  The short message service (SMS) is a service for exchanging texts via mobile
networks that has been developed not only as a means of text communication
between subscribers but also as a means to remotely manage Internet of Things
(IoT) devices. However, the originating number of an SMS can be spoofed. If IoT
devices authenticate administrators based on the originating number of an SMS,
the authentication is bypassed via SMS origin spoofing. Consequently, IoT
devices are at risk of accepting commands from attackers and performing
unauthorized actions. Accordingly, in this study, the specifications of major
cellular IoT gateways were evaluated by focusing on remote management via SMS,
and the authentication bypass hypothesis was verified. The results showed that
25 of the 32 targeted products supported SMS-based remote management, and 20
implemented authentication based on the originating number of the SMS.
Furthermore, by spoofing the originating number of the SMS, one product was
demonstrated to be remotely exploitable through authentication bypassing. Thus,
this study revealed the threats posed by SMS origin spoofing to IoT devices and
proved that SMS origin spoofing not only threatens text communication between
people but also puts machine communication at risk.
