Infogressive, Inc.

It’s always fun being a security guy and receiving attacks. I find myself respecting some of the SPAM I get from time to time for its sheer psychological and technological brilliance. However, on May 26th, 2009 the attack I received wasn’t as funny. I’m sitting in my office working trying to make a living and I receive the following text message which is obviously disruptive at best:

From: jason@server-system.net
|VISA alert: #740875 ACCOUNT FROZEN, call us at 1-866-527-0498

Unfortunately I have some of my cards send me balance alerts and such so my first instinct was “Oh great, which stupid credit card company do I have to sit on hold with now in order to fix something they screwed up?” The more I looked at it, I was like that number doesn’t look familiar at all. Then I looked at the from address with more scrutiny and then the lightbulb went off, oh this is bogus you idiot! So even the guy with alphabet soup after his name was *almost* fooled by this little act.

Based on my years of wireless telecom experience, I’m sure all the wireless providers are frantically trying to stop these attacks. I’m sure the technology behind the scheme is very similar to email-based social engineering attacks. A botnet, randomized text and subject, same story new medium. I called the number to gain insight, but it was already dead. My guess is that they use VoIP somehow to further their anonymity. I look forward to getting another message so that I can call it more quickly to gain further insight. If someone else receives one of these, please share the phone number immediately so that I can call it!

This type of attack will only gain in popularity. Consumers will get increasingly annoyed with unsolicited text messages. With the lack of awareness, I’m sure the attack is considerably more successful vs. a traditional email-based attack. A majority of people no longer trust their inbox, but their cell phones are another story. Make sure your friends and family are aware that anonymous sources can send text messages just like they do via email.