T1496.003, SMS Pumping, is telecommunications fraud carried out through a victim's messaging infrastructure. It applies to SaaS and falls under impact.
How attackers use it
A threat actor first gets a set of phone numbers from a telecommunications provider. They then use a victim's messaging system to send large numbers of SMS messages to those numbers. By generating traffic to numbers they control, they may earn payments from the provider.
Public web forms are the usual lever, such as one time password and account verification fields. Behind them may be services like Twilio, AWS SNS and Amazon Cognito. In response to the volume, SMS costs may rise and communication channels may be overwhelmed.
The victim does not lose data. They lose money, and real users stop receiving their codes.
How to detect it
MITRE's detection strategy uses SaaS application logs. Look for automated, repeated SMS triggers from OTP or account verification fields, using background messaging APIs, sending to attacker controlled numbers.
Signals worth alerting on:
- A jump in SMS sends or cost compared to a normal day
- Many requests from one source, or many sources hitting one form
- High volumes to a single country or number range
- Verification requests that are never completed
How to reduce the risk
MITRE lists one mitigation: application developer guidance. Consider CAPTCHA on forms that send messages by SMS.
Also useful: rate limit per number, per IP and per account, cap messaging spend with a provider limit, and restrict the countries you send to if you only serve some regions.
Quick check
Which mitigation does MITRE give for SMS pumping?
CAPTCHA protection on forms that send SMS messages.
