Main tenant un téléphone intelligent qui affiche une conversation de messagerie

SilentAir: text message codes intercepted inside mobile carriers, time to move off SMS MFA

The six-digit code you get by text message to confirm a sign-in feels like good protection. This week, the Swedish firm Enea, which specializes in mobile network security, described an espionage group that intercepted those messages directly inside carriers’ networks. The group, named SilentAir, controlled hacked equipment at mobile operators in at least six Asian countries. For some targets, Enea saw verification codes reach the attackers right after their text messages were diverted.

SilentAir’s targets were mostly in Taiwan, including political and government figures. Your small business is probably not among them. But Enea warns that any attacker can reuse these techniques, and it’s a good time to review SMS MFA in your company.

The words you need to understand the SilentAir case

📘 A short mobile network glossary

Term

Also called

What it means here

SS7 and Diameter signalling

Signalling protocols

The messages carriers exchange to route calls and texts and enable roaming. SilentAir used them for its attacks.

Interconnect network

IPX

The network shared between carriers, built on a high level of mutual trust. Enea now recommends treating it as untrusted.

Location update

UpdateLocation

The message that tells your home network where your phone is. SilentAir sent it to claim its equipment was serving the target’s phone.

Silent SMS

Silent text

A text that doesn’t display or ring on the phone. According to Enea, SilentAir used them in part to check that a diversion was working.

The path of a verification code, normal or diverted

✅ Normal path

🌐

The service

sends the code

➜

📡

Your carrier

knows where your phone is

➜

📱

Your phone

receives the code

You type the code and the sign-in is confirmed.

⚠️ Path diverted by SilentAir

🛰️

Hacked equipment

at another carrier

➜

📨

Fake location

"this phone is with me"

➜

📡

Your carrier

accepts and reroutes

➜

🕵️

The attacker

receives your texts

The code goes to the attacker. According to Enea, for some targets, verification codes were received immediately after the diversion.

Enea says interception made up 18.3% of the SilentAir attacks it observed, compared with about 2% for a typical commercial surveillance company in its earlier research. The report doesn’t say whether any accounts were taken over. Enea believes the group is disrupted for now, but could come back.

Why the text message is the weak link

9:41📶 🔋

Text message

1Your verification code is 482913. Don’t share it with anyone.

If you didn’t request this code, ignore this message.

2Account recovery code: 771204

What CISA points out about these messages

1Text messages aren’t encrypted: an attacker with access to a carrier’s network can read them, notes the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
2Some services fall back to text messages for account recovery. Adding an authenticator app doesn’t remove SMS: it stays as a weak backup door until you turn it off.

Text messages have other well-known weaknesses: like an app code, they don’t stand up to a fake page that asks for the code, as we showed in our article on fake event phishing that bypasses MFA.

From weakest to strongest: where does your MFA stand?

The multi-factor authentication ladder

▲Password onlyAvoid for any business account.

▲▲Text message codeBetter than nothing, but interceptable inside the network and vulnerable to fake pages. CISA recommends moving away from it.

▲▲▲Authenticator app codeBetter than SMS according to CISA, but still vulnerable to phishing.

▲▲▲▲Push with number matchingThe app asks you to type the number shown on screen: harder to abuse than a plain "Approve".

▲▲▲▲▲Security key or passkey (FIDO)The only phishing-resistant method according to CISA: nothing to intercept, nothing to copy.

The plan to move your small business off SMS MFA

🗂️ Four steps, in this order

Take inventory This week

List the accounts that still send a code by text: Microsoft 365, online banking, accounting, domain name, company social media.

Switch to the app This month

Enroll every employee in an authenticator app, starting with administrators and the people who approve payments.

Turn off SMS Next

Once the app is in place, remove SMS as a method, including for account recovery when the service allows it. Otherwise it stays as a backup door.

Aim for passkeys For key accounts

For administrators and management, adopt a physical security key or a passkey when the service supports them.

📵 What if a service only offers SMS?

Keep it, it’s better than nothing, but use a number dedicated to the company rather than an employee’s personal cell phone, and flag that account as "to review" in your inventory. Pair it with a long, unique password stored in a password manager.

In Microsoft 365, this change is made in your tenant’s authentication methods. It’s also a good time to check that device code sign-in, often used in phishing, is under control.

How NeoTech can help

As part of our Microsoft 365 services and managed IT services, we take inventory of your employees’ authentication methods, move them from SMS to an app or passkeys, then turn off the weak methods. We also provide automated 24/7 monitoring with on-call technician intervention when an unusual sign-in occurs on an account.

Book your free cyber check

In 30 minutes, we look at which of your company’s accounts still rely on a text message code and what to replace them with, starting with the most important ones.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Our office: 2572 boul. Daniel-Johnson, office 237, Laval.

Sources

Photo: cottonbro studio, Pexels (Pexels licence).