcode 64446 is run by AQL - a bulk SMS provider.

The site padd.pw was registered by Glaswegian firm Digitonic. The website is pretty crappy, but does give us a few clues.

There's an image telling people to contact Data Media and Research DMRi The email address is not clickable.

Finally, by looking at the source code of the side, we can see a Paddy Power affiliate link.

It looks like the owners of the site are spamming people in the hope of earning affiliate revenue from PaddyPower. Could this be part of the same gambling affiliate spam operation discovered by Andrew Walsh?

Where Did They Get My Details?

I started by contacting DMRi - the company who said they could provide me with the information. An email to them went unanswered, so I picked up the phone.

As soon as I said that I was calling to find out where they got my details, they gave a weary sigh and asked if it was complaining about a gambling SMS. They agreed to remove me from their list ("it may take 28 days") and said they'd call later to confirm which data broker sold my data to them.

A few hours later they rang back. They confirmed that it was Digitonic which had sent the spam SMS, but claimed that DMRi hadn't supplied my data.

So, I rang Digitonic. The MD, Grant Fraser, was very pleasant and was adamant that his company had a "zero tolerance" approach to spam. All their data, he repeatedly said, came from reputable data brokers. In this case, my details were supplied by "Datatonomy" - he assured me that Datatonomy had promised that all the data came from opt-in methods.

I asked Grant why the message showed as coming from PADDYPOWER when Paddy Power insisted it didn't come from them.

I quoted the ICO guidance:

You cannot transmit, or instigate the transmission of, any marketing by electronic mail (whether solicited or unsolicited) to any subscriber (whether corporate or individual) where:
Your identity has been disguised or concealed;
Information Commissioner’s Office Spam Guidance

Digitonic told me that their end client was Paddy Power! Had the bookies lied to me? Heaven forbid...

As Datatonomy don't have any public contact details, Grant said he'd get them to ring me.

While I waited for the call from Datatonomy, I looked up what is meant by an "opt-in." I can categorically state that I haven't given Paddy Power my name and number directly. So, we move to what the industry calls the "soft opt-in" - had I given someone my details and allowed them to be passed on to a third-party?

This shouldn't matter:

You may send or instigate the sending of electronic mail for marketing purposes to an individual subscriber where:

you have obtained the contact details of the recipient in the course of a sale or negotiations for the sale of a product or service to that recipient;

the direct marketing material you are sending relates to your similar products and services only;
If you satisfy these criteria, you do not need prior consent to send marketing by electronic mail to individual subscribers. If you cannot satisfy these criteria, you must not send marketing by electronic mail to individual subscribers without their prior consent. Information Commissioner’s Office Spam Guidance

I've not been negotiating with any gambling companies that I can think of. So how can this message possibly be legal?

I tried to get in contact with Stuart Murgatroyd who appears to run Datatonomy - he wouldn't return my messages so I gave him a phone call.

Once again, he denied that what he was doing was spamming. He merely aggregates data feeds and acquires contact details that way. He was convinced that I had somehow opted-in to third party marketing. Although it would take some time for him to look up my details.

I pointed out that ICO don't accept that as a valid reason to send spam:

If you buy or rent a marketing list you must perform your own due diligence checks to satisfy yourself that the details were obtained fairly and lawfully, that the individuals understood their details would be passed on for marketing purposes, and that you have the necessary consent for your marketing.
You should take extra care if you are using a bought-in list to send marketing texts or emails or to make automated calls. You must have very specific consent for this type of marketing, and indirect consent (ie generic consent originally given to another organisation) will not always be enough.
Information Commissioner’s Office Spam Guidance

Stuart faithfully promised to get to the bottom of this and agreed to call me back.

In the meantime, Paddy Power admitted that the spam was sent on their behalf:

A day later, and I was one step closer to the source of the spam. Datatonomy had obtained my details from DBS Data.

Based on the postcode they held on file, my phone number was obtained over 8 years ago!

Now... Why does the name DBS Data seem familiar to me....?

Oh yes! In 2013 DBS Data sold my details to a different gambling provider! If you read that blog post, you can see that I had previously asked DBS to remove my data from their systems.

At this point, I have fairly strong proof that this is spam. Even if, prior to 2007, I had accidentally opted-in to these messages I've subsequently opted-out.

While I waited for DBS to answer my emails and phone calls, I amused myself by reading the ICO's detailed guide to direct marketing.

93. As a general rule of thumb, if an organisation is making contact by phone, text or email for the first time, we would advise it not to rely on any indirect consent given more than six months ago – even if the consent did clearly cover that organisation.
…
95. Organisations should therefore make sure that they keep clear records of exactly what someone has consented to. In particular, they should record the date of consent, the method of consent, who obtained consent, and exactly what information was provided to the person consenting. They should not rely on a bought-in list unless the seller or list broker can provide these details. Organisations may be asked to produce their records as evidence to demonstrate compliance in the event of a complaint.
Direct Marketing Guidance (PDF)
Emphasis added.

Each organisation in the chain - Paddy Power, Digitonic, Datatonomy, DBS Data, and USM Digital have obviously failed to check whether my details were recent or opted-in.

Odd, when you consider DBS Data's stated passion for targeted communications...

