Are USSD Codes Safe? Understanding USSD Security

One question businesses often ask is this: Are USSD codes safe?

Security is of the utmost importance in any service that involves consumer data, and USSD, a vital technology for connecting service providers and mobile devices, is no exception. Due to its use of sensitive client data, USSD services are potential targets for security breaches.

This article looks into the security issues surrounding USSD and aims to clarify the safety measures that can be implemented to secure it.

What are USSD codes?

USSD (Unstructured Supplementary Service Data) is a communications procedure used in GSM (Global System for Mobile Communication) networks to send short text messages. It is based on the SIM card and transmits data via the signaling channel of the GSM network. USSD is sometimes called “quick codes” or “feature codes.”  The USSD service does not require a messaging app or a fee.

The computer used for USSD receives messages sent by users to the mobile company’s network; the computer reacts by sending the information back to the phone, normally in an easy-to-read format on the display. During a USSD session, messages are established in actual time as a link. The connection remains open, exchanging data sequences both ways.

The evolution of the USSD code 

When the Global System for Mobile Communications introduced Unstructured Supplementary Service Data (USSD) in the 1990s, it helped mobile devices and service providers communicate. USSD can be accessed for mobile money services, prepaid callback services, menu-based information services, location-based content services, Wireless Application Protocol (WAP) browsing, and more.

It is currently the most significant and widely used technology for establishing connections between service providers and mobile devices. The user uses a USSD command to submit a request to the operator. The commands comprise numeric codes and characters like * and #. The chain often ends with # and starts with * or # (which can appear more than once to distinguish commands from subcommands). The service provider can also initiate these commands.

How beneficial are USSD codes?

USSD codes have been known to have many benefits, among which are:

1. Quick access to banking services: USSD codes help users perform banking services like checking account balances, fund transfers, and bill payments. They are also used for account management, where customers can activate or deactivate some services.
2. Mobile airtime and data purchases: customers can use USSD codes to top up their airtime or buy data bundles.
3. Information services: USSD is used to access sports, headlines, and weather reports.
4. Emergency services: USSD codes can be used to contact fire services, ambulances, or the police during emergencies.
5. Accessibility for feature phones: USSD works on feature phones, enabling information access in areas with little to no internet connectivity.
6. Secure transactions: exchanges are encrypted and time-limited, making them a relatively safe method for financial transactions.
7. Cost-effective communication: USSD messages are cheaper than SMS. This makes it accessible to low-income earners.

But amidst these benefits, a crucial question arises: are USSD codes genuinely safe? Generally, USSDs are known to be secure but should be more secure. Here are some threats faced by USSDs:

• Phishing attacks: Cybercriminals send invalid SMS messages with links that lead to fraudulent USSD banking interfaces. Unsuspecting individuals give the scammers their USSD banking PINs by submitting their credentials.
• Social engineering uses fictitious calls or social engineering to trick people into disclosing their one-time passwords (OTPs) or USSD banking PINs. Cybercriminals have used social engineering to gain access to users’ sensitive information.
• Sensitive information may be leaked by injection attacks brought on by improper data validation in the USSD. An attacker might insert carefully constructed text into the user input to perform malicious operations on the back-end server.
• Sim theft: The victim’s bank account information and bank data are obtained by the fraudster when their mobile phone gets stolen, and their SIM card is moved to another mobile device.
• Safety inconsistencies between IT managers, security administrators, and other non-technical employees lead to misconfiguration, i.e., weak passwords or pins that can be easily guessed and poor error responses.
• Unauthorized charges: Some malicious USSD codes can subscribe users to premium services without their knowledge, leading to unexpected charges.
• Network vulnerabilities: Weaknesses in the telecom infrastructure could be exploited to manipulate or abuse USSD services.
• Lack of end-to-end encryption: While USSD sessions are encrypted, they are not encrypted, potentially exposing data to interception within the network.
• Limited user interface: The simple text-based interface of USSD can make it difficult for users to verify the authenticity of requests or confirm transaction details.

