Smishmash - Text Based 2fa Spoofing Using OSINT, Phishing Techniques and a Burner Phone

## Overview

The presentation "Smishmash," delivered by security researcher and SEC-T conference founder Thomas Olofsson alongside hacker and lock picker Michael, examines the growing trend of bypassing two-factor authentication (2FA) via SMS spoofing and smishing. The speakers emphasize upfront that SMS/text messaging was never designed for authentication purposes and has fundamental architectural weaknesses that attackers have known about and exploited for years. While SMS spoofing techniques have existed for a long time, the speakers note a recent mainstream escalation and weaponization—particularly across cryptocurrency platforms and exchanges (e.g., Crypto.com), leading to millions of dollars in stolen digital assets, Bitcoin, and NFTs.

## Research Motivation & Tooling Limitations

The speakers set out to research the exact modus operandi behind real-world 2FA bypasses and determine the minimal hardware and tooling required to replicate them. To demonstrate text-based spoofing, the speakers brought vintage burner devices: - An older **Sony Ericsson** - A **Nokia N900** (a classic mobile hacking platform)

However, live hardware demonstrations could not be executed at the venue because the local telecommunications carriers had shut down 2G and 3G network services, rendering the older devices inoperable. The speakers noted that while these devices still function on active 2G/3G networks in Europe (such as Sweden), the fundamental spoofing concepts and attack flows function identically on modern mobile hardware.

## Smishing Trends & Failure of Defenses

The speakers differentiate smishing (SMS phishing) from standard email phishing: - **Gap in Security Protections:** Traditional enterprise anti-phishing solutions, mail filters, and browser protections do not scan or filter incoming links received over mobile messaging, SMS, Telegram, or Signal. These links reach victims completely unchecked. - **Data Breaches & Exposure:** High smishing volume is fueled by widespread data breaches where phone numbers are leaked and subsequently harvested by adversaries. - **Implicit Trust & Awareness:** Text messages retain an artificially high level of user trust compared to email. The speakers reference industry research indicating that up to 35% of targets do not realize they are being targeted by a smishing attack, making SMS an effective initial vector for credential access and 2FA interception.

## Attack Vectors: Vulns vs. Protocol Abuse

When reviewing high-profile 2FA bypass incidents, the researchers distinguish true 2FA bypass attacks from infrastructure misconfigurations: - **Outlook/Exchange Bypass:** Past reports claimed 2FA bypasses against Outlook/Exchange; however, investigation showed these incidents stemmed from misconfigured or exposed management ports allowing attackers to alter server settings and disable 2FA directly on the server, rather than bypassing the 2FA protocol itself. - **SMS Spoofing & Phishing Abuse:** In contrast, modern targeted attacks—such as those against cryptocurrency exchange users—exploit the intrinsic inability of mobile networks to verify the integrity and origin of SMS sender identities, enabling adversaries to spoof legitimate sender labels and trick victims into compromising credentials and one-time codes.