In order to allow the exchange of SMS between networks, a system of SMS interconnect was created in the late 90s. Essentially, each company that wants to exchange SMS will query a database to find out what carrier is responsible for delivering SMS to a given number. (There are a lot of moving parts and several databases, varying by country code, but you get the idea.)

What services like this do is enable someone who owns a number that is not ordinarily enabled for SMS (POTS, VoIP, toll free/WATS) to enter their number into the SMS routing system and tell other carriers to deliver SMS to a service provider (one that can handle the inbound SMS traffic and display it on a web portal, for instance) of their choosing.

The flaw is when a SMS-enabled number can have its instructions overwritten by a service like this so that messages are routed where they shouldn’t go. As all mobile numbers are considered SMS-enabled by default and only the owning carrier should be the destination, this is a flaw. (Yes, I can think of some scenarios where you might want your mobile number SMS messages going elsewhere, but that’s dead for now.)

More specifically, the flaw is to do it on the back of an easily-faked, CYA letter of authority.