Why was Singapore's anti-spoofing registry shut and replaced?

Singapore

SINGAPORE'S SMS SenderID Protection Registry pilot with the Mobile Ecosystem Forum (MEF) will be shut and rebuilt by the Singapore Network Information Centre (SGNIC), a subsidiary of the Infocomm Media Development Authority (IMDA), from Monday (Mar 7).

What was the pilot supposed to achieve?

On Jan 17, 2022, IMDA's director of communications and marketing Foo Wen Dee announced the pilot in response to a spate of SMS spoofing attacks targeting OCBC customers.

As part of the attacks, OCBC customers received scam SMSes that appeared in the same thread as the bank's legitimate messages.

This was because scammers were able to send messages with the same "header", or SMS sender ID, as the bank.

Under the voluntary pilot, supported by MEF since last August, companies would pay between £15,000 (S$27,439) and £22,000 to register their sender IDs, as well as any other lookalike names, such as "OC3C" or "D5S".

Registration was supposed to prevent messages being delivered by scammers trying to impersonate the legitimate companies.

MEF would also provide training and threat analysis expertise to these companies.

How do companies send SMSes?

Companies engage so-called "Tier 1" SMS aggregators to send SMSes to their customers.

Tier 1 SMS aggregators are service providers that sign contracts with mobile network operators (MNOs) to send SMSes.

There are also lower-tiered aggregators that do not work directly with MNOs but instead forward messages onwards to other aggregators, which then pass SMS traffic on to MNOs.

For this reason, the United Kingdom's National Cyber Security Centre (NCSC) encourages companies to understand the processes that their aggregators use to send SMSes and to use Tier 1 SMS aggregators if possible.

In Singapore, examples of tier 1 aggregators include Commzgate, Hello Technology and Orange Gum.

Lower-tier aggregators tend to charge lower rates and may not comply with regulations and requirements from telecommunications companies.

How were spoofed messages blocked with the MEF?

The Business Times (BT) understands that upon signing on to the MEF registry, all SMS aggregators, regardless of their tier, would receive a blacklist of lookalike sender IDs that would automatically be blocked.

Aggregators would also receive a white-list of companies and the actual sender IDs that they use.

The white-list, however, is not meant to be used to block messages. Rather, aggregators generate a weekly log based on messages with a company's sender ID that they have relayed - and this is sent to said company.

The company would then check to see if the messages originated from their designated aggregator.

If it did not, they could flag it as suspicious and flag it to MEF.

Only after the company had concluded its investigation would MEF ask aggregators to block the offending aggregator from sending SMSes with the company's protected sender ID.

This system created some loopholes. For instance, scam messages could still be sent to users in the time it takes a company to complete its investigation.

How will SGNIC's registry work?

In its statement on Monday, IMDA said the new system would automatically identify and block spoofed messages using protected SMS sender IDs.

BT understands that this would mean an investigation will no longer be required before SMSes are blocked.

The authorities said this more proactive approach would allow it to better protect consumers.

There has been some contention about such a system. In an e-mail seen by BT, MEF had raised concerns that such a system would prevent genuine messages from being delivered.

Additionally, BT understands that IMDA will work with local mobile network operators to filter out SMSes with protected sender IDs that may have been sent through overseas telcos.

In time, the authorities intend to publish a list of compliant aggregators that have signed on to the registry. Among other conditions, aggregators will need to commit to blocking SMSes with protected sender IDs that do not originate from their listed aggregators.

Businesses that do not sign up with these aggregators will not be able to complete their registration on SGNIC's registry.