Are USSD Codes Safe?

Since USSD has gained widespread acceptance by numerous businesses and corporations, there has been an increase in its security concerns. These concerns made it important for businesses and corporations to improve the security features of USSD to safeguard the user’s data and transactions. These are some security features in USSD:

• Two-factor authentication is an access management security technique (2FA) that requires two different forms of identity to access resources and data. It can be in the form of a password or a one-time password. This helps to provide a layer of security for the user.
• Encryption: This is converting information on data into a code to prevent unauthorized access. Encrypting USSD ensures that the interaction between user and server remains secure and cannot be easily intercepted.
• PIN protection: Many USSD services require users to enter a PIN before accessing sensitive information or performing transactions, adding an extra layer of security.
• Authentication: This is the process or action of verifying the identity of a user or process. Users are required to authenticate themselves before sensitive services are initiated through USSD. This can be done by the user inputting their unique PIN or password.
• Limited character set: USSD uses a limited character set, which can help prevent specific injection attacks that rely on special characters.
• Operator-controlled access: Mobile network operators can control which services are accessible via USSD, allowing them to restrict potentially risky or unauthorized services.
• Surveillance and assessment: To quickly identify any odd activity or potential security breaches, USSD transactions are continuously monitored and reviewed. It provides a quick and efficient means of tackling suspected breaches.
• Adherence to regulations: USSD services are guaranteed to uphold the necessary standards of security and privacy through compliance with data protection and privacy rules.

Are there best practices for USSD code security

When best practices are implemented effectively, it ultimately creates a strong security framework for USSD services. They help protect against various threats, from simple PIN guessing to more sophisticated attacks.

1. Strong PIN codes: service providers implement complex, non-sequential PINs for user authentication. This encourages users to choose unique PINs and avoid easily predictable combinations like birthdates or sequential numbers. They can also enforce a minimum PIN length and require a mix of numbers and special characters where possible.
2. Session timeouts: Set short connection termination times to automatically end idle sessions. This reduces the risk of illegal access when a device is left unattended. The ideal timeout period could differ depending on the service, but generally, shorter is safer. A shorter timeout period is considered for sensitive operations. 
3. Limited retry attempts: To make the USSD secure for its users, service providers restrict the number of incorrect PIN entry attempts before temporarily locking the account to prevent brute-force attacks. After a specific number of failed attempts (typically 3-5), the account is barred for a set period or requires additional verification to unlock.
4. Data encryption: The use of end-to-end encryption for all data transmitted via USSD to protect sensitive information from interception. While basic USSD does not include end-to-end encryption, many modern implementations use encryption protocols. Ensure that encryption protocols are up-to-date and regularly reviewed.
5. Regular security audits: Conduct frequent security assessments of USSD systems to identify and address potential vulnerabilities. This should include penetration testing, code reviews, and assessments of the entire USSD architecture. Regular audits help ensure that security measures remain effective against threats.
6. User education: This involves educating the users about USSD security best practices, including PIN protection, and recognizing potential phishing attempts. Users are informed on the importance of not sharing PINs, being cautious of unsolicited USSD prompts, and how to report suspicious activities.
7. Activity monitoring: Implement an actual time monitoring apparatus to detect and flag dubious patterns or activities in USSD usage. This could include unusual transaction amounts, numerous failed attempts, or access from suspicious locations. Automated alerts can help security teams respond quickly to these threats.

These practices are crucial to maintaining security in the face of growing cyber threats; it is highly recommended that these best practices be regularly reviewed and updated.

The threats to USSD and its security 

USSD technology security must be considered because USSD provides useful services to end users and corporations globally. In addition to the security measures in place, potential risks related to USSD can be minimized or even eliminated by providing effective safety precautions, such as encryption, two-factor authentication, and user education. A secure and efficient USSD system requires continuous monitoring and frequent updates.