Attacking the Trust Boundary Where SMS Meets the Internet

The talk starts from a practical question: what happens when a one-time passcode sent through a bank's SMS path never reaches the phone. The speakers focus on Kannel, an open-source SMS and WAP gateway first released in 1999, whose last stable release they date to 2018 and which still carries bank traffic. They describe its process layout, where the central engine accepts connections from other components on an unauthenticated TCP port, and why its outbound TLS does not validate certificates.

Using a lab with a fake bank application, a log observer, and a rogue carrier built with Osmo software, they demonstrate silent message suppression, forged delivery receipts that enable billing fraud, and a message-ID conversion mismatch that can misroute receipts. They also show a null-byte discrepancy that hides content from logs, direct SMS injection through the open port, command injection through a keyword-triggered exec feature, and a SQL injection that reaches command execution. Legacy protocol parsers contain classic memory corruption as well.

The takeaway is that these weaknesses stem from design trust assumptions as much as aging code, so patching individual bugs will not fully fix them. Operators should keep gateway ports off the internet, restrict access, and monitor backend logs rather than relying only on front-end records.