Researcher exploits new bugs in firmware to wrest control of vulnerable iPhone, Android devices.
A European researcher today showed how bugs he has discovered in the baseband chipset firmware of iPhone and Android smartphones could be exploited to ultimately take control of these devices.
Ralf-Philipp Weinmann, a researcher at the University of Luxembourg, was poised here to demonstrate an exploit he created that turns on the auto-answer feature on the affected smartphones and then uses them as remote listening devices. But he was unable to get his demo to run live successfully, in part due to poor cellular reception in the hotel where the conference was held.
Despite the demo glitch, security experts say the research marks a new generation of smartphone hacking.
"This is extremely significant," says Don Bailey, security consultant with iSec Partners. "Before, you could intercept calls, SMS, and in some cases GPRS [General Packet Radio Service]/EDGE, depending on if you had the requisite hardware."
And Weinmann's research achieves the endgame of code execution, Bailey says.
Weinmann is no stranger to smartphone hacking -- he and Vincenzo Iozzo, a researcher at Zynamics, last year won the PWN2OWN contest at CansecWest by exploiting the iPhone via Safari.
Hardware hacking expert Chris Paget successfully faked several attendees' cell phones into connecting to his phony GSM base station during a live demonstration at Defcon18 in Las Vegas in July. Paget, who says GSM is "broken," was demonstrating weaknesses in the GSM protocol by using a homegrown GSM base station. His so-called "IMSI Catcher" acted as a spoofed GSM tower and fake base station that fooled GSM smartphones into connecting to it.
GSM technology is used in 80 percent of the world's mobile phone calls today and has been the subject of previous security research poking holes in it. "The main problem is that GSM is broken. You have 3G and all of these later protocols with problems for GSM that have been known for decades. It's about time we move on," Paget said prior to his demonstration at DefCon.
InformationWeek Elite 100Our data shows these innovators using digital technology in two key areas: providing better products and cutting costs. Almost half of them expect to introduce a new IT-led product this year, and 46% are using technology to make business processes more efficient.
The UC Infrastructure TrapWorries about subpar networks tanking unified communications programs could be valid: Thirty-one percent of respondents have rolled capabilities out to less than 10% of users vs. 21% delivering UC to 76% or more. Is low uptake a result of strained infrastructures delivering poor performance?
InformationWeek Must Reads Oct. 21, 2014InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.