Security Flaw In iPhone's SMS System Found

Edward Kirk · July 2nd, 2009, 09:00 PM

Security researcher Charlie Miller claimed at the SyScan conference in Singapore that he has discovered a new significant exploit in the iPhone's SMS system. The flaw may "allow an attacker to remotely install and run unsigned software code with root access to the phone."

"The SMS vulnerability allows an attacker to run software code on the phone that is sent by SMS over a mobile operator's network. The malicious code could include commands to monitor the location of the phone using GPS, turn on the phone's microphone to eavesdrop on conversations, or make the phone join a distributed denial of service attack or a botnet."

It's unlikely that there could be any risk of a wide-spead attack on iPhones, but the shear number of iPhones out there make it an issue. Miller has agreed with Apple to wait until Black Hat USA expo in Las Vegas later this year to release the details of the exploit, giving Apple a window of time to patch the exploit.

[via HotHardware]

o-matic · July 2nd, 2009, 10:42 PM #2

wide-spread

Beast · July 3rd, 2009, 12:08 AM #3

Anyone ever see Eagle Eye?

madscientest · July 3rd, 2009, 12:22 PM

they act like he is the only one in existence that can find it....please.

thuggedout · July 3rd, 2009, 03:07 PM #5

So this would be sent through an email and then installed onto your phone if you open the emil? just wondering, because that wouldn't be good if it was that simple to get control of those features on a persons phone.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Edward Kirk WrAdminterizer Join Date: Apr 2007 Location: Illinois, USA Posts: 3,084 Thanks: 19 Thanked 26 Times in 25 Posts	Security Flaw In iPhone's SMS System Found - July 2nd, 2009, 09:00 PM #1
	<script language="JavaScript" src="http://adserver1.backbeatmedia.com/servlet/ajrotator/13894/222/viewJScript?pool=13886&type=3158&pos=20&zone=5000"></script> Security researcher Charlie Miller claimed at the SyScan conference in Singapore that he has discovered a new significant exploit in the iPhone's SMS system. The flaw may "allow an attacker to remotely install and run unsigned software code with root access to the phone." "The SMS vulnerability allows an attacker to run software code on the phone that is sent by SMS over a mobile operator's network. The malicious code could include commands to monitor the location of the phone using GPS, turn on the phone's microphone to eavesdrop on conversations, or make the phone join a distributed denial of service attack or a botnet." It's unlikely that there could be any risk of a wide-spead attack on iPhones, but the shear number of iPhones out there make it an issue. Miller has agreed with Apple to wait until Black Hat USA expo in Las Vegas later this year to release the details of the exploit, giving Apple a window of time to patch the exploit. [via HotHardware] __________________ About my iPhone: iPhone & Color: iPhone 3G 16GB White iPhone Version: 3.0 Computer & OS: MacBook Pro 15", Mac OS X 10.5.4 Twitter

o-matic iPA Fanatic Join Date: Nov 2007 Posts: 91 Thanks: 2 Thanked 0 Times in 0 Posts	July 2nd, 2009, 10:42 PM #2
	wide-spread

Beast Rocks the Board Join Date: Dec 2007 Location: In my house. Posts: 159 Thanks: 3 Thanked 1 Time in 1 Post	July 3rd, 2009, 12:08 AM #3
	Anyone ever see Eagle Eye?

madscientest Rocks the Board Join Date: Sep 2007 Location: CA Posts: 294 Thanks: 1 Thanked 0 Times in 0 Posts	so lame of apple to wait to fix this - July 3rd, 2009, 12:22 PM #4
	they act like he is the only one in existence that can find it....please.

thuggedout iPA Fanatic Join Date: Oct 2007 Location: NYC Posts: 95 Thanks: 1 Thanked 1 Time in 1 Post	July 3rd, 2009, 03:07 PM #5
	So this would be sent through an email and then installed onto your phone if you open the emil? just wondering, because that wouldn't be good if it was that simple to get control of those features on a persons phone. __________________ Free your mind and your iPhone.