A gaping flaw in SMS lets hackers take over phone numbers in minutes by simply paying a company to reroute text messages.