{"id":7189,"date":"2021-02-02T10:10:16","date_gmt":"2021-02-02T10:10:16","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7189"},"modified":"2021-03-09T15:24:01","modified_gmt":"2021-03-09T15:24:01","slug":"smishing-text-messages-are-cyber-attacks-on-phones","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/smishing-text-messages-are-cyber-attacks-on-phones\/","title":{"rendered":"The New Frontier: Smishing Text Messages Bring Cyber Attacks to Phones"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7189\" class=\"elementor elementor-7189\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p dir=\"ltr\">You know all about phishing scams via email, and you are careful to never click on a link you don\u2019t recognise. But how careful are you when it comes to messages on your phone? Are you confident that the SMS from the bank, or the link sent to you via WhatsApp from your friend is genuine, and not a smishing text message?<\/p>\n<p dir=\"ltr\">We use our smartphones for pretty much everything. From online shopping to reading the news, booking doctor appointments, or reserving a slot at the post office. People tend to give their phone about 50% of their concentration, skimming messages and tapping on links without thinking about where it will take them. As a result, SMS phishing, or smishing text messages as they are commonly called, are increasing in popularity with cyber attackers as a way of gaining access to individuals\u2019 phones.<\/p>\n<p dir=\"ltr\">And as always, smishing is evolving, moving from traditional SMS text messages to malicious messages on popular apps such as WhatsApp.<\/p>\n<h2 dir=\"ltr\">What are smishing text messages?<\/h2>\n<p dir=\"ltr\">Smishing texts, or SMS phishing, is a form of cyber attack using mobile phones. Smishing text messages are scam messages designed to enable cyber criminals to steal money or identities, or infect a device for a bigger prize. Popular examples of smishing text messages include fake messages from banks requiring urgent action, or offering a limited time deal on an iPhone (for example).<\/p>\n<p dir=\"ltr\">Smishing text messages can do the following:<\/p>\n<p dir=\"ltr\">&#8211; Include a malicious link or attachment that if downloaded could install malicious software onto the victim\u2019s phone.<\/p>\n<p dir=\"ltr\">&#8211; Send victims to a malicious website that asks for personal information including names, date of birth, payment card details, and more.<\/p>\n<p dir=\"ltr\">&#8211; Simply ask the victim to reply with a piece of personal information, payment details, or more.<\/p>\n<h2 dir=\"ltr\">Why are smishing text messages successful?<\/h2>\n<p dir=\"ltr\">Smishing attacks currently appear to be successful in luring victims to interact with them for a number of reasons.<\/p>\n<p dir=\"ltr\">Lack of education about smishing attacks<\/p>\n<p dir=\"ltr\">While there are constant reminders <a href=\"https:\/\/outofsite.biz\/cynance\/10-cyber-security-mistakes-to-avoid\/\">how to recognise a phishing email<\/a>, there is still relatively little information available in company cyber security training schemes or general literature about SMS phishing attacks. As a result, people are less vigilant about smishing text messages, compared to phishing emails.<\/p>\n<p dir=\"ltr\">SMS phishing text messages manipulate their intended victims<\/p>\n<p dir=\"ltr\">Smishing text messages are designed to manipulate the receiver into doing something, usually in a hurry. Smishing texts often include messages such as \u2018urgent\u2019, \u2018act now\u2019, or \u2018don\u2019t miss\u2019.&nbsp;<\/p>\n<p dir=\"ltr\">They also often pose as banks, <a href=\"https:\/\/outofsite.biz\/cynance\/hmrc-investigates-10000-covid-scams\/\">government agencies<\/a>, or even friends or close contacts, creating a false sense of trust that lures their victims in, as people are more likely to tap on a link from someone they trust without thinking about it.<\/p>\n<p dir=\"ltr\">They are more difficult to readily identify<\/p>\n<p dir=\"ltr\">Many of the recognisable features in a malicious email aren\u2019t available in an SMS.<\/p>\n<p dir=\"ltr\">For example:<\/p>\n<p dir=\"ltr\">&#8211; SMS messages don\u2019t have a sender address that you can quickly verify. When it comes to SMS, attackers can use a borrowed name, or a short number that they have taken from another source. In addition, SMS text messages can be sent from computers with a generated short number.<\/p>\n<p dir=\"ltr\">&#8211; Some SMS scammers can insert their message into an existing chat thread, making them look like the continuation of a chat good enough to fool even some professionals.