Text Message Spoof - also known as a SMS (Short Message Service) Spoof - Impersonation of another users contact information when sending a text message to a cell phone or PDA. The sender inputs the caller ID information they choose to be displayed on the receiving cell phone.

The specified caller ID information can be numbers or letters. For example the sender could specify that the recipient's caller ID shows an incoming message is from "The Pope" and the text message reads "Repent!"

Reasons for Spoofs?

• jokes
• scams
• pretexts (faking ones identity to gain information)
• To falsify account verification
• To remain anonymous
• To send a virus, worm or other malicious code

Text Spoofs can be sent through either web site interfaces or e-mail.

Web Sites: Historically, some cell phone providers allowed text messages to be sent directly from the provider's web site to their customer's cell phones. For example a user could visit www.VerizonWireless.com and send a text message from the web site to any Verizon customer. This allows for easy spoofing because the user can input whatever data they choose in the 'from' input fields.

More recently widespread are commercial text messaging companies that provide the service for a fee (although these services often offer up to the first 500 text messages for free allowing Spoofer a lot of free messages). These services overcome a small hurdle that e-mail Text Spoofers encounter. They simplify sending a text message because they negate the need for a Spoofer to know the recipients service provider - something an e-mail Spoofer will need. These companies will get the text message to the cell phone or PDA regardless which service provider the receiving device is using.

Some Commercial text/SMS service providers:

Clickatell
Teleflip
BulkSMS

e-mail: Users can send text messages by sending a regular e-mail message to the recipient's cell phone number at the cell phone providers specified domain name. For example to send a text message to 888-555-1212 a known Verizon phone, one would send an e-mail to 8885551212@vtext.com The spoof occurs when the sender forges the information within the Senders e-mail account to specify a bogus sender.

Some e-mail programs are preferred by Spoofers over others but Thunderbird by Mozilla/FireFox is often mentioned by Blogs on the topic.

Because an e-mail Spoofer sending a text spoof by e-mail needs to correctly identify receiving cell phones service provider they either:

1. use tools to look up a cell phones service provider
2. use a shotgun approach and send the same message to multiple service providers, hoping that they get the right one.

Note the big three service providers in the US cover about 75% of the 220 Million US cell phone accounts (Cingular/ATT, Verizon, Sprint/Nextel) so Spoofers have a good odds sending out three e-mails to the same cell phone number.