Feeds

iPhone crashing bug could lead to serious exploit

More fun with SMS

Providing a secure and efficient Helpdesk

Updated This story was updated to correct factual errors contained in an IDG News article that first reported the vulnerability.

If you own an iPhone, security researcher Charlie Miller can knock it off the network. And if his hunch is right, he just might be able to do a lot more, at least until Apple fixes the flaw.

Exploiting a bug in the way iPhones parse SMS messages, the principal analyst at Independent Security Evaluators has demonstrated how to crash a part of the phone that allows him to temporarily disconnect the device from the network, he told The Register. He's still trying to figure out if the vulnerability will allow him to remotely execute code, a feat that would allow attackers to do much more nefarious things, including sending malicious commands to monitor the phone's location or turn on its microphone so it becomes a remote bugging device.

"I can definitely make the thing crash," Miller said. "I have still to determine whether it's actually exploitable or not. This thing has the potential to be really serious, but I'm still looking at it and Apple is still looking at it."

Miller presented his findings at the SyScan conference in Singapore on Thursday and plans to offer additional details later this month at the Black Hat security conference in Las Vegas. Researcher Collin Mulliner was also instrumental in discovering the bug, Miller said.

If the vulnerability turns out to be exploitable, it would be significant because there are few measures iPhone users can take to prevent an attack, said Dino Dai Zovi, a security researcher who along with Miller is the co-author of The Mac Hacker's Handbook. Dai Zovi has yet to see technical details behind the vulnerability, but he has already experienced its effects last week.

While the two were speaking on a land line, Miller told Dai Zovi he found a new bug in the iPhone and, as a demonstration, instructed him to look at his own Apple handset. The display bore the words "No service." (The outage caused by Miller's proof of concept was only temporary).

"My reaction was that this has the potential to be a very serious vulnerability and likely the worst that has affected the iPhone to date," Dai Zovi told The Register. "I was very surprised that he had a vulnerability that was triggerable with just an SMS message."

Dai Zovi and several other iPhone experts we consulted said there is no way to prevent the iPhone from receiving SMS messages. While AT&T allows users to block text messages and multimedia messages sent as emails using this site, we found no way to block all SMS messages. An Apple representative didn't respond to our email requesting comment. If you know of a way, please contact your reporter or leave a comment. ®

New hybrid storage solutions

More from The Register

next story
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.