SMS-based provisioning messages enable advanced phishing on Android phones

Attackers can abuse a special type of SMS messages used by mobile operators to deliver internet settings to Android phones to launch credible phishing attacks that result in users’ internet traffic being hijacked. According to researchers from Check Point Software Technologies, some phone makers’ implementations of the Open Mobile Alliance Client Provisioning (OMA CP) standard allows anyone to send special provisioning messages to other mobile users with a $10 GSM modem and off-the-shelf software.