Finally, I got a call back from DBS. Despite promising to suppress my number from future marketing text, an "unfortunate error" meant that Datatonomy never received that instruction.

A Pattern Of Abuse

This all follows a depressingly familiar pattern. The previous spam messages I've investigated - Coral Gambling spam and Floors2Go spam - are all caused by companies deliberately failing to do due diligence.

Paddy Power want to send out marketing messages. They get a company like Digitonic to source the numbers so Paddy Power can, in good faith, say "we asked a reputable company."

Digitonic doesn't have the capacity to supply high quality leads, so they subcontract to "reputable firms" like Datatonomy.

Dataonomy scrape from a variety of bottom-feeders like DBS and then claim to have ensured consent.

DBS dig old data out of their rubbish bins - provided by a company called USM Digital - they then spray it with deodorant, and try to pass it off as fresh.

Paddy Power then spam people - all the while claiming that they had no way of knowing that the recipients hadn't opted in.

A Little History

Incidentally, this "padd.pw" spam has been ongoing for a while - and Paddy Power don't seem to have any interest in putting a stop to it.

Complaining

I have lodged complaints with the following bodies - if you've received this or similar spam, I suggest you do the same. Remember, this sort of spam only flourishes because regulators aren't receiving enough complaints.

Hopefully at least one of them will be able to take action against these spamming twunts.

Going Forward

No one wants to receive junk SMS. Companies don't want to waste time and money sending to hostile recipients. The Direct Marketing industry knows that its reputation is unsanitary.

What the Direct Marketing Association needs to do is create a Universal Opt Out service. Allow people to register their details so that DMA members know not to spam mobiles with unwanted messages.

At the moment, people have to reactively track down the source of the problem - and not everyone is as obsessive as I am!

Every company involved in this spam network are acting in a way many would consider to be utterly negligent.

The DMA must ensure that its members aren't allowed to get away with such a lax attitude to people's personal details.

Donating via SMS - using QR Codes

@edent — Mon, 07 Jul 2014 10:45:37 +0000

One of the greatest cultural achievements of the last Labour Government was making museum entry free for everyone.

Whether you're rich, poor, British, foreign, young, old - you can enjoy the treasures of our museums and galleries.

Of course, while museums are funded by the state, they still rely on generating some external revenue - hence the ubiquitous gift shop and major corporate donations.

In the front of most museums, you'll find a vessel for collecting donations. Usually half full with pound coins, Euros, and Dollars. On entering the British Museum recently, I saw a new way to donate - QR codes!

Let's take a closer look at that code:

If you scan it, your QR reader should prompt you to send a Premium Rate SMS to 70070 - a charity donation service run by Just Giving.

Just about anyone with a UK SIM will be able to send a fiver - no messing about with passwords, logging in, credit card numbers - it comes straight off the phone bill.

Setting It Up

It's really very easy to use the SMS feature of QR codes. Assuming you've already got a number which can receive messages, you simply need to enter this text into your QR code:

SMSTO:07700900617:Hello

Which will appear as:

Scan it and you QR scanner should open up your SMS app, and you can choose whether to send or not.

So, there you go! A really simple way to turn QR codes into donations using the ubiquitous SMS.

Stopping Coral's SMS Spam

@edent — Wed, 04 Dec 2013 12:02:08 +0000

I don't like spam. I'm very careful always to tick the "do not pass my details on to 3rd parties" box on forms. So, when I do get SMS spam, I like to know who has been flouting the rules. See my previous investigation.

A few weeks ago, I received this rather annoying message:

I'm not a gambler - and I've never had a business relationship with Coral. So why are they sending me this tripe? I took to Twitter to find out.

I spoke to customer care who were utterly bemused as to why I'd received this. They promised to look into it.

DBS

A few days later I got a voicemail from Martin Johnson of DBS Data. Run out of a small industrial estate in Chelmsford, DBS Data offers bulk SMS services as well as junk mail and email.

DBS finally got back to me about how my number ended up with them.

Following your recent communication I can confirm that we have removed your details from our systems and, following any pending client campaigns within the next 28 days, your details will not be used again by DBS for any of our clients. Your information was provided to us by the below organisation who you may wish to contact. USM Digital 2, Greswolde House 197b Station Road Knowle Solihull West Midlands B93 0PU Tel: 0156 482 2633 http://www.usmdigital.co.uk/

Right, onwards!

USM Digital

As far as I can tell, USM Digital is a very small business run by Mark Reohorn, Mark was quick to answer the phone, and promised that he'd get back to me that afternoon.

Two days later I received a phone call from "Dana" from USM. You can take a listen to a excerpt:

🔊

💾 Download this audio file.

According to Dana, my number had been gathered by them in August 2007. That's six-and-a-half years ago. I didn't think to ask if they knew I was still using the number. Most people would change numbers several times over that time period.

I've no real way of knowing if I did opt-in or opt-out of sharing my numbers in that glorious summer of old. I'll be generous and say that it is entirely possible that I gave my phone number to what I thought was an insurance company - but I don't think that means the number should be spammed over six years later for unrelated goods.

Back To Basics

It should be incumbent on all of these parties to check the data they're using.

Coral told me they bought the data in good faith from DBS. I assume they said "give us verified numbers of men aged 24-32 who met criteria X, Y, Z."

