Affiliate Disclosure
If you buy through our links, we may get a commission. Read our ethics policy.

Apple working to fix unreleased iPhone SMS exploit

Tipped off by a Mac OS X security expert, Apple is working to repair a serious security flaw in the iPhone’s operating system – one that could allow an attacker to track the phone’s location via GPS, eavesdrop on conversations via the microphone, or create a mobile bot net capable of unleashing denial of service attacks.

The attack takes advantage of a vulnerability in the phone’s short messaging service, or SMS, feature, allowing an outside party into the phone’s root access without the owner’s knowledge. Security researcher Charles Miller, co-author of The Mac Hacker’s Handbook, announced his discovery Thursday at the SyScan Conference in Singapore, according to Computerworld.

Apple plans to have the fix released later this month, before Miller gives his scheduled speech at the Black Hat Technical Security Conference in Los Angeles. At the July 25-30 conference, Miller will be joined by Colin Mulliner for a talk entitled “Fuzzing the Phone in Your Phone,” which will show attendees how to discover vulnerabilities in a variety of smartphones.

Miller has not specifically detailed how the SMS exploit is done, citing an agreement with Apple. But he will discuss the attack in length at the Black Hat conference.

The exploit takes advantage of the fact that SMS can send binary code to an iPhone. That code is automatically processed without user interaction, and can be compiled from multiple messages, allowing larger programs to be sent to a phone.

For a widely-adopted platform, Apple’s iPhone has had remarkably little in the way of discovered vulnerabilities in its short history. In 2007, a security firm – including Miller – notified Apple of the phone’s first security flaw, soon after the hardware had been released. It was subsequently fixed by Apple.

Miller said that the iPhone’s stripped-down version of OS X makes it more secure than the full-fledged operating system. And because it lacks support for Adobe Flash and Java, isolates individual applications from one another, and only allows software that has been digitally signed by Apple, it is less likely to have security flaws than a full-form computer.



23 Comments

mactripper 16 Years · 1307 comments

Quote:
For a widely-adopted platform, Apple’s iPhone has had remarkably little in the way of discovered vulnerabilities in its short history. In 2007, a security firm – including Miller – notified Apple of the phone’s first security flaw, soon after the hardware had been released. It was subsequently fixed by Apple.


Oh, I beg to differ greatly and I have a link to prove that 46 vulnerabilities were fixed in iPhone 3.0.

I'll be right back with a link.

Quote:
iPhone OS 3.0 fixes 46 vulnerabilities

Apple has released version 3.0 of its iPhone mobile operating system. The update not only includes several new features, but also fixes 46 security vulnerabilities. Version 3.0 of the iPhone OS fixes 23 vulnerabilities in WebKit and Safari alone. According to Apple, many of the problems could have lead to the execution of arbitrary code when visiting a maliciously crafted website. Other vulnerabilities include unexpected application termination or arbitrary code execution when opening a maliciously crafted PDF document or image file and possible disclosure of sensitive information when connecting to a malicious Exchange server.

http://www.h-online.com/security/iPh...--/news/113563http://arstechnica.com/apple/news/20...rabilities.arshttp://blogs.zdnet.com/security/?p=3644

Also Apple can replace the iPhone glass at retail stores. It uses a suction type device to pull the old one off.

alectheking 16 Years · 206 comments

Quote:
Originally Posted by thespaz

First!

why do you come to the forums just to say that?

napoleon_phoneapart 18 Years · 550 comments

Quote:
Originally Posted by alectheking

why do you come to the forums just to say that?

I think I know of him from MacRumors and he seems to have self-esteem issues.

virgil-tb2 17 Years · 1416 comments

What's *not* stated in Miller's description of the vulnerability is that the other apps are sandboxed anyway, so even if the hacker sends an SMS with (presumably a picture attachment), gets the code to run and gets root access, all they have access to is the low level system stuff and the automatic messages. It's hard to tell until he fully describes it, but it doesn't seem like this would give anyone access to your data, just some low level phone hardware items.