Security Researcher Uncovers Apple iOS SMS Bug - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

11:03 AM

Security Researcher Uncovers Apple iOS SMS Bug

Vulnerability in Apple's iOS platform could allow hackers to send phishing messages via text, but there's no need to panic. Yet.

Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
Apple iPhone 5 Vs. Samsung Galaxy S III: What We Know
(click image for larger view and for slideshow)
An Apple iOS security researcher who goes by the handle pod2g has unearthed a bug in Apple's iOS platform. The bug, which pod2g says others should know about, is present in all versions of iOS up to and including iOS 6 beta 4. The bug essentially allows hackers to spoof the reply-to number in a text message.

Text messages are of course bits of text sent between cellphones. Americans send billions and billions of them to one another each month. They're such a common form of communication that most people probably never stop to think that they might be insecure.

In a post on his blog, pod2g explains that text message are converted from the original text to PDUs (protocol description units), which are sent to the baseband and then fired off across the network.

"In the text payload, a section called UDH (user data header) is optional but defines [a] lot of advanced features not all mobiles are compatible with," wrote pod2g. "One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer to the text, he will not respond to the original number, but to the specified one. Most carriers don't check this part of the message, which means one can write whatever he wants in this section: a special number like 911, or the number of somebody else."

Why is this particular bug cause for concern?

Pod2g believes that ne'er-do-wells could send phishing messages via SMS. In one case, a person could receive a message that would appear to come from their bank, requesting information or sending them to a website. If they respond to the message, the reply wouldn't go to the bank, but instead to the phisher. If you're fool enough to send personal information via SMS, then you could be in a bit of trouble.

[ So much for Apple's walled-garden security approach. Apple Security Talk Suggests iOS Limits. ]

For the CSI lovers out there, pod2G also explains that bad guys could send spoofed messages to your device that would appear to have come from you. In other words, pirates or other nefarious types could plant false evidence on someone's iPhone.

Apple hasn't acknowledged the bug, but there's little reason to worry right now. Most financial or other businesses that might send a text message to an iPhone are delivering information, not requesting it. As long as you don't respond to such messages, you'll be fine.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

11 Things IT Professionals Wish They Knew Earlier in Their Careers
Lisa Morgan, Freelance Writer,  4/6/2021
Time to Shift Your Job Search Out of Neutral
Jessica Davis, Senior Editor, Enterprise Apps,  3/31/2021
Does Identity Hinder Hybrid-Cloud and Multi-Cloud Adoption?
Joao-Pierre S. Ruth, Senior Writer,  4/1/2021
White Papers
Register for InformationWeek Newsletters
The State of Cloud Computing - Fall 2020
The State of Cloud Computing - Fall 2020
Download this report to compare how cloud usage and spending patterns have changed in 2020, and how respondents think they'll evolve over the next two years.
Current Issue
Successful Strategies for Digital Transformation
Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
Flash Poll