Feeds

Hijacking iPhones and other smart devices using SMS

No user interaction necessary

Beginner's guide to SSL certificates

Black Hat Update: Apple says it has patched the vulnerability described below. The full story is here

Researchers have uncovered a bevy of vulnerabilities in smart phones made by multiple vendors, including one in Apple's iPhone that could allow an attacker to execute malicious code without requiring the victim to take any action at all.

The iPhone bug allows an attacker to take complete control of the coveted device simply by sending the owner an SMS, or short message service, message, said Charlie Miller, principal analyst at Independent Security Evaluators. He said he informed Apple's security team of the vulnerability several weeks ago and has yet to receive an official response.

The vulnerability is the same one Miller discussed three weeks ago, when he said he wasn't sure if it would allow him to do anything other than remotely crash an iPhone. Now that he's had more time to analyze the bug, he says he's confident he can remotely hijack the devices by doing nothing more than sending a malformed SMS message.

The bug resides in CommCenter, a service that's responsible for handling SMS, wireless and other functions in the iPhone. By default, it runs as root and isn't limited by an application sandbox. That makes it an ideal vector for taking control of the device. What's more, the messages are delivered automatically and often aren't easy for users to block.

The attack is carried out by dropping the last byte or two from UDH, or user data header, contained in the message, something that's fairly trivial to do.

Miller's discovery is the result of an aggressive fuzzing endeavor he and fellow researcher Collin Mulliner carried out over the past few months and laid out during a talk at the Black Hat security conference in Las Vegas. It threw more than 500,000 specially manipulated SMS messages at smart phones running operating systems made by Apple, Google and Microsoft to see how they might react. To save the researchers a bundle in fees charged by the phone carriers, they created a man-in-the-middle channel between the devices' application processor and modem so the messages didn't have to be sent over the network.

Mulliner also reported several bugs that can cause smart phones running Google's Android and Microsoft's Windows Mobile operating systems to crash. Because SMS messages are stored on carrier servers until the recipient is online, hackers can create long-lasting denial-of-service attacks by queuing up a large number of the malformed SMS messages.

Their talk came on the heels of one given by researchers Luis Miras, reverse engineer for RingZero, and Zane Lackey, senior security consultant for iSEC Partners. They showed it was possible to deliver MMS, or multimedia messaging service, messages over rogue servers that completely bypass the systems carriers use to block communications containing malware, spam and other malicious content.

That makes it possible for them to spoof the phone numbers of the sender, allowing them to masquerade as a recipient's bank, friend or other trusted party. They can also spoof the date and time stamps that appear on the messages.

One possible attack might involve sending a message that purports to come from the victim's carrier that warns the phone needs to be updated immediately and contains a link to software that creates a backdoor on the device instead.

The attack works by manipulating certain fields in the message headers so they include values that are intended to be used only by the carriers. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.