Feeds

Hijacking iPhones and other smart devices using SMS

No user interaction necessary

SANS - Survey on application security programs

Black Hat Update: Apple says it has patched the vulnerability described below. The full story is here

Researchers have uncovered a bevy of vulnerabilities in smart phones made by multiple vendors, including one in Apple's iPhone that could allow an attacker to execute malicious code without requiring the victim to take any action at all.

The iPhone bug allows an attacker to take complete control of the coveted device simply by sending the owner an SMS, or short message service, message, said Charlie Miller, principal analyst at Independent Security Evaluators. He said he informed Apple's security team of the vulnerability several weeks ago and has yet to receive an official response.

The vulnerability is the same one Miller discussed three weeks ago, when he said he wasn't sure if it would allow him to do anything other than remotely crash an iPhone. Now that he's had more time to analyze the bug, he says he's confident he can remotely hijack the devices by doing nothing more than sending a malformed SMS message.

The bug resides in CommCenter, a service that's responsible for handling SMS, wireless and other functions in the iPhone. By default, it runs as root and isn't limited by an application sandbox. That makes it an ideal vector for taking control of the device. What's more, the messages are delivered automatically and often aren't easy for users to block.

The attack is carried out by dropping the last byte or two from UDH, or user data header, contained in the message, something that's fairly trivial to do.

Miller's discovery is the result of an aggressive fuzzing endeavor he and fellow researcher Collin Mulliner carried out over the past few months and laid out during a talk at the Black Hat security conference in Las Vegas. It threw more than 500,000 specially manipulated SMS messages at smart phones running operating systems made by Apple, Google and Microsoft to see how they might react. To save the researchers a bundle in fees charged by the phone carriers, they created a man-in-the-middle channel between the devices' application processor and modem so the messages didn't have to be sent over the network.

Mulliner also reported several bugs that can cause smart phones running Google's Android and Microsoft's Windows Mobile operating systems to crash. Because SMS messages are stored on carrier servers until the recipient is online, hackers can create long-lasting denial-of-service attacks by queuing up a large number of the malformed SMS messages.

Their talk came on the heels of one given by researchers Luis Miras, reverse engineer for RingZero, and Zane Lackey, senior security consultant for iSEC Partners. They showed it was possible to deliver MMS, or multimedia messaging service, messages over rogue servers that completely bypass the systems carriers use to block communications containing malware, spam and other malicious content.

That makes it possible for them to spoof the phone numbers of the sender, allowing them to masquerade as a recipient's bank, friend or other trusted party. They can also spoof the date and time stamps that appear on the messages.

One possible attack might involve sending a message that purports to come from the victim's carrier that warns the phone needs to be updated immediately and contains a link to software that creates a backdoor on the device instead.

The attack works by manipulating certain fields in the message headers so they include values that are intended to be used only by the carriers. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.