
The popular iOS hacker and security researcher, pod2g, recently revealed a newly-discovered security issue that is found in all versions of iOS. The security issue could allow malicious parties to spoof SMS messages, making the recipient think that a message came from a trusted sender, when it in fact did not. The issue is related to iOS’ handling of User Data Header (UDH) information, an optional section of a text payload that allows users to specify certain information such as changing the reply-to number on a message to a different number. The iPhone’s handling of this optional information could leave recipients open to targeted SMS spoofing attacks. Pod2g mentioned the following regarding the vulnerability:
In the text payload, a section called UDH (User Data Header) is optional but defines lot of advanced features not all mobiles are compatible with. One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer to the text, he will not respond to the original number, but to the specified one.
Most carriers don't check this part of the message, which means one can write whatever he wants in this section : a special number like 911, or the number of somebody else.
In a good implementation of this feature, the receiver would see the original phone number and the reply-to one. On iPhone, when you see the message, it seems to come from the reply-to number, and you [lose] track of the origin.
Most carriers don't check this part of the message, which means one can write whatever he wants in this section : a special number like 911, or the number of somebody else.
In a good implementation of this feature, the receiver would see the original phone number and the reply-to one. On iPhone, when you see the message, it seems to come from the reply-to number, and you [lose] track of the origin.
The issue is still an important one and pod2g is trying to bring this to the attention of Apple in hopes of having the Cupertino California company patch the flaw in their mobile operating system.
Source: pod2g (blog)
Message