I spend a lot of time looking at network traffic and reading about application security for my IT studies here in Poltava. Usually, when we think of cyberattacks, we picture complex malware or zero day exploits. But recently, I read a series of three articles on the DEV Community blog that highlighted a completely different approach to hacking. The author goes by Zero Day Notes and breaks down three related attacks: subscription bombing, SMS bombing, and phone call floods.
What I found most fascinating about these articles is that the attackers are not really hacking anything. Instead, they are weaponizing the normal notification systems built by legitimate companies.
The core concept across all three attacks is distraction. If your phone suddenly blows up with four hundred text messages, or your inbox receives thousands of newsletter confirmations in a single hour, your first reaction is probably annoyance. You might think someone is playing a prank on you. But the author explains that this digital noise is almost always a smokescreen for a much more serious crime.
In an email subscription bomb, attackers use automated scripts to submit your email address to thousands of different web forms, free trials, and mailing lists. Because the emails coming back to you are from real companies, they usually bypass your spam filters. While you are frantically trying to delete the junk, the attacker is busy breaking into your bank account or placing orders with your saved credit cards. The goal is to bury the single legitimate fraud alert or password reset notification under a mountain of useless welcome emails.
The exact same logic applies to SMS bombing and phone call floods, which security professionals sometimes call telephony denial of service. Attackers use bots to trigger verification codes and automated voice calls from hundreds of different apps all at once. According to the articles, an SMS flood is frequently used to mask a SIM swap attack. If the attacker is transferring your phone number to their own device, your carrier will text you a warning. By drowning your phone in hundreds of useless verification texts, they make sure you never see that warning until it is too late.
From an IT perspective, I found the business side of SMS bombing incredibly interesting. The author mentions a scheme called SMS pumping. In this scenario, the attacker sets up a premium rate phone number in a foreign country. They then use a bot to constantly request verification codes from a poorly secured startup website, directing all those text messages to their premium number. The startup ends up paying a massive telecommunications bill, and the attacker gets a cut of those termination fees. It is a brilliant but devastating exploit of basic business logic.
As a student learning how to build secure networks and web applications, reading this changed how I view web forms. These attacks only work because developers leave APIs and signup forms completely unprotected. We have to start building friction into our applications. The articles point out several ways developers can stop this abuse. We need to implement strict rate limiting so a single IP address cannot request a hundred text messages in five minutes. We also need to use invisible honeypot fields to catch bots and require users to actually click a link to confirm their email before we send them regular newsletters.
If you ever find yourself on the receiving end of one of these floods, the articles offer some great practical advice. The most important rule is not to panic and mass delete your messages. You need to use your search bar to look for words like purchase, login, or security alert to find what the attacker is trying to hide. You should also check your bank accounts from a secure device immediately. For phone and text floods, both iOS and Android have settings to silence unknown callers, which will at least give you the peace and quiet you need to figure out what is actually going on.
These articles were a great reminder that security is not always about preventing unauthorized access. Sometimes it is about making sure your application cannot be used to harass or distract someone else.
- https://dev.to/zero_day_notes/subscription-bombing-explained-how-email-bombing-attacks-work-and-how-to-stop-them-2lc4
- https://dev.to/zero_day_notes/phone-call-bombing-how-call-flood-attacks-work-and-how-to-stop-them-6gf
- https://dev.to/zero_day_notes/sms-bombing-attacks-how-they-work-why-they-happen-and-how-to-defend-your-apps-306j