The iPhone may not be as secure as you think. New SMS and zero-day hacks show that iOS can be manipulated for use in phishing scams. (Photo: flickr.com / Yutaka Tsutano)
If you own an iPhone, you may never be able to trust an SMS message that you receive ever again. Apple is warning customers that messages sent via SMS may not be what users think. The iPhone allows hackers to change the “reply to” field of SMS messages so that someone may not be responding to exactly who they think they are.
Pod2G, the famous hacker that revealed the exploit, posted at length about how to trick iOS SMS functions. The hacker points out that the exploit still exists in Apple’s new operating system, iOS 6 Beta 3, which is an early version of the operating system expected to run on the next iteration of the iPhone, unofficially dubbed the “iPhone 5” by Apple fans.
After writing at length about the exploit he’s discovered, Pod2G begs Apple to fix the bug before the final release of the operating system. The hacker believes that there are innumerable ways for hackers to take advantage of this particular security flaw.
“A SMS text is basically a few bytes of data exchanged between two mobile phones, with the carrier transporting the information. When the user writes a message, it is converted to PDU (Protocol Description Unit) by the mobile and passed to the baseband for delivery,” explains Pod2G.
“…In a good implementation of this feature, the receiver would see the original phone number and the reply-to one. On iPhone, when you see the message, it seems to come from the reply-to number, and you loose track of the origin,” he adds.
The hacker explains that existing SMS on the iPhone could be an issue because pirates could send a message that appears to come from a different sender such as someone’s bank or relatives asking for private information. The deceptive method of gathering personal information about people an old hacking method known as phishing. By making it easy for hackers to deceive people, Apple is, in essence, making it extremely easy for people to phish for private information.
Pod2G also warns Apple and the world that someone could send spoofed messages to a device and use it as false evidence. It’s an extreme scenario, but it could cause tremendous legal problems for any party involved. Pod2G adds that basically anything you could think of to mislead someone using a false identity could be used through the exploit.
Apple has simply asked iPhone users to use iMessage rather than using SMS messages to communicate with their loved ones. “Apple takes security very seriously,” the company said in a statement. “When using iMessage instead of SMS, addresses are verified, which protects against these kinds of spoofing attacks.”
“One of the limitations of SMS is that it allows messages to be sent with spoofed addresses to any phone, so we urge customers to be extremely careful if they’re directed to an unknown website or address over SMS,” the company added.
Hackers had previously reported that iOS could be infiltrated through a zero-day hack. “You can infect the phone without a passphrase. The virus or bit of code sits on the phone, waiting for the user to unlock it,” said security researcher Jonathan Zdziarski in a CNET report. “Give me two minutes with somebody’s phone and I can dump the entire file system from it.” CNET editor Seth Rosenblatt explains that iOS is still relatively safe, but hackers are still able to exploit phones by manipulating apps.