I imagine that DBS - not having a suitable quantity of data - then went off to another supplier and said "Give us something vaguely suitable - the mugs at Coral will never know the difference."

USM Digital, it would appear, dragged out data from half a decade ago, dusted it off, and then spun it as numbers who had adequately given consent.

And, with that, Coral end up spamming people who never asked to have their numbers shared with a company which helps drug dealers launder money.

SMS marketing can be a powerful tool in the right hands. In this case, Coral comes across as indiscriminate spammers who don't care about the provenance of their marketing data. DBS are a broker who have to rely on dodgy 3rd party suppliers. USM's data is so out of data that it may as well be useless.

Remember, if you receive spam SMS please report them to the Information Commissioner's Office. If you can find who has supplied your number, ringing them up and having a friendly word with them about their spamming practices is very cathartic!

Text Adventures Via Text Message

@edent — Fri, 14 Jun 2013 10:55:20 +0000

Remember text adventures, eh? They were pretty nifty!

"You are in a maze of twisty little passages, all alike"
>Go East
"You have been eaten by a Grue. A dwarf starts singing about gold"

Smashing! Just like the pictures are better on the radio, so the graphics are immeasurably superior when they're in your head. Don't get me wrong, I love the 5.1 surround sound snarl of a rabid beast rendered in 1080p - but nothing is quite as good as using your imagination.

Text Adventures - or, more properly, Interactive Fiction - is enjoying a mini-renaissance at the moment. There are emulators for smart phones, computers, and consoles.

But for SMS? None that I could find. Think about it; SMS is close to the perfect medium for Interactive Fiction. Your commands are concise enough to fit into a single message, you don't have to worry about the speed of your response, everything is text based.

So, I present to you, Zork via SMS (with a little help from Twilio).

Brilliant!

HOWTO

Although superficially a simple project, there are a few gotchas along the way. This documentation is mostly for me - but may be of use to you :-)

Let's start at the end.... Using Twilio you can send an SMS to a phone number, that is then POSTed to a webserver of your choice.

Twilio will send an SMS back if it receives a response such as



  You are in an open field west of a big white house with a boarded
front door.
There is a small mailbox here.

Easy enough. (NB the free account prepends your messages with a trial message. Once you pay, that goes away.)

So, how do we get a text adventure like Zork running server side? There are plenty of client side emulators out there - but I only found one which was purely server side.

THCnet have a PHP interpreter for Zork. It's slightly cludgy - but it works. I'm checking to see if I can distribute it on GitHub.

The game library "dtextc.dat" must be installed in "/usr/games/lib/". The source code is available if you want to recompile it and place it somewhere more accessible.

A MySQL database needs to be created to keep track of users and sessions.

A temporary directory (which must be readable and writeable) will also be needed to store the state of play for each session. I've used "tmp/404/" but you can alter config.php to point wherever is convenient. You will also need to adjust index.php and functions.php with the new location.

Finally, the executable "zork" must be runable.

That's pretty much it.

When a user (or, in this case, Twilio) first makes a request to the URL, we check to see if they already have a session cookie. If they don't, create one, and start the game by returning the opening text.

For every subsequent connection, we check the state of the game based on their cookie, then apply the body of their SMS to the game engine. Whatever Zork spits out, we return as an SMS.

By default, Twilio kills unused sessions after 4 hours, and all cookies will be lost.

Where Next?

It strikes me that the various forms of text adventures are excellent as a sort of mini-IVR. A nice little finite-state-machine which can quite happily run for years. Services like Frontline SMS are great for information sharing, but they're really not designed for this sort of work.

Could we use interactive fiction in places where SMS is cheap but other forms of entertainment are expensive? Could IF be used to augment existing media events? SMS is lowest common denominator - even iPhones can use it.

But, for now, all I have to worry about is someone texting me "Go west'); DROP TABLE ..." ;-)

Protecting Against Credit Card Scams

@edent — Mon, 09 Jul 2012 12:26:24 +0000

I recently read about an innovative telephone call scam.

A scammer rings the mark and asks for her credit card details. If the mark refuses, the scammer tells her to hang up the phone, then dial 999 and ask for "Sergeant Scammer of the Fraud Squad".

The mark does so, and is connected to what they assume is the emergency services. However, because the scammer hasn't hung up at their end, the call is still active. So the mark isn't speaking to 999, but to the scammer.

Pretty devious. Luckily, it can't work on mobile. But it got me thinking - how could you get someone to give you credit card details over the phone? I'm inspired by both Bruce Schneier's "Movie Plot Threat" competitions and Kevin Mitnick's work on Social Engineering.

Trying to think like "the enemy" is a crucial part of understanding how nefarious people can exploit a situation. I think it should be considered the seventh "thinking hat".

The Goal

I want the victim to willingly give me her credit card details. I do not want her to be suspicious or report my activity to the police.

The Strategy

The victim receives a text on her phone.
"Your Barclay's credit card (starting 4304) was recently used to buy £2,103.54 worth of goods in China. If you wish to dispute this transaction, please call 0113 496 0123."
The victim checks her BarclayCard - it does start 4304. Damn! She rings the number.
"Welcome to the BarclayCard fraud line," says the voice at the other end.
"To protect your security, please type in your sixteen digit card number," says the automated voice. So that's what the victim does.
... after typing in several more details, the victim finally gets through to the scammer.
At this point, the scammer can attempt to get more information - such as home address - or simply assure the victim that the fraud has been reported.
"Unfortunately," the fraudster says, "the £2,103.54 will show up on your July statement. But you will see the refund on the August statement."

