IPhone Hack Unveiled at BlackHat
Due to an SMS vulnerability, iPhones can be knocked off the network by flooding them with malformed SMS messages.
iPhone says, “Hack me and you fail.”
From InformationWeek here:
In a presentation at the Black Hat security conference in Las Vegas on Thursday, security researchers Charlie Miller and Collin Mulliner are scheduled to discuss SMS vulnerabilities iPhone.
Using the Sully fuzzing framework, the researchers have developed a way to identify flaws in SMS systems in mobile devices. Fuzzing is a form of automated software testing that involves entering random or unexpected data. Crashes or unexpected behavior arising from such input can then be analyzed as a potential vulnerability.
The two researchers created a layer, called the injector, just above the bottom of the telephony stack that performs a man-in-the-middle attack by intercepting communication between a mobile device’s modem and multiplexer.
The pair state that they found multiple SMS vulnerabilities on Android and iPhone systems and are still working on Windows Mobile systems.
In iPhone OS 2.2 and 2.2.1, they were able to crash the iPhone’s SpringBoard window management application and the iPhone’s CommCenter, which manages iPhone connectivity.
“This bug can be utilized for a serious denial-of-service attack since the victim can be effectively barred from making and receiving phone calls,” the researchers claim.
Other phones were vulnerable as well and patches are being issued as I write this. Bottom line, however is these are attacks that require some specialized equipment. I don’t expect any widespread exploitation.
Can I say it? I wanna say it.
Michael Jackson is ROLLING IN HIS GRAVE!
Oh, that was man in the mirror.
Every time I go to a security conference I am told that yet another device is man-in-the-middleable. I think we should just accept our fate that we are so cool that people wanna listen in on our data and talk about the weirdest stuff we can possibly think of at random intervals.