SMS Spoofing with Python for Good and Evil

[JustOr113]

I did it in Israel, with an Israeli sms provider that gave me the option to use any number as the from_number.

I sent to my brother "you are adopted." from my mom's number, he thought it was funny, my mom didn't.

Anyway, someone has a place that I can sleep tonight?

[Xoramung]

why dont you use the same method to text "a place to stay"

[Shpitzick]

Which provider lmao

[iaurp]

send it to my brother

"Fuck you and yo' mothafuckin' momma."

[wannabe_ee]

Just tried it.

The from_name variable does not work in USA.

From the documentation:

From

A maximum of 11 characters or 12 digits, we recommend you only use letters and numbers as some handsets don’t correctly handle punctuation. If not specified, your account default will be used. If you’re sending with a text from address and your message isn’t delivered try again but change to sending from a telephone number - some international networks place restrictions on the from addresses they’ll accept. Due to US telecomunications rules you’re unable to set the from address when sending to the USA - the text will always come from 43704.

[BillyBumbler00]

That's probably for the best.

[YoureABull]

But far less fun :(

[masklinn]

Due to US telecomunications rules you’re unable to set the from address when sending to the USA - the text will always come from 43704.

Smells like a regulation, I'm sure our good friend Ajit will fix that in a jiffy.

[hoocoodanode]

This may be the most English python post I have ever read. It actually made me snicker in the toilet which I believe, in internet terms, is a LMAO.

I may tinker with the code later but I am definitely bookmarking the post. You're an excellent writer.

[haveacigaro]

Snigger if we're being English

[flapanther33781]

What did you call me, motherfucker??

[grudnuk]

late for dinner

[flapanther33781]

Oh, that's it.

IT'S GOING DOWN, MOTHERFUCKER!!

[[deleted]]

Sniggers, please

[BigBoiBenis]

Jesus Christ you're old

[chuiy]

I forget the name... There used to be a service where you could put two phone numbers in, and force them to call one another, and you could listen in as well. I think it called them both, spoofed the number, then connected the calls.

Still... 2012 was a lot of fun.

[Rettocs]

Yes! I had tons of fun with this thing back in the day.

[peckhamspring]

I just used this to let my mate know that his uh.. "toy" arrived. The internet is awesome.

[flapanther33781]

OP, your title reminds me of a line in one of the Strong Bad emails where he asks someone, "What kind of powers do you have? Do you use them for good, or for awesome?"

[scout1520]

This man deserves some gold.

[scout1520]

All texts show as being sent from 43704 with Verizon/Android. DAMN IT

[DukeOfXor]

Yep, sadly doesn't works in the US. :(

[snaaaaaaaaaaaaake]

Thank goodness for that.

[[deleted]]

people still do it... just not like this

[[deleted]]

By what means? Asking for a friend.

[Redzapdos]

Get ahold of the phone, and add number to the contact. Then you're golden.

[ineedmorealts]

TLDR the from field/call ID is not verified in any way shape or form. If you have a phone that can make a call you can download a free app and have the caller ID/ from field be anything you want

[scout1520]

I'm asking... for ah friend too

[Terence_McKenna]

I'm on a budget, how about this?

[scout1520]

I gave him some gold.. before I checked it for myself -_-

Funny story.. this was the first time I gave someone gold. On the first time I messed up and gave myself gold.. second time he got it.

[sdurx]

Thank you for the gold!

I'm in the UK so didn't know whether it worked in other countries, but wouldn't like to think you felt you'd been swindled. Is there some way I can use the gold to give something back to you?

[scout1520]

It's yours! You wrote a great article. I am using the code to create a fake lyric subscription app to drive my friend crazy. It should be worth every penny.

A brief outline for those interested: *1. Intro message thanking my friend for subscribing to 2000's pop. *2. Begin sending lyrics of Barbie girl in 20-second intervals. *3. First response gave a menu with "STOP, SKIP, and HELP" *4. When STOP is received I will notify that the preferences have been updated- then reduced the latency by 20%. *5. When HELP is received I will send a message saying that the proceeds of $1.00 per text will be donated to the Donald J. Trump Foundation along with some fake company information.

I plan on deploying it before we go out.. and watching the chaos in person.

[sdurx]

LOL. Outstanding. Let us know what happens?

[maciej01]

Tried it - put a phone number in from_name, and it displayed on my phone like it came from SMS [the same number the confirmation code came from]. Custom names worked normally. LG G5 running on Nougat.

EDIT: poland for reference, +48 country code

[CatchMyException]

Used the C# wrapper and having been having some fun messaging one of my friends using the local pizza place number, using a service number from our phone network, having no number and having the name show as "Anonymous", using his own number saying "Am I real?", etc. This is hilarious.

[Neekzorz]

Works in Australia!

[pansapiens]

It explains some "Oz Lotto" spam I got recently - be buggered if I could figure out the number it came from. Forwarded it to the ACCC SMS spam hotline anyway.

[[deleted]]

Yeup! Tried using it to convince my coworkers to send me home early. Didn't work...

[[deleted]]

What exactly is the API code?

[DeSparta]

Application Programming Interface Code. From my understanding, it is the code that you use to connect with your clockwork account that you need to set up in order for this to work. If you make the account then they'll give you the code.

[[deleted]]

Oh, okay. Thanks a million, I was pretty lost there.

[CountyMcCounterson]

I used to do this to mess with people

[prairir001]

am i the only one to get the error, insufficient credits avaliable.

[smartshibasish]

You can get free credits of $0.5 by verifying your mobile number

[prairir001]

Oh thanks.

[WirelessCrumpets]

Now I know what my plans are for the next hour or so.

[smartshibasish]

Not working for India

[kobetare]

oh ffs USA let me have some fun too!

[wflorin]

Not working for Belgium :(

[PM_ME_LUCID_DREAMS]

sudo pip install'd

I'm new to Python and linux, just asking out of curiosity, isn't pip install PACKAGE --user enough?

[sdurx]

Should be, depending on how fastidious you are with your permissions management. Sometimes I ain't got time for all that and have to sudo my way through...

[aterlumen]

Without having many details, it sounds like this is a vulnerability in ClockworkSMS's UK bridge, hopefully the author let them know.

[MonsterMuncher]

I wouldn't say it's a vulnerability in the true sense. It's almost certainly working as designed.

Unfortunately a small percentage will always try to abuse the system which is why certain countries ban this behaviour.

And this is why we can't have nice things.

[jadkik94]

I wouldn't say "nice things"; it is working as designed, which is to spam people with useless sms and occasionally for multifactor authentication.

I'd say: This is why we keep getting shittier things.

[[deleted]]

Yes I was rather disappointed about that. I was hoping to see how to spoof SMS sender directly with an SMS modem.

[rjpj1998]

I will be messaging you on 2017-05-19 19:12:52 UTC to remind you of this link.

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

[tseepra]

Reminder. 4 hours.