alt Hacker News> The attack is remote, needs only the victim's number, and shows them nothing.
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
Replies
Back in the day you could send logos, ringtones, and bunch of other random crap thru carrier APIs, provided you signed a blood contract with them lol
Those APIs are probably still online, and still require to nail your ass to the contract, but technically I would assume it's possible.
They do accept/forward messages without checking if they are special carrier-only ones. ~10 years ago I had some fun sending a "voicemail received" message to people, which caused android phones to display a notification which couldn't ever be dismissed. IIRC it only worked on HTC phones and required root/xposed. SS7 in general is built with total trust in connected systems.
Looks like the website offers an APK.
But not all SMS are text messages for the user.
I've sent weird SMS messages through my (rooted) phone before. Silent SMS messages (useful for police trying to activate your phone for triangulation) still returned delivery reports a year or two ago, allowing someone to find out if someone else's phone is on without the target ever noticing.
I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.
Carrier firewalls will probably filter these messages out but I wouldn't rely on it.