Thought you received a text from your beloved ex wanting to get back together? It could be one of your friends pranking you, at least if you use an iPhone. An iOS "hacker" going by pod2g is drawing fresh attention to a long-extant SMS spoofing flaw within iOS that allows a prankster to pose as someone else when sending an SMS to your device—a flaw that is still present in the latest beta of iOS 6.
First things first: this loophole reportedly does not involve any kind of code execution, so a dedicated hacker won't be able to use it to take over your iPhone. But there could still be potential privacy breaches as a result—a hacker could make use of a tool in order to send a specially crafted SMS to your phone claiming to be from someone else that you actually trust, such as your bank asking for verification information, or a "friend" asking for your home address.
As pod2g noted in his blog post on Friday, practically anyone can do this with a smartphone or a modem and an SMS gateway, sending SMSes in raw Protocol Description Unit (PDU) format with a User Data Header (UDH) that specifies a different reply address than the one that's actually sending the message. (Like sending an e-mail that claims to be coming from a different address than the one you're sending it from.) "If the destination mobile is compatible with it, and if the receiver tries to answer the text, he will not respond to the original number, but to the specified one. Most carriers don't check this part of the message, which means one can write whatever he wants in this section: a special number like 911, or the number of somebody else," pod2g wrote. "On iPhone, when you see the message, it seems to come from the reply-to number, and you lose track of the origin."
Read 5 remaining paragraphs | Comments
DIGITAL JUICE
No comments:
Post a Comment
Thank's!