How It Works

There are a number of factors which go into making this a potentially successful scam.

People are quite used to receiving texts from their card issuer.
It's quite common to be asked to confirm a suspicious transaction.
Credit cards number have a predictable start sequence. That's why credit card receipts often show you only the last few digits. This tricks the victim into thinking that the scammer knowa two crucial pieces of information; the credit card issuer and the credit card number.
We're trained not to give details to strangers who ring us up. By contrast, we're expected to give details to people when we ring them!
You can't argue or otherwise interrogate an IVR. You either have to give that disembodied voice your details or hang up.
Again, we're quite used to typing in our credit card details and then pressing the hash key!
If we do get through to a real person, the standard Social Engineering tricks all apply. Only, in this case, not only is the victim worried about the potential fraud, she has also primed herself into thinking she's speaking with her credit card provider.
At this point, the scammer knows that they can use the card for a fraudulent purchase and the victim won't report it! It will only be after two statements have been received that the victim will notice that she hasn't been refunded.

Problems

Now, this fraud isn't without issue. The most notable being that you do not know who has a credit card issued by a specific provider. The scammer would either need some third party intelligence that their victims all use HSBC, or they could just go on a phishing expedition. Spam a few thousand numbers and there will bound to be a few which have the card which is being targeted.

How To Do It

Using services like Twilio and Tropo, it's quite easy to create a telephone menu. It can play back a recorded voice, save all the user's keypresses, then pass the call on to the scammer.

They can even handle the automated sending of the text messages, playing back different messages depending on the caller - "Welcome to HSBC", "Welcome to American Express", etc.

Defending Against This Scam

There are three main strategies for defending against this scam - and they all boil down to trust

Don't Trust An Unknown Phone Number

Save your credit card provider's phone number in your address book. That is the only number you should ring. If someone rings you - tell them that you will take their name and call them back on the official number. If you receive a text - call the official number to check it is legitimate.

Don't Trust Partial Information

The first few numbers of your credit card are fairly generic. Trusting someone who guesses your Visa Electron starts with "4197" is like trusting a psychic who says "You were a bit of a handful growing up, especially in your teens." It's such general information as to be worthless.

Don't Trust The Other Person

I sometimes act deviously. When asked to give my address, I'll give an incorrect house number or post code. If the person at the other end doesn't pick up on the mistake, I assume I'm talking to a scammer. Similarly, you don't have to trust interactive menus. You can input incorrect information, and see if it is accepted without complaint - a sure sign of a scam. Or see if it gets you through to a human.

Is This Scam Possible?

One hurdle is targeting enough people who have the "correct" credit card. The scam would work without the credit card info, but may be less effective.

The cost of sending out the texts is also a constraint. Although text bundles are relatively cheap now.

Shutting down the numbers - or tracing them - is perhaps the biggest issue. Buying a disposable pre-pay SIM is virtually anonymous. A landline number is probably fairly easy to trace - assuming the police have the time and staffing levels to investigate such a scam.

And that may be the deciding issue. If someone reports a suspicious text to the police or their credit card provider, how quickly can the number be shut down? If the scammer is sending out hundreds of fraudulent SMS an hour, it would only take a few responses to make the scheme worthwhile.

Disclaimer

Naturally, you should not attempt this. The penalties for credit card fraud a very serious. This is intended as a thought experiment.

If you want people to willingly give up their credit card information - take a look at the morons on Twitter posting photos of their cards!

SMS PDU in Python for Raspberry Pi

@edent — Wed, 27 Jun 2012 14:09:05 +0000

Cracking on with my Raspberry Pi, I've written my first program in Python.

The aim - to be able to send an SMS via a 3G USB dongle. The problem - the way SMS needs to be encoded is hideously complicated.

For example, suppose you want to send "This is a very simple message :-)" to the phone number +447700900123.

This is the command that you need to send to your dongle:

AT+CMGS=42
079144872000626001000C9144770009103200112154747A0E4ACF416190BD2CCF83E6E9369C5D06B5CBF379F85C06E95A29

WHAT? THE? JUDDERING? FUCK?!

I found an excellent JavaScript PDU tool - which I have adapted. Also of great help was Lars Pettersson's PDU explanation and Jeron's discussion of the SMS PDU. I would have been totally lost without them.

Python is already pre-installed on the Raspberry Pi - which is handy. So here is a tool I whipped up which will generate the above gibberish.

Running the program should show this:

Which phone number do you want to send an SMS to? (e.g. +447700900123) :
What message do you want to send? :
For FLASH SMS, type 0. For regular SMS, type 1 :
Which SMSC will you use? (e.g. +447802002606) :

And will output this:

AT+CMGS=60
079144872000626001000C91447700091032001035493328FFAE83D0617B19442E8FDFE432194447A7E72C50FE5D07A1C3F632E8FE7683C2A0B3BC1CA683E0F2B4BE1C02

The source is on GitHub - or please find in below for your edification and delight.