<\/p>\n<p dir=\"ltr\">&#8211; Basic SMS messages only contain texts and links. This limits the small details that are obviously wrong, such as spelling errors, poor quality logos. These things may come later in the chain, but usually after a victim has already clicked on a link, infecting their phone.<\/p>\n<p dir=\"ltr\">People interact with SMS messages quickly and without thinking<\/p>\n<p dir=\"ltr\">People tend to spend even less time reading text messages on their phone than they do reading emails. This means that they are quick to skim a text and click on the link before they have even thought about what they are doing.<\/p>\n<h2 dir=\"ltr\">An evolving threat: The WhatsApp worm<\/h2>\n<p dir=\"ltr\">The latest in smishing text messages is a <a href=\"https:\/\/www.welivesecurity.com\/2021\/01\/26\/wormable-android-malware-spreads-whatsapp-messages\/\" target=\"_blank\" rel=\"noopener\">new Android worm<\/a> which is spread via WhatsApp as a form of automated smishing text message.<\/p>\n<p dir=\"ltr\">TheWhatsApp <a href=\"https:\/\/searchsecurity.techtarget.com\/definition\/worm\" target=\"_blank\" rel=\"noopener\">worm<\/a> works by replicating itself on a victim\u2019s phone and then sending automatic replies to chats that the victim has with their contacts in WhatsApp. The worm is sent as a link to a fake app (usually to a fake version of the Huawei mobile app, but also other apps have been reported, including a fake Netflix app). The worm also tries to make itself look more legitimate by only sending once an hour even if the victim is having a lively chat with their contact.&nbsp;<\/p>\n<p dir=\"ltr\">The intention is that because the smishing text message is sent as a reply to another message, it looks as though it came from a trusted source, and is more likely to be downloaded by other victims. Once installed, the attached malware appears to be mainly aiming to generate advertising revenue for its creators by spamming infected users with adverts, but it could also be used for any other purpose at any time, including spyware, banking trojans, or even <a href=\"https:\/\/outofsite.biz\/cynance\/warning-ransomware-attacks-may-cost-lives\/\">ransomware<\/a>.<\/p>\n<p dir=\"ltr\">As well as replicating itself in automatic messages to WhatApp contacts, the fake app will also make other changes to a victim\u2019s phone such as requesting permissions to run in the background at all times, and using this permission to override battery optimisation rules, so that is drains the phone\u2019s battery, and remains connected to the internet, using up data.<\/p>\n<h2 dir=\"ltr\">Follow these tips to stay safe from smishing text messages and malicious apps:<\/h2>\n<p dir=\"ltr\">1. Don\u2019t tap on links or attachments in SMS, WhatsApp or other messages on your phone unless you can verify the sender, or that they meant to send it.<\/p>\n<p dir=\"ltr\">2. Think before tapping. Take a second to think about the contents of the message before tapping on the link. If you are uncertain about it, report it a spam, or delete the message from your phone. And if the offer sounds too good to be true, it probably is.<\/p>\n<p dir=\"ltr\">3. Never download an app from outside an official app store (Google Play or the App Store). For example the WhatsApp worm above takes victims to a site outside the Google Play store to download the app, bypassing Android\u2019s security.<\/p>\n<p dir=\"ltr\">4. If you receive the same message many times from the same sender, don\u2019t tap on it, as it could be an automated spam message.<\/p>\n<p dir=\"ltr\">\n<\/p><p dir=\"ltr\">5. Think about the permissions the app is requesting. Are they reasonable for the services the app provides?<\/p>\n<p dir=\"ltr\">6. Check your app settings to ensure that apps can\u2019t install apps on their own. This is usually done by going to Settings &gt; Apps &gt; Special Access &gt; Install Unknown Apps.<\/p>\n<p dir=\"ltr\">7. Don\u2019t reply to a suspicious looking message. Especially don\u2019t reply to messages that request important information. Never share important information over text message.<\/p>\n<p dir=\"ltr\">\n<\/p><p dir=\"ltr\">Stay safe.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>You know all about phishing scams via email, and you are careful to never click on a link you don\u2019t recognise. But how careful are you when it comes to messages on your phone? Are you confident that the SMS from the bank, or the link sent to you via WhatsApp from your friend is&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7193,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7189"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7189"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7189\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7193"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}