A hacker attempted to send more than 4m text messages saying “death to the Jews” by exploiting the network of a global telecommunications company.
A Guardian investigation has revealed that data was stolen in 2013 as a result of unauthorised access to the systems of SMSGlobal, which provides messaging services for “some of the world’s best known brands” and has more than one million customers worldwide.
In April 2015, a hacker attempted to send over 4m messages to phone numbers across the Middle East. The message said: “Our motto forever Death to America, Death to the Jews.”
SMSGlobal succeeded in blocking most messages, but approximately 5,000 were distributed to mobile numbers in the United Arab Emirates. The identity of the hacker or group of hackers is not known. The company has defended their handling of the incident, and said that no message history, data or any other personal customer data was taken as a consequence of the breaches.
The 2013 theft was attributed by the company to be a cause of the breach in April 2015. Clients who had not changed their passwords were potentially vulnerable.
The investigation has also revealed that SMSGlobal said it “proactively” cooperates with UAE intelligence agencies, and has pointed to help it has given the FBI and the Australian federal police.
The company is based in Australia and has a strong presence in the UAE and offices in Britain and the US.
SMSGlobal’s clients include Nestle Waters, Serco, Etihad Airways, Emirates Transport, Tecom, Samsung, Microsoft, IBM, Dell, the Australian Football League and law enforcement agencies around the world. SMSGlobal’s corporate structure is based largely in Australia through SMSGlobal Investments Pty Ltd, SMSGlobal Holdings and SMSGlobal Pty Ltd.
The beneficial owner and chief executive is the Australian Carl Krumins, who was nominated in 2013 for the Ernst & Young entrepreneur of the year award.
Etihad uses SMSGlobal to provide authorisations for its pilots before their planes take off, and the Australian defence department has signed an A$80,000 contract with the company to provide messaging services for its e-health service.
A letter obtained by the Guardian from SMSGlobal to the Dubai telecommunications company DU following the April 2015 breach said text messages had been received with “malicious content” arising from a number of accounts.
“SMSGlobal makes note that an attempt to send in excess of 4 million SMS messages to +971 UAE numbers was attempted through the compromised accounts,” it said.
It said the April 2015 breach was attributed to the “use of a brute force attack” to penetrate accounts due to a “number of vulnerabilities” such as that customers’ passwords were not encrypted in SMSGlobal’s database, user accounts were not complicated enough, and an earlier platform’s code was no longer supported.
The letter outlined measures that had been taken to resolve the breach, but said: “There is a risk of brute force attacks continuing and more so that other legacy account credentials may have been compromised. That said SMSGlobal believes that by adding a number of additional security measures we can stop this from happening and/or any SMS from being sent through these attacks.”
The company listed a number of measures it had taken to remedy future breaches, including increasing content filtering, and contacting some customers using a particular type of their service to ask them to change their passwords.
But the letter did not disclose to DU that the company believed the hack was linked to the 2013 security breach.
In September 2015 a third hack occurred. The hackers tried to send a text message that said “mismanagement by Saudi officials was the reason for the death of the hajjaj in Mina” – believed to be a reference to the deaths of almost 2,000 Hajj pilgrims in September. It is not clear how many of the messages were successfully sent.
SMSGlobal said in response to the Guardian’s questions: “At no time in 2013 or 2015 has the message history, database or any personal information of any SMSGlobal customer been compromised by a breach of the SMSGlobal systems.
“The alleged unauthorised use only ever extended as far as access to a password and log-in for the purpose of sending messages via an API. It did not provide access to customer information, and at no time were any unauthorised SMS’s purporting to be from or on behalf of a customer sent using our system. We have acted at all times in accordance with Australian privacy law.
“Since 2013 SMSGlobal has further tightened its security measures by migrating all customers to a new security platform requiring the creation of new user names and passwords. This platform has been regularly tested by independent auditors and quality security assessors and it complies with or exceeds all international best-practice security standards.”
The Guardian has established that at least one client of SMSGlobal contacted the company following the April 2015 breach, advising them that one of their customers had received one of the messages from the hacker that was from the same source number used by SMSGlobal’s client. This meant that the text message appeared to have been sent on behalf of SMSGlobal’s client.
After the hacker tried to send the 4m messages in 2015, the Dubai telecommunications company DU suspended SMSGlobal’s use of its carrier service to send messages, causing chaos for SMSGlobal’s clients such as Etihad Airways, Emirates Transport, Samsung, Microsoft and Dell.
In a July 2015 letter to DU, Krumins alleged DU officers told SMSGlobal’s clients the company was shutting down its operations in the UAE. Krumins insisted he was not shutting down but expanding and would not be “bullied to lose business on this bad faith by these unknown DU employees”.
As a result Krumins threatened DU with legal action, and attempted to use his relationship with global law enforcement agencies as leverage, the documents reveal.
Krumins wrote to DU: “SMSGlobal being in UAE since 2007 has an excellent working relationship with UAE state security.
“I am not allowed to mention names of people we work with, nor any specific cases for operational matters which I have signed an agreement paper with these agencies … I cannot divulge any more information than that SMSGlobal fully cooperates, proactively in helping UAE intelligence, as we notice trends and report them to authorities before they become aware themselves.”
Krumins went on to tell of his company’s relationship with other law enforcement agencies around the world.
“I can supply many references from the FBI in USA, the federal police in Australia who have publicly written us a personal letter thanking us for our support in matters,” he wrote.
In the April 2015 letter to DU he also said the company was prepared to hand over all data – including the identity of the 4 million intended SMS recipients – surrounding the April 2015 breach to UAE agencies.
Krumins wrote: “We log all messages, both content, source and destination and time. SMSGlobal is willing to supply UAE authorities all 4m UAE numbers this information to assist in their investigations. We are also willing to supply all associated data including IP addresses used in this malicious send.”
In response to questions from the Guardian about the letters, a spokesperson for SMS Global said: “From time to time we are asked to assist domestic and international security agencies with their investigations into unauthorised SMS campaigns on a confidential basis. This assistance involves no disclosure of any customer data or personal information which is protected at all times unless compelled to do so by law.”
Under Australian law, companies must put in place reasonable security safeguards and take reasonable steps to secure personal information. Companies are not legally required to disclose data breaches, but the Australian government has agreed to introduced notification laws before the end of the year.
The Office of the Australian Information Commissioner’s guidelines state that notification “supports good privacy practice” and “can be an important mitigation strategy for individuals”.
SMSGlobal’s privacy policy states that it will agree to be subject to privacy laws and guidelines on the use and disclosure of personal information.
The company’s terms and conditions surrounding use of customer data state that SMSGlobal will “establish and maintain reasonable safeguards against the destruction, loss or alteration of customer data in the possession, custody or control of SMSGlobal”.
The company will “use its reasonable endeavours to protect the customer data from destruction, loss, alteration or security breaches while the customer data is stored in the SMSGlobal Systems”.
