Security Researcher Uncovers Apple iOS SMS Bug - InformationWeek
11:03 AM

Security Researcher Uncovers Apple iOS SMS Bug

Vulnerability in Apple's iOS platform could allow hackers to send phishing messages via text, but there's no need to panic. Yet.

Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
(click image for larger view and for slideshow)
An Apple iOS security researcher who goes by the handle pod2g has unearthed a bug in Apple's iOS platform. The bug, which pod2g says others should know about, is present in all versions of iOS up to and including iOS 6 beta 4. The bug essentially allows hackers to spoof the reply-to number in a text message.

Text messages are of course bits of text sent between cellphones. Americans send billions and billions of them to one another each month. They're such a common form of communication that most people probably never stop to think that they might be insecure.

In a post on his blog, pod2g explains that text message are converted from the original text to PDUs (protocol description units), which are sent to the baseband and then fired off across the network.

"In the text payload, a section called UDH (user data header) is optional but defines [a] lot of advanced features not all mobiles are compatible with," wrote pod2g. "One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer to the text, he will not respond to the original number, but to the specified one. Most carriers don't check this part of the message, which means one can write whatever he wants in this section: a special number like 911, or the number of somebody else."

Why is this particular bug cause for concern?

Pod2g believes that ne'er-do-wells could send phishing messages via SMS. In one case, a person could receive a message that would appear to come from their bank, requesting information or sending them to a website. If they respond to the message, the reply wouldn't go to the bank, but instead to the phisher. If you're fool enough to send personal information via SMS, then you could be in a bit of trouble.

[ So much for Apple's walled-garden security approach. Apple Security Talk Suggests iOS Limits. ]

For the CSI lovers out there, pod2G also explains that bad guys could send spoofed messages to your device that would appear to have come from you. In other words, pirates or other nefarious types could plant false evidence on someone's iPhone.

Apple hasn't acknowledged the bug, but there's little reason to worry right now. Most financial or other businesses that might send a text message to an iPhone are delivering information, not requesting it. As long as you don't respond to such messages, you'll be fine.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
Andrew Hornback,
User Rank: Apprentice
8/18/2012 | 2:05:11 AM
re: Security Researcher Uncovers Apple iOS SMS Bug
How is this not news?

It's Apple, it's iOS, it's a bug and it's a security risk in every version of iOS. How many iOS devices are out there?

Think of the ramifications here - you get a text message from someone posing as a friend, you strike up a conversation. Each of those texts happens to be going to a number in, oh, Zimbabwe. So, you're getting hit by charges for outgoing and incoming texts at that point - that's just the cost of the transport. Then what happens if you don't realize the messages are fake and you start giving out information? The cost could grow astronomically.

Sure, you can spoof a return e-mail address (or, even legitimately in some cases, apply a real but different return e-mail address), but that's something that can be easily checked. How do you easily check where your texts are coming from and going?

Andrew Hornback
InformationWeek Contributor
User Rank: Strategist
8/17/2012 | 5:30:04 PM
re: Security Researcher Uncovers Apple iOS SMS Bug
This isn't really news. You can do something quite similar with emails ... you can configure just about any client on any platform to send messages with spoofed reply-to info. And I'm not aware of any mail clients that will raise an alert when they receive messages with potentially-altered reply-to parameters. Sure, reading through full message headers will give plenty of clues that the message has been faked, but who looks at those with any regularity?

Whether a message arrives by text/sms, email or carrier pidgeon, the usual advice still applies: NEVER reply to any requests for personal/financial info and never follow links related to such requests. Instead, open your browser, type in the URL of a trusted business (if you even do business with them) then find the appropriate spot on their site to provide the requested info. Or just call their customer service line ... after looking up their number on your credit card, bank statement, etc.
2017 State of IT Report
2017 State of IT Report
In today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends for 2018
As we enter a new year of technology planning, find out about the hot technologies organizations are using to advance their businesses and where the experts say IT is heading.
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll