Feeds

Hijacking iPhones and other smart devices using SMS

No user interaction necessary

Beginner's guide to SSL certificates

Black Hat Update: Apple says it has patched the vulnerability described below. The full story is here

Researchers have uncovered a bevy of vulnerabilities in smart phones made by multiple vendors, including one in Apple's iPhone that could allow an attacker to execute malicious code without requiring the victim to take any action at all.

The iPhone bug allows an attacker to take complete control of the coveted device simply by sending the owner an SMS, or short message service, message, said Charlie Miller, principal analyst at Independent Security Evaluators. He said he informed Apple's security team of the vulnerability several weeks ago and has yet to receive an official response.

The vulnerability is the same one Miller discussed three weeks ago, when he said he wasn't sure if it would allow him to do anything other than remotely crash an iPhone. Now that he's had more time to analyze the bug, he says he's confident he can remotely hijack the devices by doing nothing more than sending a malformed SMS message.

The bug resides in CommCenter, a service that's responsible for handling SMS, wireless and other functions in the iPhone. By default, it runs as root and isn't limited by an application sandbox. That makes it an ideal vector for taking control of the device. What's more, the messages are delivered automatically and often aren't easy for users to block.

The attack is carried out by dropping the last byte or two from UDH, or user data header, contained in the message, something that's fairly trivial to do.

Miller's discovery is the result of an aggressive fuzzing endeavor he and fellow researcher Collin Mulliner carried out over the past few months and laid out during a talk at the Black Hat security conference in Las Vegas. It threw more than 500,000 specially manipulated SMS messages at smart phones running operating systems made by Apple, Google and Microsoft to see how they might react. To save the researchers a bundle in fees charged by the phone carriers, they created a man-in-the-middle channel between the devices' application processor and modem so the messages didn't have to be sent over the network.

Mulliner also reported several bugs that can cause smart phones running Google's Android and Microsoft's Windows Mobile operating systems to crash. Because SMS messages are stored on carrier servers until the recipient is online, hackers can create long-lasting denial-of-service attacks by queuing up a large number of the malformed SMS messages.

Their talk came on the heels of one given by researchers Luis Miras, reverse engineer for RingZero, and Zane Lackey, senior security consultant for iSEC Partners. They showed it was possible to deliver MMS, or multimedia messaging service, messages over rogue servers that completely bypass the systems carriers use to block communications containing malware, spam and other malicious content.

That makes it possible for them to spoof the phone numbers of the sender, allowing them to masquerade as a recipient's bank, friend or other trusted party. They can also spoof the date and time stamps that appear on the messages.

One possible attack might involve sending a message that purports to come from the victim's carrier that warns the phone needs to be updated immediately and contains a link to software that creates a backdoor on the device instead.

The attack works by manipulating certain fields in the message headers so they include values that are intended to be used only by the carriers. ®

Intelligent flash storage arrays

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.