Apple ID verification codes coming from FAKE Apple SMS Number

Question

Level 1

91 points

Apple ID verification codes coming from FAKE Apple SMS Number

So I was reviewing my detailed billing logs from AT&T and suspiciously not a single text message from Apple has been included in the log. Very odd indeed. So I started doing a little digging.

The text messages with my verification codes (not iMessages Messages to be clear but real SMS text) come from 504-72. I receive SMS short codes because one of the accounts I use is not registered to any device but I've had a million problems with everything including iCloud and the location it sends me is always on the other side of the country or further.

Side note: The script on this explains that "that's the location of the server your carrier is using." Im obviously not always on mobile but that's what they always repeat back to me. Traceroutes on both mobile and my networks have absolutely no hops whose internet numbers geolocate to the region listed by Apple.

So who does the SMS short code 504-72 register to? "Apple" but the rest of the information given is SKETCHY as anything. Just like the fake calls to Apple Care and screensharing session I had with Ms. Cleo and her 1999 graphics that I know I've experienced and been pretty much told to prove it, crazy pants. I wish I had a video camera rolling...I'm not a computer expert and have no interest in this stuff which is exactly why I liked Apple. Ironic and amusing at least..

There is no Apple logo like provided on the lookup reports on the real Apple SMS short codes Apple owns and the additional data is missing or obviously fake.

So who is this? I will find out. I wonder exactly what, which is absolutely nothing (I can guarantee it), will be done to protect the security and privacy of users.

So does Apple own the SMS short code 504-72? Where did they send the code to? Was that even a code from Apple? Will we ever know? No? They're not talking and you'll need to motion for discovery for that information, you say?

Posted on Jul 27, 2017 12:21 AM

Reply

Answer 1

Jul 27, 2017 5:43 AM in response to Praty52

Praty52 wrote:

Just go now to the Apple Company to give it your Phone to the company and say them all your problems and then see it they will find it the real culprit who is behind of all Fake S.M.S who is sending you all types of Junk mails please do not worry sir your tension is now Apple Company Matter they will help you in any matter as Mr. chase_ daniel . This is your Adviser from Country of India as Mr. Pratap Roy .

Apple is not a law enforcement agency. The will not find out who is behind a fake SMS.

Reply

Answer 2

chase_daniel Author

Level 1

91 points

Jul 28, 2017 11:20 AM in response to MrHoffman

I was specifically requesting them from this website via direct access I don't click popups and have no email installed. I've owned and been in sole possession of the phone number these are being sent to for almost 15 years.

Clearly code injection or something similar is in full force on apple.com.

It's fairly hysterical Apple won't remove the malware distributer "Thor Anti-Virus," as one clear example of how far the mighty have fallen.

Good idea on the FCC. I love getting federal regulators involved.

Reply

Answer 3

Jul 27, 2017 2:32 PM in response to Lawrence Finch

Lawrence Finch wrote:

It's better to switch to Apple's 2 factor authentication, which does not go over SMS at all.

The default two-factor authentication path for the codes doesn't use SMS, but the person initiating the authentication request can ask that SMS text messages be used. Unfortunately, recipients don't have control over that detail, either. (If you know a way to disable that, do please let me know!) Which means that the authentication requests can run afoul of the aforementioned SMS vulnerabilities.

I've used the SMS path for those codes, too. Sometimes iMessage has gotten itself... tangled.

There've been more than a few cases of social engineering against the cellular carriers, too. Which means not using a widely-known telephone number as your trusted number for SMS, too.

Hence my expectation that we're headed toward not-SMS and not-cellular-based implementations.

Reply

Answer 4

Nov 26, 2017 7:57 AM in response to MrHoffman

Please ignore chase_daniel. Just a common troll with false info.

Reply

Answer 5

Praty52

Level 1

8 points

Jul 27, 2017 7:21 AM in response to chase_daniel

Mr. chase_ daniel try to inform this problem to the Apple Company and give it your Phone to them for investigation of your phone .So the Apple Company will figure out who is in this who the person making you trouble on your Phone just

take my advice .Please sir take your phone to the apple Company and say them that i get this fake S.M.S from Apple Company and i do not know what step i should take it .So i bring it my Phone with me i want it that you keep it my phone for investigate that who that person who is sending to this person all types of fake S.M.S .So on later the company of Apple will find it the Culprit who is sending to you the Fake S.M.S .then you see it the Result sir .You will never be get disturbed from this Fake person who is sending you this Fake S.M.S to your phone .Please sir please do not worry at all

Apple Company will help you in any matter .Please do not get depress at all you will get the perfect result and then you will get it the perfect Phone with secure security system will be make install in your phone like Kaspersky Antivirus Program and your phone will not going to accept it any more Fake S.M.S from any unknown person as like from your Country or any other Country as Mr. chase_ daniel please get relax . Just go now to the Apple Company to give it your Phone to the company and say them all your problems and then see it they will find it the real culprit who is behind of all Fake S.M.S who is sending you all types of Junk mails please do not worry sir your tension is now Apple Company Matter they will help you in any matter as Mr. chase_ daniel . This is your Adviser from Country of India as Mr. Pratap **** .

