It’s December 2022 and five men are driving the streets of Paris on a mission. That mission is to steal information from as many people as possible: they are sending text messages to people all over the city.
The messages are phishing attempts to get people to enter their personal information into a bogus health insurance website.
They get 400,000 messages through before police stop their vehicle and call out the bomb squad to conduct a controlled explosion for a device they find in the back of the car. They believe it is a bomb.
But the device is not a bomb, it’s an SMS Blaster: a device that anyone with an internet connection and a credit card can buy online.
The ultimate fraud phishing machine is out in the wild and it’s increasingly popping up in cities across the world.
SMS Blasters Act Like Miniature Cell Towers
SMS blasters are devices that can send out mass text messages to mobile phones in a targeted area. In essence, they act like miniature cell towers or bulk SMS senders, blasting texts to all devices within range.
The blasters were originally designed for emergency services and law enforcement to warn communities of impending disasters, but now they are being used for nefarious purposes.
An SMS Blaster hijacks the cell phones frequency around it to takeover the local cellular airspace. Think of it as setting up a fake traffic control tower that directs all planes (in this case, text messages) to follow the fraudster’s instructions instead of legitimate air traffic controllers.
Here is a simple graphic of how these blasters work:
Friend or Foe: SMS Blasters Have Legitimate As Well As Fraudulent Purposes
Consider the contrast in how these devices are being used for both legal and illegal activity.
In one instance, Thai police used an SMS blaster to warn residents about an approaching tsunami, potentially saving countless lives.
Yet in another case just months later, a Chinese fraudster in Bangkok used the exact same technology to blast one million scam messages from his van, trying to steal people’s banking information.
Fraudsters exploit SMS blasters for a variety of scams. Some blast out fake banking alerts (“Your account is locked, log in here to verify”), hoping to steal login credentials. Others send false package delivery notices or prize winnings that bait users into providing credit card info.
Impersonation messages are typical as scammers pose as government agencies, hospitals, or trusted companies . In the U.K., for instance, one group used a homemade SMS blaster to send thousands of texts posing as banks and official organizations, attempting to trick people into giving up personal details.
It’s the duality of purposes, legal and illegal, that makes regulation of these devices particularly challenging. Outright bans could hamper law enforcement agencies and first responders that rely on these mass messaging machines to reach people in times of crisis.
It’s Easy To Purchase an SMS Blaster
One alarming aspect is how easily accessible SMS blaster devices are. While you might expect such powerful technology to be tightly controlled, a quick search online reveals many vendors openly selling them.
But the machines are expensive and typically run $35,000 or more. Its a small price to pay for a fraud machine.
SMS Broadcaster.com
This website advertises a machine that can “send SMS in real time to active mobile phones around you without any credit (per-message cost)”. This means the device can transmit texts, without needing a paid SMS plan – a clue that it’s exploiting the cellular network rather than using legitimate channels.
“Your SMS will send to the nearest mobile phones within range within the radius of the machine without you having to know the cellphone number”.
TheSpySolution.Com
Their product descriptions boast impressive specs: one model advertises an 80W transmitter with a 3 km radius, capable of sending 100,000 SMS per hour.
While the site features disclaimers stating that it’s the customer’s responsibility to follow local laws and that the company “assumes no legal liability for illegal use”, they do feature a cell phone with a phishing style message on their landing page.
Alibaba.com
The machines are openly sold on wholesale market places. Alibaba (the largest market) shows numerous SMS blasting machines and kits for sale.
Everything from portable GSM base station devices to high-powered antennas can be bought with a few clicks. Some listings advertise ranges of a few hundred meters up to multiple kilometers, and the ability to send tens of thousands of messages per hour.
Watch an SMS Blaster In Action In The Philippines
An SMS Blaster sits atop a table overlooking a cityscape in the Philippines. High Tech music plays as a man starts up the machine and begins to connect to unsuspecting phones around his high rise apartment.
Watch the demo here.
A Challenging Issue To Regulate And Control
Controlling the misuse of SMS blasters has proven to be a significant challenge for governments and telecom regulators.
In some countries like Thailand having a rogue cellular base station is clearly illegal and there have been multiple arrest by police enforcing those laws. In other countries that is not the case.
Telecom companies are also in a bind. Mobile operators can normally monitor and filter messages that traverse their networks, but a rogue SMS blaster bypasses the carriers completely so they cannot stop the SMS Blasters either.
In the end it may all come down the consumer to protect themselves. Google, for example, added an option on their phones that lets users disable 2G connectivity entirely which prevents phones from connecting to legacy networks that SMS blasters exploit.