This is my first outing in Python, so I'm sure I've made a few syntactic and stylistic mistakes. Any corrections gratefully received.

# This Python file uses the following encoding: utf-8
"""
© 2012 Terence Eden

Adapted from http://rednaxela.net/pdu.php Version 1.5 r9aja
Original JavaScript (c) BPS & co, 2003. Written by Swen-Peter Ekkebus, edited by Ing. Milan Chudik, fixes and functionality by Andrew Alexander.
Original licence http://rednaxela.net/pdu.php "Feel free to use this code as you wish."

Python version © 2012 Terence Eden - released as MIT License
***
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
***

Note - this is my first Python program - I am quite happy to be corrected on True Pythonic Style etc. :-)
"""

"""
This program allows the user to craft a PDU when sending an SMS.
The user enters the destination number, the message, the class, and the SMSC.
The program generates the commands needed to instruct a modem to deliver the SMS.
"""

# Array with the default 7 bit alphabet
# @ = 0 = 0b00000000, a = 97 = 0b1100001, etc
# Alignment is purely an attempt at readability
SEVEN_BIT_ALPHABET_ARRAY = (
    '@', '£', '$', '¥', 'è', 'é', 'ù', 'ì', 'ò', 'Ç', 'n', 'Ø', 'ø', 'r','Å', 'å',
    'u0394', '_', 'u03a6', 'u0393', 'u039b', 'u03a9', 'u03a0','u03a8', 'u03a3', 'u0398', 'u039e',
    '€', 'Æ', 'æ', 'ß', 'É', ' ', '!', '"', '#', '¤', '%', '&', ''', '(', ')','*', '+', ',', '-', '.', '/',
    '0', '1', '2', '3', '4', '5', '6', '7','8', '9',
    ':', ';', '< ', '=', '>', '?', '¡',
    'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
    'Ä',                                                                  'Ö', 'Ñ',                     'Ü', '§', '¿',
    'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
    'ä',                                                                  'ö', 'ñ',                     'ü',
    'à')


def semi_octet_to_string(input) :
    """ Takes an octet and returns a string
    """
    out = ""
    i=0
    for i in range(0,len(input),2) : # from 0 - length, incrementing by 2
        out = out + input[i+1:i+2] + input[i:i+1]
    return out


def convert_character_to_seven_bit(character) :
    """ Takes a single character.
    Looks it up in the SEVEN_BIT_ALPHABET_ARRAY.
    Returns the position in the array.
    """
    for i in range(0,len(SEVEN_BIT_ALPHABET_ARRAY)) :
        if SEVEN_BIT_ALPHABET_ARRAY[i] == character:
            return i
    return 36 # If the character cannot be found, return a ¤ to indicate the missing character

# Set the initial variables
FIRST_OCTET = "0100" # MAGIC
PROTO_ID = "00" # MORE MAGIC
data_encoding = "1" # EVEN MORE MAGIC
message_class = "" # Message Class. 0 for FLASH, 1 for normal
SMSC_number = "" # The message centre through which the SMS is sent
SMSC = "" # How the SMSC is represented once encoded
SMSC_info_length = 0
SMSC_length = 0
SMSC_number_format = "81" # by default, assume that it's in national format - e.g. 077...
destination_phone_number = "" # Where the SMS is being sent
destination_phone_number_format = "81" # by default, assume that it's in national format - e.g. 077...
message_text = "" # The message to be sent
encoded_message_binary_string = "" # The message, as encoded into binary
encoded_message_octet = "" # individual octets of the message

# Get the user inputs. No error checking in this version :-)
get_destination_phone_number = raw_input("Which phone number do you want to send an SMS to? (e.g. +447700900123) : ")
get_message_text = raw_input("What message do you want to send? : ")
get_message_class = raw_input("For FLASH SMS, type 0. For regular SMS, type 1 : ")
get_SMSC_number = raw_input("Which SMSC will you use? (e.g. +447802002606) : ")

# TODO Error check & sanitize input
destination_phone_number = get_destination_phone_number
message_text = get_message_text
message_class = int(get_message_class)
SMSC_number = get_SMSC_number

# Set data encoding
data_encoding = data_encoding + str(message_class)

# Get the SMSC number format
if SMSC_number[:1] == '+' : # if the SMSC starts with a + then it is an international number
    SMSC_number_format = "91"; # international
    SMSC_number = SMSC_number[1:len(SMSC_number)] # Strip off the +

# Odd numbers need to be padded with an "F"
if len(SMSC_number)%2 != 0 :
    SMSC_number = SMSC_number + "F"

# Encode the SMSC number
SMSC = semi_octet_to_string(SMSC_number)

# Calculate the SMSC values
SMSC_info_length = (len(SMSC_number_format + "" + SMSC))/2
SMSC_length = SMSC_info_length;

# Is the number we're sending to in international format?
if destination_phone_number[:1] == '+' : # if it starts with a + then it is an international number
    destination_phone_number_format = "91"; # international
    destination_phone_number = destination_phone_number[1:len(destination_phone_number)] # Strip off the +

