{"id":46615,"date":"2016-01-05T15:04:06","date_gmt":"2016-01-05T23:04:06","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=46615"},"modified":"2025-06-05T07:46:50","modified_gmt":"2025-06-05T14:46:50","slug":"sms-phishing-campaign-spreads-china","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sms-phishing-campaign-spreads-china\/","title":{"rendered":"SMS Phishing Campaign Spreads in China"},"content":{"rendered":"

Phishing messages and fake websites for stealing users’ credentials are a common occurrence. Recently, however, mobile banking users in China are facing a new wrinkle: phishing texts that appear to come from a major bank’s official number.<\/p>\n

The GSM standard is not a secure network because the authentication between mobile phone and network goes in a single direction: The network checks the legality of the client, but client does not check the network. An attacker can take advantage of this to send mass text messages to mobile devices from a fake base station.\u00a0For more information, check out the following:\u00a0https:\/\/www.twelvesec.com\/?s=fake+base+station<\/a><\/p>\n

The following two screen captures of SMS text messages appear to come from the service number of a well-known bank in China:<\/p>\n

\"ww_wechat_post\"<\/p>\n

The messages warn that a mobile bank account will become unavailable, and lead the potential victim\u00a0to fake websites.<\/p>\n

The bogus site pretends to be the web interface of the bank and “requires” users to input bank account, password, and mobile phone number to register the mobile phone’s bank features. The following images show the fake interface (left) and the legitimate interface (right) of\u00a0the bank.<\/p>\n

\"real_fake_merchants_bank\"<\/p>\n

If a victim delivers the bank account, password, and mobile phone number, an attacker is much more likely to steal money from an account.<\/p>\n

If a victim delivers the bank account, password, and mobile phone number, an attacker could at least access the account and steal information. (The attacker might not be able to withdraw funds because\u00a0a one-time password is necessary.)<\/p>\n

The key to this threat is that the SMS texts appear to come from the bank’s official number. This is an important point because most people trust messages that appear authentic. Unfortunately, this kind of message can be forged with a fake base station and an SMS mass-sending tool.<\/p>\n

When a user enters an\u00a0area where the fake base station’s signal is stronger than the real base station’s, the fake station will send SMS messages to the user\u2019s device. This fake base station could be in a house or a moving car. In China, buying the equipment to set up a fake station is inexpensive.<\/p>\n

\"20160113<\/a><\/p>\n

Threats vary considerably. In this case, you need to question even official phone numbers, websites, and other apparently authorized sources to avoid being cheated.<\/p>\n

To check if your device is connecting to a fake base station, try the following:<\/h2>\n