USSD Request Manipulation

An attacker can transfer money from the account of a subscriber or an operator's partners by sending fake USSD requests using the ProcessUnstructuredSSRequest message. Also, UnstructedSSNotify is used to send notifications to subscribers from various services and the operator.

An attacker can send a fake notification on behalf of a trusted service containing instructions for the subscriber. That may include sending an SMS message to a paid number to subscribe to a service, calling a fake bank number due to suspicious transactions, or following a link to update an application.