Reply

Answer 6

chase_daniel Author

Level 1

91 points

Jul 27, 2017 1:06 PM in response to Praty52

Thanks for your help with this. Advice is a little bit uh questionable but I do appreciate your advice. It's more than I'm sure I will hear from this Apple Company. Unfortunately, they've failed at assisting me on every other issue I've had for the last 7 months. I've contacted the Apple Company time and time again since this all began. Never until 6-7 months ago had I ever even called Apple Company. As the other comment noted they really aren't law enforcement and I don't expect them to hunt down cyber criminals but considering this is such a serious issue (if they believed me which they probably don't) I'd expect them to take it seriously and address it head on. Unfortunately the Apple Company is not as committed to these type security issues as one would imagine considering the Apple Company's most esteemed nature. It's like a grey area right now where no one believes it because no one is supposed to believe it and it didn't used to be true maybe, but now it is should anyone care to expend some effort to look into this. Something about resting on laurels.

It's interesting to note here that I've gotten more assistance from the other side of the world than the people up the street.

I'll pursue this with AT&T and the short code governing body, the CTIA, who Apple's VP of Wireless Design Engineering, Ruben Cabellero, is a member of the board of. Funny that a fake short code could slip threw and be used as a legitimate Apple short code. Would really like this verified if 504-72 is legit or not, but surely Apple Company will continue the stellar efforts on behalf of their users' privacy.

Reply

Answer 7

Jul 27, 2017 1:43 PM in response to chase_daniel

There were some misdirected iMessage messages happening a while back (not SMS), and it's possible your telephone number might have been associated with somebody else's (former) account (if your number is new to you), but as for SMS, that 504-72 certainly looks to be a short code used by Apple.

If you weren't doing something that would have triggered a two-factor short message, ignore it. If you're getting more than the usual verification code and usual text — maybe some URL that the sender wants you to click on — then somebody's probably (unfortunately) forging that data and directing you to a web site that's pretending to be Apple, and trying to phish for your credentials.

Most of the spam calls folks are getting these days are "originating" from spoofed telephone numbers. Coincidentally, I received one of those recorded spam calls as I was entering this reply. With a bogus source number.

At best, AT&T might look into this. But probably not. Two-factor authentication via SMS is known to be insecure, and the US NIST standards folks are explicitly discouraging the use of SMS for two-factor authentication. Maybe call the US FCC or your particular country's equivalent telecommunications bureau, or your legislative reps?

Until SMS is reworked to better secure it and the SMS servers then tested and deployed, it'll be vulnerable. Cellular towers aren't all that secure, either — spoofed cell towers were common in previous years in Las Vegas, during some of the well-known security conferences held there. (Same for spoofing Wi-Fi, and I've personally encountered spoofed Wi-Fi in Las Vegas.) I'll expect to hear that more spoofed towers are around this year, too.

I'm getting the two-factor codes via iMessage, which may or may not be more secure, but it's not vulnerable to the same problems as AT&T SMS. Longer-term, we're probably headed toward key fobs or some other other second factor for authentication. (Here's a discussion of better securing gmail using a hardware token, for instance.)

Nobody here represents Apple or AT&T, so you'll not get an official answer from us, nor a particular confirmation.

And if you know a better way to solve these problems, there's money to be made.

Reply

Answer 8

Jul 27, 2017 2:02 PM in response to MrHoffman

Good response. To expand on it, SMS goes over the worldwide SS7 signaling network, which is very easy to hack as it is not encrypted. It dates from the days when the network was behind physical firewalls. And short codes are easy to forge also.

It's better to switch to Apple's 2 factor authentication, which does not go over SMS at all.

Reply

Answer 9

Jul 28, 2017 3:39 PM in response to chase_daniel

chase_daniel wrote:

I was specifically requesting them from this website via direct access...

Apple doesn't follow postings here. We're users. Like you.

Clearly code injection or something similar is in full force on apple.com.

if it's Apple sending the codes, then it seems more likely that somebody keeps trying to access your Apple ID.

If it's spam or phishing spoofing that sending address, then it could be anybody that's inclined to misbehave on or connecting into the AT&T network.

In general, there's been a long history of shady and sketchy anti-virus and anti-malware providers. But that's not relevant to whether or not you're getting verification codes in error, or due to phishing, or otherwise. Those SMS messages are fodder for discussions directly with AT&T and Apple.

Reply