# Calculate the destination values in hex (so remove 0x, make upper case, pad with zeros if needed)
destination_phone_number_length = hex(len(destination_phone_number))[2:3].upper().zfill(2)

if len(destination_phone_number)%2 != 0 : # Odd numbers need to be padded
    destination_phone_number = destination_phone_number + "F"

destination = semi_octet_to_string(destination_phone_number)

# Size of the message to be delivered in hex (so remove 0x, make upper case, pad with zeros if needed)
message_data_size = str(hex(len(message_text)))[2:len(message_text)].upper().zfill(2)

# Go through the message text, encoding each character
for i in range(0,len(message_text)) :
    character = message_text[i:i+1] # get the current character
    current = bin(convert_character_to_seven_bit(character)) # translate into the 7bit alphabet
    character_string = str(current) # Make a string of the binary number. eg "0b1110100
    character_binary_string = character_string[2:len(str(character_string))] # Strip off the 0b
    character_padded_7_bit =  character_binary_string.zfill(7) # all text must contain 7 bits
    # Concatenate the bits
    # Note, they are added to the START of the string
    encoded_message_binary_string = character_padded_7_bit + encoded_message_binary_string


# Reverse the string to make it easier to count
encoded_message_binary_string_reversed = encoded_message_binary_string[::-1]

# Get each octet into hex
for i in range(0,len(encoded_message_binary_string_reversed),8) : # from 0 - length, incrementing by 8
    # Get the 8 bits, reverse them back to normal, if less than 8, pad them with 0
    encoded_octet = encoded_message_binary_string_reversed[i:i+8][::-1].zfill(8)
    encoded_octet_hex = hex(int(encoded_octet,2)) # Convert to hex

    # Strip the 0x at the start, make uppercase, pad with a leading 0 if needed
    encoded_octet_hex_string = str(encoded_octet_hex)[2:len(encoded_octet_hex)].upper().zfill(2)

    # Concatenate the octet to the message
    encoded_message_octet = encoded_message_octet + encoded_octet_hex_string

# Generate the PDU
PDU = str(SMSC_info_length).zfill(2)
        + str(SMSC_number_format)
        + SMSC
        + FIRST_OCTET
        + str(destination_phone_number_length)
        + destination_phone_number_format
        + destination
        + PROTO_ID
        + data_encoding
        + str(message_data_size)
        + encoded_message_octet

# Generate the AT Commands
AT_CMGS = (len(PDU)/2) - SMSC_length - 1
AT_COMMAND = "AT+CMGS=" + str(AT_CMGS)

# Show the commands
print AT_COMMAND
print PDU

The source is on GitHub.

In order to actually send the SMS, you will need to put the modem into PDU mode, this is done by the command

AT+CMGF=0

So, as per my earlier post on sending SMS, the complete sequence is

AT+CMGF=0
AT+CMGS=60
07914487...

Then press CTRL+Z to send.

Raspberry Pi and Frontline SMS

@edent — Sun, 24 Jun 2012 00:00:56 +0000

(I think I'm the first person to try this - so I decided to document the process.)

A few weeks ago, I won a Raspberry Pi at the #OTA12 hackday. It arrived on Friday, so I thought I would turn it into an SMS server using the incredible FrontlineSMS.

0. Setting up the Pi

This is the easy part. Follow the excellent guide on the eLinux wiki. Essentially, download the Debian image, extract, and dd it onto an SD card.

The hardest part was finding a full sized SD! In the end, I found an old adapter and stuck in a 2GB micro SD card.

1. First Boot

My first boot was a failure. Nothing appeared on the screen. So, I switched off the power, unplugged every lead, plugged them back in, and powered it on. Success!

The first thing I did was ensure the operating system was up to date.

Check for updates:

sudo apt-get update

Then, apply those updates

sudo apt-get upgrade

This took a few minutes.

Finally, set up SSH or VNC if you plan on using the machine remotely.

2. Dongle Hardware

FrontlineSMS maintains a list of USB dongles which work with its service. I used a Vodafone branded Huawei E220. Sold as Vodafone K3565 The Raspberry Pi only has 2 USB slots - the dongle was slim enough not to interfere with the other USB cable, but it did mean I could only run either a keyboard or a mouse without using a hub. It's recommended that you use a powered USB hub - although my keyboard and mouse didn't seem to draw too much power.

3. Frontline SMS

Downloading Frontline SMS via the commandline (using v1.6 because v2 isn't ready for Linux yet)

wget http://frontlinesms.com/download/secure/FrontlineSMS-distribution-1.6.16.3-linux_i686-dist.zip

Unzip

unzip FrontlineSMS-distribution-1.6.16.3-linux_i686-dist.zip

Run

cd FrontlineSMS-distribution-1.6.16.3
./FrontlineSMS.sh

Gave an error - FrontlineSMS requires Java.

4. Installing Java

The Java install takes about 140MB of disk space. After downloading and extracting FrontlineSMS, I only had about 220MB of free space. I deleted the FrontlineSMS zip file and had 234MB free. Just about enough room!

sudo apt-get install openjdk-6-jdk

Wait several minutes and you'll be good to go.

5. Running for the First Time

Frontline SMS requires a GUI.

Running a GUI is as easy as typing

startx

The resolution was set at the slightly odd dimensions of 1264*672 - which meant there was a large black border around the screen.

Open a terminal (Start, Accessories, LXTerminal, then type

cd FrontlineSMS-distribution-1.6.16.3
./FrontlineSMS.sh

After several minutes of waiting, FrontlineSMS started!

However, no matter what I tried, I couldn't get FrontlineSMS to detect the dongle. The OS could see it fine (using "lsusb" and "dmesg"), but it just didn't appear to be detected by FrontlineSMS.

A delve into the commandline, showed this error:

librxtxSerial.so: cannot open shared object file: No such file or directory
(Possible cause: can't load IA 32-bit .so on a ARM-bit platform)
thrown while loading gnu.io.RXTXCommDriver

6. Installing the Correct Libraries

We need to load the correct (ARM) version of rxtx.

sudo apt-get install librxtx-java

Find where the install process has dumped it

find . -name "librxtxSerial.so"

It should show you two location - the first being where the correct version is, the second where the FrontlineSMS version is.

./usr/lib/jni/librxtxSerial.so
./home/pi/Desktop/FrontlineSMS-distribution-1.6.16.3/librxtxSerial.so

All we need to do is overwrite the incorrect version.

cp /usr/lib/jni/librxtxSerial.so /home/pi/Desktop/FrontlineSMS-distribution-1.6.16.3/

Then, run

./FrontlineSMS.sh

And, after some warnings and waitings, you should see

Hey Presto! FrontlineSMS up and running on a Raspberry Pi!

(Oh! I finally worked out how to do screenshots! install scrot and run "scrot -d 10" to take a screenshot after 10 seconds.)

7. Manually Sending an SMS

Running FrontlineSMS via Java on a 700MHz ARM device is very slow. It is possible to talk directly to the dongle and manually tell it to send SMS.

First, I installed picocom.

sudo apt-get install picocom

To find out where the dongle has been installed, type:

dmesg

Which will give an long output, which should contain some text like this like this:

option 1-1.2:1.1: GSM modem (1-port) converter detected
usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB0
option 1-1.2:1.0: GSM modem (1-port) converter detected
usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB1

The dongle installs itself in two places - ttyUSB0 & 1. It's the first one we want.

Connect by issuing this command

picocom /dev/ttyUSB0 -b 115200 -l

Which will give you the output

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
escape is      : C-a
noinit is      : no
noreset is     : no
nolock is      : yes
send_cmd is    : ascii_xfr -s -v -l10
receive_cmd is : rz -vv

Terminal ready

From now on in, we're typing commands directly into the dongle. You cannot press the delete key! Copy & paste, or be careful when typing!

First, to make sure everything is working, we type

AT

We should see this response

OK

Next, set the dongle to text mode

AT+CMGF=1

Again, the response should be

OK

Let's send our first SMS!

AT+CMGS="+447700900123"

This will not say "OK", rather, it will prompt us to type a message

Type your message, so the screen looks like

> This is a test

DO NOT HIT ENTER. Instead, hit CTRL and Z at the same time.

You should see a response like

+CMGS: 193

OK

The number is the "sent items" reference. Within a few moments, the SMS should have been received.

You can send an SMS to the dongle. To check for messages, type the command

AT+CMGL="ALL"

You should see all the messages in the inbox

+CMGL: 0,"REC READ","+447700900000",,"12/06/19,13:53:19+04"
Received
+CMGL: 1,"REC READ","+447700900321",,"12/06/23,17:16:29+04"
Testing
+CMGL: 2,"REC UNREAD","+447700900555",,"12/06/23,23:27:48+04"
This is another test

To quit picocom, hold down CTRL, then hold down A, then hold down X.

Useful Links

A collection of links I found useful when writing this blog post

SMS Spam From PeekabooTV

@edent — Sat, 19 Nov 2011 09:30:22 +0000

I've been investigating some rather nasty SMS spam.

I have finally heard back from Switchfire, the SMS gateway who sent the message.

According to them, the originator of the message was PeekabooTV.com. Take a look round that site - it hasn't been updated since 2007, and the Contact page leads to a 404.

A quick wander into the DNS registration produces this rather stale information:

GPRS Solutions LTD
   David Berney
   11 Gower Street
   London
   WC1E 6HB
   phone: +44.8707414151

So, using the utterly brilliant WhoRunsIt I can get their latest information from Companies House.

GPRS SOLUTIONS LIMITED
MASONS YARD, 34 HIGH STREET
WIMBLEDON VILLAGE
LONDON
SW19 5BY
Company No. 05966632

Why! It's exactly the same as our friends at EKASure! And identical to Peek A Boo TV Ltd. And, indeed, identical to a whole web of companies run by Md Shamimul Haque.

All roads seem to lead back to EKASure. I've contacted them for an explanation - but so far none has been forthcoming.

All very curious. With so many different companies, each supplying domains, redirects and services to each other - all registered out of EKASure... it's almost like they're trying to hide something.

SMS Spammers

@edent — Wed, 16 Nov 2011 12:20:45 +0000

As I've mentioned before, I hate SMS Spam.

Last night, I received this unsolicited message. Now, I can try to unsubscribe using STOP ALL - and I have forwarded the text to VSPAM. But that's not enough for me. I want to stop them sending any more spam SMS to anyone.

Let's do a little ~~stalking~~ investigating and find out what we can.

Who Supplies Their SMS Gateway?

