Security Researcher Uncovers Apple iOS SMS Bug - InformationWeek
IoT
IoT
Mobile
News
8/17/2012
11:03 AM
50%
50%
RELATED EVENTS
The Real Impact of a Data Security Breach
Aug 02, 2017
In this webcast, experts discuss the real losses associated with a breach, both in the data center ...Read More>>

Security Researcher Uncovers Apple iOS SMS Bug

Vulnerability in Apple's iOS platform could allow hackers to send phishing messages via text, but there's no need to panic. Yet.

Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
(click image for larger view and for slideshow)
An Apple iOS security researcher who goes by the handle pod2g has unearthed a bug in Apple's iOS platform. The bug, which pod2g says others should know about, is present in all versions of iOS up to and including iOS 6 beta 4. The bug essentially allows hackers to spoof the reply-to number in a text message.

Text messages are of course bits of text sent between cellphones. Americans send billions and billions of them to one another each month. They're such a common form of communication that most people probably never stop to think that they might be insecure.

In a post on his blog, pod2g explains that text message are converted from the original text to PDUs (protocol description units), which are sent to the baseband and then fired off across the network.

"In the text payload, a section called UDH (user data header) is optional but defines [a] lot of advanced features not all mobiles are compatible with," wrote pod2g. "One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer to the text, he will not respond to the original number, but to the specified one. Most carriers don't check this part of the message, which means one can write whatever he wants in this section: a special number like 911, or the number of somebody else."

Why is this particular bug cause for concern?

Pod2g believes that ne'er-do-wells could send phishing messages via SMS. In one case, a person could receive a message that would appear to come from their bank, requesting information or sending them to a website. If they respond to the message, the reply wouldn't go to the bank, but instead to the phisher. If you're fool enough to send personal information via SMS, then you could be in a bit of trouble.

[ So much for Apple's walled-garden security approach. Apple Security Talk Suggests iOS Limits. ]

For the CSI lovers out there, pod2G also explains that bad guys could send spoofed messages to your device that would appear to have come from you. In other words, pirates or other nefarious types could plant false evidence on someone's iPhone.

Apple hasn't acknowledged the bug, but there's little reason to worry right now. Most financial or other businesses that might send a text message to an iPhone are delivering information, not requesting it. As long as you don't respond to such messages, you'll be fine.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
8/18/2012 | 2:05:11 AM
re: Security Researcher Uncovers Apple iOS SMS Bug
How is this not news?

It's Apple, it's iOS, it's a bug and it's a security risk in every version of iOS. How many iOS devices are out there?

Think of the ramifications here - you get a text message from someone posing as a friend, you strike up a conversation. Each of those texts happens to be going to a number in, oh, Zimbabwe. So, you're getting hit by charges for outgoing and incoming texts at that point - that's just the cost of the transport. Then what happens if you don't realize the messages are fake and you start giving out information? The cost could grow astronomically.

Sure, you can spoof a return e-mail address (or, even legitimately in some cases, apply a real but different return e-mail address), but that's something that can be easily checked. How do you easily check where your texts are coming from and going?

Andrew Hornback
InformationWeek Contributor
jasonscott
50%
50%
jasonscott,
User Rank: Strategist
8/17/2012 | 5:30:04 PM
re: Security Researcher Uncovers Apple iOS SMS Bug
This isn't really news. You can do something quite similar with emails ... you can configure just about any client on any platform to send messages with spoofed reply-to info. And I'm not aware of any mail clients that will raise an alert when they receive messages with potentially-altered reply-to parameters. Sure, reading through full message headers will give plenty of clues that the message has been faked, but who looks at those with any regularity?

Whether a message arrives by text/sms, email or carrier pidgeon, the usual advice still applies: NEVER reply to any requests for personal/financial info and never follow links related to such requests. Instead, open your browser, type in the URL of a trusted business (if you even do business with them) then find the appropriate spot on their site to provide the requested info. Or just call their customer service line ... after looking up their number on your credit card, bank statement, etc.
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
IT Strategies to Conquer the Cloud
Chances are your organization is adopting cloud computing in one way or another -- or in multiple ways. Understanding the skills you need and how cloud affects IT operations and networking will help you adapt.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll