In the realm of mobile security research, SMS communication still plays a critical role in assessing the potential risks and vulnerabilities in mobile devices. SMS messaging, specifically, is an essential aspect of mobile security research, as it is often employed in various attack vectors, such as phishing and targeted remote code execution attacks. To effectively analyze and mitigate these risks, security researchers need powerful, simple, and safe tools. This is where Twilio, Cloudflare Workers, and Corellium come together to create a potent solution that enables researchers to receive real-time SMS messages and route them efficiently.
In this blog post, we will explore how these three technologies can be integrated to build a robust SMS handling system for mobile security research. Twilio, a cloud communications platform, will serve as our SMS gateway, enabling us to receive SMS messages programmatically. Cloudflare Workers, a serverless computing platform, will be responsible for processing incoming SMS messages and forwarding them to the appropriate destination. Finally, Corellium, a virtual device platform, will provide the ability to work with remote iOS devices, allowing researchers to test and analyze the impact of SMS-based threats on mobile devices. And the total cost for all of this? Less than $5.
Our objective is to demonstrate the process of receiving real-time SMS messages, routing them from Twilio to a virtual iOS device on Corellium via Cloudflare Workers, and showing how this integration can enhance mobile security research workflows. Let's dive in and see how these technologies can work together to create an efficient and cost-effective SMS handling solution for security researchers.
To create a Cloudflare Worker that's reachable over the internet, you'll first need a Cloudflare account. If you don't already have one, simply visit the Cloudflare website and sign up for a free account.
For our use-case, you do not need a domain on Cloudflare. We will use the free *.workers.dev subdomain that Cloudflare offers.
For a beginner's guide on writing your first Worker for Corellium, please see our previous blog post. For this blog, we're just going to jump right into our src/index.ts.
For our wrangler.toml, we're going to define CORELLIUM_INSTANCE_ID.
This code listens for incoming Twilio requests, extracts the sender's phone number and the SMS message content, and forwards this information to the Corellium API.
To deploy the Worker in production, run:
Take note of the URL in yellow, we're going to need it for the next section.
To watch for incoming HTTP requests, run:
To begin, you'll need to set up a Twilio account if you don't already have one. Twilio offers a wide range of communication services, but in this tutorial, we will focus on using their SMS capabilities. Follow these steps to create an account and obtain a Twilio phone number:
If all went well, you should see you have a number. In our example, we have +1-775-402-9665.
To forward incoming SMS messages to a webhook, you'll need to configure your Twilio phone number's settings. Follow these steps to set up the webhook:
1. In the Twilio Console, navigate to the Phone Numbers section.2. Click on the phone number you obtained earlier to view its configuration settings.
3. In the "Messaging" section, locate the "A MESSAGE COMES IN" webhook configuration.
4. Enter the URL of your Cloudflare Worker (which we created in the previous section) in the "Webhook" field. The URL should look like https://project-name.your-worker-subdomain.workers.dev/.
5. Make sure the "HTTP POST" option is selected, as we will be using the POST method to send the incoming SMS data to our Cloudflare Worker.
6. Click "Save" to apply the changes.
With the Twilio configuration complete, your Twilio phone number is now set up to forward incoming SMS messages to the specified webhook. Our Cloudflare Worker is now set up to process these messages and route them to our Corellium virtual iOS device!
We're now going to open the messages app on our virtual iPhone, and wait for a text. Within a few seconds of sending a text message to our +1-775-402-9665 number, the message pops up. Success!
In our wrangler tail log window, we can also see the incoming POST request from Twilio.
In our example, we are not validating the authenticity of the POST request from Twilio. This can be done by following Twilio's documentation.
In practice, I would also recommend adding basic authentication to the endpoint (and validating the Twilio message signature).
In this blog post, we've demonstrated how to integrate Twilio, Cloudflare Workers, and Corellium to receive real-time SMS messages on a virtual iOS device. We began by creating a Cloudflare Worker, wrote TypeScript code to handle incoming Twilio requests and forward them to Corellium, and deployed the worker. Next, we set up a Twilio account and obtained a phone number, then configured Twilio to send incoming SMS messages to a webhook and updated the webhook URL in Twilio with the Cloudflare Worker URL. Finally, we tested the integration by sending an SMS message to the Twilio phone number and verifying that the message was received on the virtual iOS device.
Integrating Twilio, Cloudflare Workers, and Corellium for real-time SMS handling offers several benefits and use cases for mobile app security testing and development:
Overall, the integration of Twilio, Cloudflare Workers, and Corellium for real-time SMS handling can significantly enhance the app development and testing process, enabling developers and security researchers to build more robust, secure, and reliable applications.
Experience Corellium’s groundbreaking virtualization technology for mobile devices and discover never-before-possible mobile vulnerability and threat research for iOS and Android phones. Book a meeting today to explore how our platform can optimize mobile security research and malware analysis.