Members
  • Total Members: 12814
  • Latest: Rono
Stats
  • Total Posts: 28518
  • Total Topics: 8240
  • Online Today: 1026
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Apple patching serious SMS vulnerability on iPhone  (Read 1584 times)

0 Members and 1 Guest are viewing this topic.

mike2009

  • SCF Member
  • **
  • Posts: 14
  • KARMA: 1
Apple patching serious SMS vulnerability on iPhone
« on: 03. July 2009., 05:40:34 »


Apple Inc. is working to fix an iPhone vulnerability that could allow an attacker to remotely install and run unsigned software code with root access to the phone.

The attack in question exploits a weakness in the way iPhones handle text messages received via SMS (Short Message Service), said security researcher Charlie Miller, during a presentation at the SyScan conference in Singapore on Thursday. He didn't provide a detailed description of the SMS vulnerability, citing an agreement with Apple.

Miller is an authority on Mac OS X security, and is a co-author of The Mac Hacker's Handbook.

The SMS vulnerability allows an attacker to run software code on the phone that is sent by SMS over a mobile operator's network. The malicious code could include commands to monitor the location of the phone using GPS technology, turn on the phone's microphone to eavesdrop on conversations, or make the phone join a distributed denial-of-service attack or a botnet, Miller said

Apple expects to have a fix ready later this month, before Miller discusses the attack in greater detail during a planned presentation at the Black Hat USA conference in Las Vegas.

Despite the SMS vulnerability, the stripped-down version of Mac OS X used in the iPhone makes it more secure than computers running the full-blown version of the operating system, Miller said.

For starters, the stripped-down version presents fewer options for attackers because it doesn't have certain applications and features, such as support for Adobe Flash and Java, that hackers might otherwise be able to exploit. In addition, the iPhone includes hardware protection for data stored in memory and it is designed to only run software code that has been digitally signed by Apple.

The iPhone also requires applications to run in a sandbox, a security feature that isolates them from other applications and limits their access to the phone's capabilities. But SMS offers a way for attackers to get greater access to the iPhone's capabilities, Miller said.

"SMS is a great vector to attack the iPhone," he said.

Most often used to send brief text messages between cell phones, SMS can also send binary code to an iPhone, which then processes the code without any user interaction. Each SMS message is limited to 140 bytes, but longer sequences can be sent to the phone as multiple messages that are automatically reassembled.

This feature allows larger programs to be delivered to a phone, Miller said.

In addition, vulnerabilities found in the iPhone's SMS function give an attacker root access to the handset, Miller said. That's not the case for the iPhone's other applications, such as its browser, where vulnerabilities only give an attacker access to the application's sandbox.

"The iPhone is more secure than OS X, but SMS could be a critical vulnerability," Miller said.

Samker's Computer Forum - SCforum.info

Apple patching serious SMS vulnerability on iPhone
« on: 03. July 2009., 05:40:34 »




 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising