"Device manufacturers, like all members of the mobile ecosystem should aim to take security seriously and ensure their devices comply with a wide range of standards and technical recommendations," says Cathal McDaid, Security Consultant, AdaptiveMobile. "For SMS to remain a trusted, clean channel, companies need to be vigilant that their products both properly conform to standards and don't inadvertently expose flaws that can compromise their customers.
The exploit was first revealed by a researcher on the pod2g blog and the exploit misuses an optional 'Reply Address' field within the SMS protocol upper-layers. If misused, the iPhone SMS client displays a different address / phone number as the sending address rather than the actual originating address. This could be used to show recipients that text messages are from someone familiar, when they originate from a hacker or external party.
"We know conclusively that this is not a network problem because the 3GPP specification - which outlines how modern mobile phones and networks operate today - discusses the security implications of this field in all phones and give recommendations on how to avoid malicious use of this," continues McDaid. "We have tested this issue on Android, Windows Mobile, BlackBerry and Symbian phones and most of them simply ignore the 'reply address' field or display both the 'real' originating address and the reply address as per the specification recommendations. The iPhone, so far, is the only device which does not comply with these security recommendations."
Apple has responded to these claims, acknowledging the weakness, but without any stated intention of remedying the situation.
"Historically, the 'reply-address' field was introduced to allow users to reply to texts which were 'broadcast' from information agencies or marketing firms, for example. These broadcast systems may not be capable of receiving messages, so this system allows for more interaction," continues McDaid. "However, whilst most handsets now ignore this quirk, with the remainder treating the field correctly, Apple has left a significant vulnerability in its handsets which could allow consumers to be fooled and hand over personal details to hackers and criminals. This reinforces the importance of handset manufacturers, operators and security providers collaborating and helping to keep SMS as a secure, reliable and trusted channel."
-ends-
About AdaptiveMobile:
AdaptiveMobile is the world leader in mobile security, enabling trusted networks for the world's largest operator groups and protecting one in six subscribers globally. AdaptiveMobile provides Operators with the most comprehensive network-based security solutions enabling them to protect their consumer and enterprise customers against the growing threat of mobile abuse. www.adaptivemobile.com
Press contacts:
Rocket Communications (UK)
Ella Thompson / Sally Brown
Adaptive@rocketcomms.net
+44 8453 707 024
ACSCom PR (USA)
Anne Coyle
anne@acscompr.com
+1 857 222 6363
