Feeds

iPhone crashing bug could lead to serious exploit

More fun with SMS

Choosing a cloud hosting partner with confidence

Updated This story was updated to correct factual errors contained in an IDG News article that first reported the vulnerability.

If you own an iPhone, security researcher Charlie Miller can knock it off the network. And if his hunch is right, he just might be able to do a lot more, at least until Apple fixes the flaw.

Exploiting a bug in the way iPhones parse SMS messages, the principal analyst at Independent Security Evaluators has demonstrated how to crash a part of the phone that allows him to temporarily disconnect the device from the network, he told The Register. He's still trying to figure out if the vulnerability will allow him to remotely execute code, a feat that would allow attackers to do much more nefarious things, including sending malicious commands to monitor the phone's location or turn on its microphone so it becomes a remote bugging device.

"I can definitely make the thing crash," Miller said. "I have still to determine whether it's actually exploitable or not. This thing has the potential to be really serious, but I'm still looking at it and Apple is still looking at it."

Miller presented his findings at the SyScan conference in Singapore on Thursday and plans to offer additional details later this month at the Black Hat security conference in Las Vegas. Researcher Collin Mulliner was also instrumental in discovering the bug, Miller said.

If the vulnerability turns out to be exploitable, it would be significant because there are few measures iPhone users can take to prevent an attack, said Dino Dai Zovi, a security researcher who along with Miller is the co-author of The Mac Hacker's Handbook. Dai Zovi has yet to see technical details behind the vulnerability, but he has already experienced its effects last week.

While the two were speaking on a land line, Miller told Dai Zovi he found a new bug in the iPhone and, as a demonstration, instructed him to look at his own Apple handset. The display bore the words "No service." (The outage caused by Miller's proof of concept was only temporary).

"My reaction was that this has the potential to be a very serious vulnerability and likely the worst that has affected the iPhone to date," Dai Zovi told The Register. "I was very surprised that he had a vulnerability that was triggerable with just an SMS message."

Dai Zovi and several other iPhone experts we consulted said there is no way to prevent the iPhone from receiving SMS messages. While AT&T allows users to block text messages and multimedia messages sent as emails using this site, we found no way to block all SMS messages. An Apple representative didn't respond to our email requesting comment. If you know of a way, please contact your reporter or leave a comment. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.