The people who provide the SMS gateway services ought to do a better job of policing who uses them.

PhonePayPlus allows us to look up any SMS short code and see to whom it belongs.

We can quickly see that the people responsible for sending the message are

Switchfire Ltd
2nd Floor
66 Wilton Road
London
SW1V 1DE
Tel: 020 7798 2800
support@switchfire.com

I rang them and got them to block my number from their system.

I also asked them where they got my number from - they are going to try and find out.

They wouldn't tell me who they are sending the campaign on behalf of, so I set about trying to find out...

Where Do They Live?

The domain name "hoho.me.uk" redirects to the not-exactly-confidence-inspiring "blablabla.me.uk".

A quick WHOIS gives us

    Domain name:
        hoho.me.uk

    Registrant:
        EKASure

    Registrant's address:
        Masons Yard 34 High St
        London
        UK
        SW19 5BY
        United Kingdom

    Registrar:
        eNom, Inc. [Tag = ENOM]
        URL: http://www.enom.com

    Relevant dates:
        Registered on: 07-Oct-2011

    Name servers:
        dns1.registrar-servers.com

The results are identical for blablabla.me.uk

A little dig around Companies House gets their phone number.

So, the registrant is EKASure of 34 High St, Wimbledon, telephone +44 208 946 6739.

Main URL ekas.co.uk/.

Who Provides Their Web Presence?

Again, from the WHOIS, and a little gentle pinging, we can see who the domains were registered and hosted with.

I've sent some abuse reports.

Other Complaints

PhonePayPlus are the regulators for these services, they have a handy complaints form.

Who Is Behind This?

Although I can't find out who has authorised the sending of these spam messages, it would appear that the person who has registered all these dodgy sites is one "Stephen Clive Hedley Jennings".

Various official filings have him either as "Stephen Jennings" or "Clive Jennings".

Jennings - who is the owner of HotSexChat.info among many others - is the director of several companies.

A phone call to the Ekas offices confirmed that - although they are accountants - they do register domains for some of their clients.

I've dropped Mr Jennings a mail, linking to this blog post, to try and find out more information.

Charity QR Codes - A Missed Opportunity?

@edent — Wed, 11 May 2011 11:07:54 +0000

QR codes are an awesome free resource for charities. Sadly, they are often misused. Charities can use them to drive SMS donations - here's a quick example of how this works.

Sightsavers

Sightsavers is an incredible charity, working hard to combat blindness in developing countries. I'm picking on them only because their poster caught my eye this morning. It's an effective poster with a strong call-to-action; "Text now". They've even included a QR code with it.

Due to the proximity of the code to the text, I thought scanning the code would allow me to donate to them.

The Code

The code is well sized and uses a small URL, so it's easily scannable. The only problem is - you guessed it - it redirects to a non-mobile-friendly page. This isn't particularly easy to use, and there's no simple way for a visitor on a mobile to quickly donate to the charity.

It doesn't have to be this way.

Sending SMS via QR Code

The QR specification allows us to request that the scanning phone sends an SMS. The syntax is really simple.

smsto:70800:TALLA

That tell the phone to send the message "TALLA" to the number 70800.

Mobile Badvertising: Floors-2-Go Have Crappy SMS Spam

@edent — Fri, 13 Aug 2010 20:43:02 +0000

UPDATED 08 October 2010

How to unsubscribe

If you want to unsubscribe from this SMS spam, you have three options.

Ring "Dill" on 0121 359 0234 - she works for Floors2Go and will be happy to remove you from the list.
Floors2Go purchased your phone number from tmnmedia - who assured Floors2Go that you were desperately interested in getting SMS spam. Call them on 020 7936 6600. Or call Matt Love 020 7936 6520 - you can also email him on matt.love@tmnmedia.com - Matt was responsible for the SMS "campaign" and is happy for you to email him if you want your number removed.
But that's not all! tmnmedia purchased your number from Scientia Data Call them on 0207 940 9797. At the moment, I've got "Tess" from Scientia looking in to where they got my number from.
10/09/2010 - According to Tess, Scientia data purchased the number from Call Credit. You can call them on 0113 388 4300 - but they'll tell you to email for a "Subject Access Request Form". So, email info@callcreditgroup.com - so, that's what I'm trying next.
08/10/2010 - According to Charlotte Spencer, Call Credit Group don't keep phone numbers on their database. Either Call Credit are lying or Scientia are. The investigation continues.

Remember - if you ring each of them, they'll soon see the value of SMS spam...

Hope that helps.

Original Article

If there's one thing I hate more than SMS spam - it's crap SMS spam.

Let's count the errors in this atrocious attempt at mobile marketing.

Where is my nearest Floors-2-Go store?
What number should I call to find the nearest store?
WHY THE random capitalisation of SOME words?
Grammatical and spelling errors ("UKS" should be "UK's". "upto" should be "up to")
No return number - I can't opt-out nor text them for more information.
No mobile website.
IT'S SPAM! HORRIBLE NASTY EVIL SPAM. The mobile is the only battery powered toy I caress against my face and take to bed with me. It's personal and intimate. If I haven't given you permission to invade my personal space - I'm not going to be best pleased with you.

Look - don't spam people. But if you are going to - at least put some effort. This is a pathetic attempt at engaging the customer.