BlackHat is a yearly security conference where Industry’s most Dark side secrets are revealed.
Few years back, Sir Lenin identified a Cisco security flaw that could bring down EVERY SINGLE CISCO ROUTER in the world. Lenin was from ISS (Internet Security Systems), he was fired & tortured, and what not. Cisco, at no cost, wanted their secrets to be revealed. Well, that was years back. since that year, we have more darker sides of the IT world.
A serious security flaw that could allow a remote attacker to take control of the victim’s iPhone by sending a specially constructed SMS message. The vulnerability might be publicly demonstrated and explained as per the schedule here at the Black Hat security conference held in Las Vegas.
The bad news is, Apple hasn’t released a patch of any sort, yet.
As researchers who had found the bug, Charlie Miller and Collin Mulliner explain at the Black Hat website,
“We present techniques which allow a researcher to inject SMS messages into iPhone, Android and Windows Mobile devices. This method does not use the carrier and so is free (and invisible to the carrier).“
And while security advisories such as this one appear on a monthly basis, often not being very dangerous to the general public, this threat seems to be real. The attack was demonstrated on the iPhone of Cnet’s Elinor Mills; here’s her explanation of how this attack works in practice:
“Here’s what happened: While I was talking on the phone to Charlie Miller, his partner, Collin Mulliner, sent me a text message from his phone. One minute I’m talking to Miller and the next minute my phone is dead, and this time it’s not AT&T’s fault. After a few seconds it came back to life, but I was not able to make or receive calls until I rebooted.“
Although Miller and Mulliner mention Android and Windows Mobile phones as well, it seems they’re actually about to present several SMS-based attacks. A vulnerability in Android was promptly fixed by Google, while another vulnerability in HTC’s code (company that makes Android and Windows Mobile-based phones) can render the phone useless, but it doesn’t allow the attacker to take control of it. iPhone’s security flaw, enabled by a memory corruption bug in the way it handles SMS messages, is by far the most serious.
Currently, the only thing you can do to stop the attack is watch for odd-looking SMS messages (empty or containing a single square character) and turn off your iPhone quickly if you see one. It all sounds quite scary; we’re hoping to see a quick patch from Apple. If this hack spreads – and big ones usually do – it might be a serious risk for every iPhone owner.
“Until now most of the SMS related security issues have been found by accident,” state Miller and Mulliner in a paper that describes their approach. This, they explain, is because sending SMS messages costs money and because lack of access to source code for SMS implementations has meant hunting for bugs by trial and error.The two researchers created a layer, called the injector, just above the bottom of the telephony stack that performs a man-in-the-middle attack by intercepting communication between a mobile device’s modem and multiplexer.
The pair state that they found multiple SMS vulnerabilities on Android and iPhone systems and are still working on Windows Mobile systems.
In iPhone OS 2.2 and 2.2.1, they were able to crash the iPhone’s SpringBoard window management application and the iPhone’s CommCenter, which manages iPhone connectivity.
“This bug can be utilized for a serious denial-of-service attack since the victim can be effectively barred from making and receiving phone calls,” the researchers claim.
They found a similar bug that affects Android OS 1.0, 1.1, and 1.5. “The bug is similar to the second iPhone bug in the way that it kills the telephony process (com.android.phone) and thus kicks the Android device from the mobile phone network,” the pair state in their paper. “On Android the bug is a little more interesting since it will permanently kick the target device off the network if the SIM card residing in the phone has a PIN set.”
Though Apple did not respond to a request to confirm reports, Google is a step ahead of it as they confirmed that the Android issue has been patched.