{"id":7923,"date":"2013-04-04T21:28:44","date_gmt":"2013-04-04T20:28:44","guid":{"rendered":"http:\/\/www.betangel.com\/blog_wp\/?p=7923"},"modified":"2013-04-19T16:37:20","modified_gmt":"2013-04-19T15:37:20","slug":"text-betting-security-issu","status":"publish","type":"post","link":"https:\/\/www.betfairtradingblog.com\/blog_wp\/2013\/04\/04\/text-betting-security-issu\/","title":{"rendered":"Nasty security issue with text betting?"},"content":{"rendered":"

I’ve been messing around with\u00a0SMS<\/a> recently.<\/p>\n

When you are running automation<\/a> you can’t help but think, as you are guzzling down that drink at a party, how did I do on the 20:50?\u00a0\u00a0So I thought it may be neat to look at SMS as a solution. I thought it may technically difficult to do, but it turns out SMS is a quite easy, if not an inexpensive option. That was when I discovered something else.<\/p>\n

I quickly realised, excuse the technical jargon, that SMS messages have no authentication payload. An SMS message is simply a number followed by some text. “So what!”, I hear you say. Well that basically means that I can send a message to you and make it look like it was from somebody else. I had some fun testing this by sending messages to two people from each other, which duely set off a chain of utter confusion. But then something else dawned on me….<\/p>\n

Text betting has been popular for a while now and\u00a0a number of firms have set up text betting services, just google text betting<\/a>. You register your phone then send them some short code and an amount to bet. It all sounded a bit too simple, so I asked a friend to register, then placed a bet for him. Maybe I’m missing something, but this seems like a potentially big security flaw to me? There is no real authentication that it’s really you that is sending a bet to a company. The only authenticatation\u00a0\u00a0used is your phone number and that can be faked. But it appears anyone can mimic this phone number in a matter of minutes?<\/p>\n

If you are registered or thinking of registering for a service like this, I’d be nervous. Surely it’s only a matter of time before this is exploited? Given the lengths to which accounts are protected for normal betting activity, this seems a bit of a hole?<\/p>\n

\u00a0\"04-04-2013<\/a><\/p>\n

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n\n
Tweet<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

I’ve been messing around with\u00a0SMS recently. When you are running automation you can’t help but think, as you are guzzling down that drink at a party, how did I do on the 20:50?\u00a0\u00a0So I thought it may be neat to look at SMS as a solution. I thought it may technically difficult to do, but […]<\/p>\n

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1421],"tags":[1785,1784,1269,1783],"class_list":["post-7923","post","type-post","status-publish","format-standard","hentry","category-general","tag-issue","tag-loophole","tag-security","tag-text-betting"],"_links":{"self":[{"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/posts\/7923"}],"collection":[{"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/comments?post=7923"}],"version-history":[{"count":7,"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/posts\/7923\/revisions"}],"predecessor-version":[{"id":8053,"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/posts\/7923\/revisions\/8053"}],"wp:attachment":[{"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/media?parent=7923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/categories?post=7923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.betfairtradingblog.com\/blog_wp\/wp-json\/wp\/v2\/tags?post=7923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}