How to Detect SIM Swaps in Rust With Twilio's Lookup API

2FA (Two-factor Authentication) OTP (One-time Password) codes sent via SMS are increasingly essential for protecting access to online accounts. However, there's a big catch: phones are vulnerable to SIM Swap attacks.

In a SIM swapping attack, an attacker takes over the mobile phone number of the real subscriber, by asking the mobile telecom provider to link that number to a SIM card under the attacker’s control.

And, it doesn't matter what type of SIM the victim has, as both physical and the newer eSIM (embedded SIM) are vulnerable.

When a SIM Swap attack occurs:

The victim loses control of their number
The malicious user can receive all calls and SMS sent to the victim's phone number. This allows them to receive any OTP codes delivered via SMS.

However, there is a solution! Twilio offers SIM swap detection through the Lookup API which reduces the impact of SIM swap attacks.

Quoting the documentation:

Lookup SIM Swap provides real authoritative data, directly sourced from mobile network operators, telling you if the SIM linked to a mobile phone number has recently changed. This gives you assurance that the mobile channel can be used for communications or authentication with your user. It also can help you assess the potential risk that a mobile phone number, and the associated user's account, has been potentially compromised.

This gives you assurance that the mobile channel can be used for communications or authentication with your user. It also can help you assess the potential risk that a mobile phone number, and the associated user's account, has been potentially compromised.

If this sounds like something that you need so you can better protect your users, this tutorial is for you! You'll learn how to integrate SIM swap detection into your Rust applications.

While SIM swaps can be suspicious, there are also legitimate reasons for them. For example: you lost your phone or it was stolen; you want to port your number to a different carrier; you bought a new phone. Given these reasons, it's hard to programmatically determine if a SIM swap is suspicious or not. The SIM swap data should always be used as part of a larger, more holistic determination. Please keep this in mind.

Prerequisites

To follow along with this tutorial, you'll need the following:

Rust and Cargo installed
A Twilio account (either free or paid) with SIM swap support enabled. Create one now if you don't have one already.
A mobile/cell phone number that you want to check
Your preferred Rust editor or IDE, such as Neovim, Visual Studio Code, or Rust Rover
Some prior experience with both Rust and the command-line would be helpful, though not essential

Create the Rust project

The first thing to do is to create a new Rust binary project and change into the new project directory, by running the following commands:

Copy code

Add the required crates

Next up, naturally, is to add the crates that the app will need. There aren't many, just the following:

To add them, run the following command

Crate

Description

These simplify setting and retrieving the environment variables that the app will need. Doing this keeps credentials and configuration data out of the Rust code.

This simplifies interacting with Twilio's Lookup v2 API.

serde and serde_json

These simplify deserialising the response from the Lookup API requests, making it easier to work with them.

This simplifies writing async code.

Copy code

Set the required environment variables

The application makes use of three environment variables. These are your Twilio Account SID and Auth Token, and a mobile/cell phone number or two that you want to check for SIM Swaps.

To set them, create a new file named .env and in that file paste the code below.

Copy code

Next, log in to your Twilio Console, then, from the Account Info panel of the Account Dashboard, copy the Account SID and Auth Token.

After that, paste the values into .env in place of <TWILIO_ACCOUNT_SID> and <TWILIO_AUTH_TOKEN>, respectively.

Write the Rust code

Now, let's get to the core of the tutorial and write the application's Rust code. To do that, replace the code in src/main. rs with the following:

Copy code

Then, replace <<YOUR PHONE NUMBER>> with the phone number you want to look up.

The code starts by loading the variables in .env as environment variables. Then, through calling the lookup_phone_data() function, it looks up the details of the phone number that you specified, retrieving any available SIM swap data (as data_packages contains DataPackage::SmsPumpingRiskScore). If SIM swap data is available, it prints out that information. Otherwise, it prints out that no SIM swap data is available.

Test that the application works

At this point, you're ready to use the application to detect potential SIM Swaps. To do that, back in the terminal, run the command below.

Copy code

You should see output similar to the following printed to the terminal:

Copy code

Keep in mind that there are legitimate reasons for SIMs to be swapped

While SIM swaps can be suspicious, there are also legitimate reasons for a SIM to be swapped. For example, you lost your phone or it was stolen; you want to port your number to a different carrier; you bought a new phone. Please bear these in mind.

Given these reasons, it's hard to programmatically determine if a SIM swap is suspicious or not. The SIM swap data should always be used as part of a larger, more holistic determination.

That's how to detect SIM Swaps in Rust

Thanks to Twilio's SIM swap detection through the Lookup API functionality (and Rustlio), there's very little that you need to do to retrieve SIM swap data for a phone number and check if it has been recently swapped.

By doing that, you can reduce the likelihood that someone loses control of their number, or that a malicious user can receive all calls and SMS sent to someone's phone number.

I can't wait to see what you build with SIM swap detection!

Matthew Setter is a PHP and Go Editor in the Twilio Voices team. He’s also the author of Mezzio Essentials and Deploy with Docker Compose. You can find him at msetter@twilio.com. He's also on LinkedIn and GitHub.