Feeds

Hijacking iPhones and other smart devices using SMS

No user interaction necessary

Using blade systems to cut costs and sharpen efficiencies

Black Hat Update: Apple says it has patched the vulnerability described below. The full story is here

Researchers have uncovered a bevy of vulnerabilities in smart phones made by multiple vendors, including one in Apple's iPhone that could allow an attacker to execute malicious code without requiring the victim to take any action at all.

The iPhone bug allows an attacker to take complete control of the coveted device simply by sending the owner an SMS, or short message service, message, said Charlie Miller, principal analyst at Independent Security Evaluators. He said he informed Apple's security team of the vulnerability several weeks ago and has yet to receive an official response.

The vulnerability is the same one Miller discussed three weeks ago, when he said he wasn't sure if it would allow him to do anything other than remotely crash an iPhone. Now that he's had more time to analyze the bug, he says he's confident he can remotely hijack the devices by doing nothing more than sending a malformed SMS message.

The bug resides in CommCenter, a service that's responsible for handling SMS, wireless and other functions in the iPhone. By default, it runs as root and isn't limited by an application sandbox. That makes it an ideal vector for taking control of the device. What's more, the messages are delivered automatically and often aren't easy for users to block.

The attack is carried out by dropping the last byte or two from UDH, or user data header, contained in the message, something that's fairly trivial to do.

Miller's discovery is the result of an aggressive fuzzing endeavor he and fellow researcher Collin Mulliner carried out over the past few months and laid out during a talk at the Black Hat security conference in Las Vegas. It threw more than 500,000 specially manipulated SMS messages at smart phones running operating systems made by Apple, Google and Microsoft to see how they might react. To save the researchers a bundle in fees charged by the phone carriers, they created a man-in-the-middle channel between the devices' application processor and modem so the messages didn't have to be sent over the network.

Mulliner also reported several bugs that can cause smart phones running Google's Android and Microsoft's Windows Mobile operating systems to crash. Because SMS messages are stored on carrier servers until the recipient is online, hackers can create long-lasting denial-of-service attacks by queuing up a large number of the malformed SMS messages.

Their talk came on the heels of one given by researchers Luis Miras, reverse engineer for RingZero, and Zane Lackey, senior security consultant for iSEC Partners. They showed it was possible to deliver MMS, or multimedia messaging service, messages over rogue servers that completely bypass the systems carriers use to block communications containing malware, spam and other malicious content.

That makes it possible for them to spoof the phone numbers of the sender, allowing them to masquerade as a recipient's bank, friend or other trusted party. They can also spoof the date and time stamps that appear on the messages.

One possible attack might involve sending a message that purports to come from the victim's carrier that warns the phone needs to be updated immediately and contains a link to software that creates a backdoor on the device instead.

The attack works by manipulating certain fields in the message headers so they include values that are intended to be used only by the carriers. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.