This Apple iOS SMS issue serves as a reminder that SMS messages, like email, can be spoofed to fool users and conceal the true identity of the sender.
The ability to spoof the reply-to information on Apple iOS
SMS messages is a reminder that such messages should not be considered any more
secure than email when it comes to authenticating senders, experts say.
A scheme for spoofing the information was disclosed Aug. 17
on a
blog dedicated to research on Apple iOS security. The issue allows
attackers to disguise the sender and potentially trick whoever receives the message
by modifying the SMS data header. This allows the attacker to include a
different reply-to number and possibly impersonate other people or
organizations.
"If you either own a smartphone, or a modem and an
account in a SMS gateway, you can send texts in raw PDU format (some services
also exist to send a text with an HTTP request in raw PDU format)," blogged
researcher Pod2g, who disclosed the flaw last week.
"In the text payload, a section called UDH (User Data
Header) is optional but defines lot(s) of advanced features not all mobiles are
compatible with," the researcher continued. "One of these
options enables the user to change the reply address of the text. If the
destination mobile is compatible with it and if the receiver tries to answer to
the text, he will not respond to the original number, but to the specified one."
"In a good implementation of this feature, the receiver would see the original phone number and the reply-to
one," Pod2g blogged. "On iPhone(s), when you see the message, it
seems to come from the reply-to number, and you [lose] track of the origin. Why
is it an issue? Pirates could send a message that seems to come from the bank
of the receiver asking for some private information, or inviting them to go to
a dedicated website."
In a response
to Engadget, Apple said that it takes security "very seriously,"
and highlighted the availability of iMessageâwhich works on the iPhone, iPad or
iPod Touch running iOS 5 or later and Mac OSX 10.8 (Mountain Lion) or later.
"When using iMessage instead of SMS, addresses are verified which protects against these kinds of spoofing
attacks," a spokesperson told Engadget. "One of the limitations of
SMS is that it allows messages to be sent with spoofed addresses to any phone,
so we urge customers to be extremely careful if they're directed to an unknown
website or address over SMS."
Michael Sutton, vice president of security research at
Zscaler's ThreatLabz, said the issue was not an iOS vulnerability per
se.
"The iOS application is not uniquely vulnerable due to a coding error, but rather includes and relies on a
field that most SMS clients do notânamely the 'reply to' field," he said. "Just
as email is easily spoofable as fields indicating the origin of a message are
not verified, the same is true of SMS."
Spoofing the 'reply to' field is trivial, he added, but the damage that can be done is limited.
"While a user could be tricked into sending an SMS message to a location other than what they intended
to, this issue could not be used to compromise the device in any way," he
explained. "It could however be used in a social engineering attack to
trick a user into believing that a message came from a particular source. This
is no different than receiving a spoofed email message and users should be
equally as suspicious of unexpected SMS text as they are of emailâthe true
source in both cases is unverified."
Users should not be willing to disclose information over SMS that they expect to be secure, nor should they
assume that it is a trustworthy channel for communications with banks or other sensitive
service providers, said Derek Halliday, the Lead Security Product Manager
at Lookout Mobile Security.
"SMS should not be considered a secure communication method, it is no more trustworthy than email
in this regard," he said.
Email
Print
