Mobile
News
8/17/2012
11:03 AM
Connect Directly
RSS
E-Mail
50%
50%

Security Researcher Uncovers Apple iOS SMS Bug

Vulnerability in Apple's iOS platform could allow hackers to send phishing messages via text, but there's no need to panic. Yet.

Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
(click image for larger view and for slideshow)
An Apple iOS security researcher who goes by the handle pod2g has unearthed a bug in Apple's iOS platform. The bug, which pod2g says others should know about, is present in all versions of iOS up to and including iOS 6 beta 4. The bug essentially allows hackers to spoof the reply-to number in a text message.

Text messages are of course bits of text sent between cellphones. Americans send billions and billions of them to one another each month. They're such a common form of communication that most people probably never stop to think that they might be insecure.

In a post on his blog, pod2g explains that text message are converted from the original text to PDUs (protocol description units), which are sent to the baseband and then fired off across the network.

"In the text payload, a section called UDH (user data header) is optional but defines [a] lot of advanced features not all mobiles are compatible with," wrote pod2g. "One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer to the text, he will not respond to the original number, but to the specified one. Most carriers don't check this part of the message, which means one can write whatever he wants in this section: a special number like 911, or the number of somebody else."

Why is this particular bug cause for concern?

Pod2g believes that ne'er-do-wells could send phishing messages via SMS. In one case, a person could receive a message that would appear to come from their bank, requesting information or sending them to a website. If they respond to the message, the reply wouldn't go to the bank, but instead to the phisher. If you're fool enough to send personal information via SMS, then you could be in a bit of trouble.

[ So much for Apple's walled-garden security approach. Apple Security Talk Suggests iOS Limits. ]

For the CSI lovers out there, pod2G also explains that bad guys could send spoofed messages to your device that would appear to have come from you. In other words, pirates or other nefarious types could plant false evidence on someone's iPhone.

Apple hasn't acknowledged the bug, but there's little reason to worry right now. Most financial or other businesses that might send a text message to an iPhone are delivering information, not requesting it. As long as you don't respond to such messages, you'll be fine.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
8/18/2012 | 2:05:11 AM
re: Security Researcher Uncovers Apple iOS SMS Bug
How is this not news?

It's Apple, it's iOS, it's a bug and it's a security risk in every version of iOS. How many iOS devices are out there?

Think of the ramifications here - you get a text message from someone posing as a friend, you strike up a conversation. Each of those texts happens to be going to a number in, oh, Zimbabwe. So, you're getting hit by charges for outgoing and incoming texts at that point - that's just the cost of the transport. Then what happens if you don't realize the messages are fake and you start giving out information? The cost could grow astronomically.

Sure, you can spoof a return e-mail address (or, even legitimately in some cases, apply a real but different return e-mail address), but that's something that can be easily checked. How do you easily check where your texts are coming from and going?

Andrew Hornback
InformationWeek Contributor
jasonscott
50%
50%
jasonscott,
User Rank: Strategist
8/17/2012 | 5:30:04 PM
re: Security Researcher Uncovers Apple iOS SMS Bug
This isn't really news. You can do something quite similar with emails ... you can configure just about any client on any platform to send messages with spoofed reply-to info. And I'm not aware of any mail clients that will raise an alert when they receive messages with potentially-altered reply-to parameters. Sure, reading through full message headers will give plenty of clues that the message has been faked, but who looks at those with any regularity?

Whether a message arrives by text/sms, email or carrier pidgeon, the usual advice still applies: NEVER reply to any requests for personal/financial info and never follow links related to such requests. Instead, open your browser, type in the URL of a trusted business (if you even do business with them) then find the appropriate spot on their site to provide the requested info. Or just call their customer service line ... after looking up their number on your credit card, bank statement, etc.
InformationWeek Elite 100
InformationWeek Elite 100
Our data shows these innovators using digital technology in two key areas: providing better products and cutting costs. Almost half of them expect to introduce a new IT-led product this year, and 46% are using technology to make business processes more efficient.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest September 24, 2014
Start improving branch office support by tapping public and private cloud resources to boost performance, increase worker productivity, and cut costs.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.