iOS SMS Security Flaw Revealed, Apple Says Use iMessage Instead

| News

SMS iPhone Security Flaw

Last week, jailbreak developer “pod2g” announced the discovery of a “severe” security flaw in SMS text messages on iOS. A vulnerability inherent to the legacy messaging format allows nefarious users to spoof the message’s sender and possibly trick recipients into responding with personal or financial information.

The flaw takes advantage of the ability to modify an SMS data header, a small piece of text that is optionally included with an SMS message that includes, among other information, a reply-to number. Hackers can easily modify the header to include a different reply-to number and make it appear to recipients that the message was sent by someone else, be it a financial institution, government, or business colleague.

Some SMS software shows the user the header information, including both the number that originally sent the message and the reply-to number. However, on every iPhone since the product’s launch, and persisting through the latest betas of iOS 6, only the reply-to number is visible to the end user.

“In a good implementation of this feature, the receiver would see the original phone number and the reply-to one. On iPhone, when you see the message, it seems to come from the reply-to number, and you loose track of the origin,” pod2g wrote in describing the flaw.

For its part, Apple responded to the announcement of the flaw, suggesting that users switch to its iMessage protocol, something that mobile carriers, which derive a significant amount of revenue from overpriced SMS fees, surely failed to appreciate. An Apple spokesperson gave the following statement to Engadget Saturday:

Apple takes security very seriously. When using iMessage instead of SMS, addresses are verified which protects against these kinds of spoofing attacks. One of the limitations of SMS is that it allows messages to be sent with spoofed addresses to any phone, so we urge customers to be extremely careful if they’re directed to an unknown website or address over SMS.

While Apple is happy to refer SMS users to its free iMessage alternative, the reality is that iOS users still need to communicate with SMS users on other platforms and that moving exclusively to iMessage is not a viable solution for most iOS owners. It is in this context that pod2g and others are imploring Apple to fix the way iOS handles SMS messaging.

Until Apple does so, iPhone owners should exercise caution in responding to SMS messages that request personal or financial information.

Teaser graphic via Shutterstock.

[via ReadWriteWeb]

Sign Up for the Newsletter

Join the TMO Express Daily Newsletter to get the latest Mac headlines in your e-mail every weekday.

5 Comments Leave Your Own

Lee Dronick

So what would it take for the carriers tomfix the vulnerability?

jfbiii

If it seems to come from the reply-to number, say, a trusted number, and you reply, and it goes to the reply-to number, wait…huh?

Lee Dronick

Jfbiii, if I am reading this correctly it is like in email where you can have different sent from and reply to addresses.

jfbiii

?In a good implementation of this feature, the receiver would see the original phone number and the reply-to one. On iPhone, when you see the message, it seems to come from the reply-to number, and you loose track of the origin,? pod2g wrote in describing the flaw.

Right. But their description doesn’t make sense as an implementation. If I send someone a message with a spoofed reply-to number, and the iphone thinks the message came from that reply-to number, and sends any message back to that reply-to number, how am I supposed to hack them if I’m not in control of the reply-to number?

Paul Goodwin

Security flaw fixed or not I would still never send anything like financial info or passwords, or proprietary across the Internet or SMS. I’ve seen web page forgeries that pulled up from email forgeries of banks where it was almost impossible to tell it wasn’t real. I especially wouldn’t respond to some SMS message requesting anything like that. SMS is for “don’t forget to pick up the coney dogs on the way home”......” OK honey”

Log-in to comment