Root Cause Analysis SMS Attack 30.3.2025-1.4.2025

History background and Determination of Causes

From March 30 to April 1, 2025, a so-called SMS mass attack (SMS Pumping Request) was carried out. This automatically led to a safety shutdown of the SMS service in question and a fallback to the backup SMS service of Swisscom Trust Services over the weekend.

The analysis first revealed a partner test account that had insufficiently protected the input mask for mobile number and was accessible to the attacker via the internet. CAPTCHA verification or limitation of SMS requests were lacking on this input mask, allowing the attacker to carry out their attack. The account was immediately blocked on Monday, March 30th.

Further assessment showed that the attack rate decreased as a result, but SMS messages were still being sent to countries not normally part of the signing service. Consequently, the complete dispatch of SMS outside the EU, EEA, Switzerland, and the UK was stopped. The primary SMS service was brought back into operation on Tuesday, April 1^st.

Another application was found that was improperly using the interface. This application was also disconnected from SMS triggering in the afternoon of Tuesday, April 1st.

Even after shutting down the second test application, we could still detect SMS deliveries to third countries outside the aforementioned European states. Subsequent dialogue with several partners revealed that sporadically, citizens residing in third countries were using this service, contrary to contractual exclusions. We also prohibited the use of password-OTP authentication on standard test applications.

Impact

The outage exclusively affected legacy signature applications (OASIS interface/AIS) that do not yet use broker technology, and only those signature applications that rely on one-time passwords in connection with signature approval.

The switch to the backup SMS service particularly impacted groups of people who have contracts with a (often budget) network operator with whom this backup SMS service has inadequate contractual relationships. They are often using cheaper routing options in connection with interworking and roaming agreements. Our primary provider has significantly better coverage for such contracts than the backup service.

Affected by the shutdown of SMS outside the EU/EEA/CH/UK are EU/EEA citizens, citizens of Switzerland and the UK who were traveling or are traveling and who have acquired a SIM card from the respective holiday destination outside their home countries and wanted or want to use it for signatures. Users affected by the restriction on standard test applications are those who want to test signature approval via password one-time code via SMS. Tests can now only be conducted with Mobile ID or Mobile ID app.

Recommendations and Next Steps

Swisscom Trust Services generally recommends very limited use of SMS for signature approval. Along with potential future regulatory restrictions within the tightening of signature legislation due to the vulnerability of SMS, SMS delivery is also not always reliable. We generally recommend transitioning to the Multiple Authentication Broker (MAB) architecture and thereby using authentication methods such as Passkey, Mobile ID, or Swisscom Signature Approval App. For so-called one-shot signatures, i.e., signatures that are always accompanied by identification, the broker method allows use without one-time code via SMS input. If citizens residing in third countries must use the one-time code via SMS service, it must explicitly be contractually agreed upon due to legal regulations. A memo has already been distributed for this purpose. We will gradually resume SMS dispatch to the third countries mentioned herein. However, third countries with high pricing (such as Pakistan) or third countries with inadequate data protection provisions (China, Russia, etc.) will remain excluded. SMS dispatch to third countries will now be separately monitored so that countermeasures (e.g., account shutdowns) can be carried out more quickly. Test accounts with password one-time code via SMS release will be set up from now on only specifically for special partners with signed contracts for this purpose. New test contracts will gradually be provided for existing test accounts. With this extensive bundle of measures, we are confident in being able to offer one-time password usage again without further damage to the productive system.

Customer success stories

Customer success stories

Root Cause Analysis SMS Attack 30.3.2025-1.4.2025