Cyber Alert: New SMS scam can bypass security, hijack any smartphone

ISLAMABAD: Google has released a new advisory to phone users regarding a rising tide of SMS-based cyberattacks that are able to bypass network-level security and go directly to mobile devices.

According to the company, these attacks take advantage of vulnerabilities in older 2G networks so that scammers can send malicious texts without being detected.

How the Attack Works

The danger arises from portable equipment called SMS blasters or cell-site simulators, which are imitation mobile towers. They are also referred to as False Base Stations (FBS) or Stingrays and have the capability of intercepting cellular signals and sending spoofed text messages that appear to be sent from authentic sources.

After local phones tap into these imposter towers, an attacker can send false messages into the device without going through anti-fraud and anti-spam filters employed by the network provider. The messages usually appear just like legitimate texts, so it is almost impossible for users to realize they have been attacked.

Initially created for espionage, the technology is currently being utilized for massive scams and fraud campaigns that beam messages to thousands of devices within proximity.

2G Networks

All these attacks rely on making smartphones link up with 2G networks, which do not have contemporary encryption and authentication security. By degrading a device from 4G or 5G to 2G, attackers can carry out man-in-the-middle attacks, intercept, and modify unencrypted traffic.

“Downgrading the user’s connection to a legacy 2G protocol exploits the absence of mutual authentication and compels connections to be unencrypted,” Google stated. This enables attackers to send malicious text messages that avoid standard carrier protection.

How to Stay Protected

Google has urged people to turn off 2G connections to shield themselves against such attacks. “Android 12 added a user option to disable 2G at the modem level,” the company stated, adding that this option “completely mitigates the risk from SMS blasters.”

The capability has since been added in Android 16, where Advanced Protection Mode disables 2G networks by default. Samsung has also activated the same level of protection under Maximum Restrictions mode, such that users can deactivate 2G manually.

Harder for iPhones

Apple users have fewer choices. iPhones do not, at the moment, have a built-in option to block 2G connections. Lockdown Mode, which is designed for high-risk users, only disables both 3G and 2G networks, but it also restricts various important functions, so it is not suited for daily use.

Cybersecurity specialists caution that such attacks are increasingly widespread, with fraudsters now aiming at whole locations rather than specific phone numbers. By sending out spurious SMS messages to all devices within proximity, attackers have the capability of targeting thousands of users simultaneously.