iPhone Bug Allows SMS Spoofing

Trailrunner7 writes "The iPhone SMS app contains a quirky bug that could allow someone to send a user a text message that appears to come from any number that the sender specifies. The researcher who discovered the bug said it could be used by attackers to spoof messages from a bank or credit card company and send the victim to a target site controlled by the attacker. The issue lies in the way iOS implements a section of the SMS message called User Data Header, which has a number of options, one of which allows the user to change the phone number that the text message appears to come from. The advent of mobile banking apps, some of which use SMS messages for out-of-band authentication, makes this kind of attack vector perhaps more worrisome and useful for attackers than it would seem at first blush."

Comments

What is old is new again...

[Anonymous Coward]

Pretty much iOS hides the SMS equivilent of the From: field, and only shows the Reply To: field

Lovely fail there since a lot of sites use SMS for some sort of authentication, Google, and Blizzard among them.

Re:What is old is new again...

[msauve]

"a lot of sites use SMS for some sort of authentication, Google, and Blizzard among them"

Their problem. They have poorly designed systems. The spoof mentioned is no different from what anyone can do with email, simply.

There are legitimate reasons to allow a sender to signify a different "from" number. One example might be someone using Google Voice, where they want to send an SMS via the carriers network (where a different phone number is associated), but have it appear as coming from the GV number to the recipient (or same, via an SMS gateway from a PC, etc.).

For security, similar to the common password reset procedures via email, sites might accept a request via SMS, but then return a necessary confirmation code to the "from" number. Even if you can send an SMS which appears to be from an arbitrary number, you can't get the reply (and confirmation code) unless you're actually associated with that number.

Problem with the iPhone, or the cell system?

[Bradmont]

I'm no apple fanboy by any stretch of the imagination, but this seems like a security vulnerability with the cell phone system, not with the app. No client should ever be trusted in a network security context, and this is no different. It may have shown up as a bug in the iPhone software, but it is the cell networks that should have protection against these sorts of things...

Re:Problem with the iPhone, or the cell system?

[GameboyRMH]

It is sort of design flaw in the cell phone system that the phone has any say in the matter, but that's a done deal and now this is a bug in the phone. This is the sort of thing that should be firmware-controlled.

Why trust everything to these little devices.

[Anonymous Coward]

I don't understand why people even do banking on a device that is so easily lost. And before people start screaming at me, please know that this is coming from someone who had his bank account broken into from using only legitimate ATMs from actual banks(didn't even know there was such a thing as a card skimmer).

Re:So what?

[Em Adespoton]

The method is:
1) send you a fake email telling you to log into your account to update your settings/read the policy change/etc.
2) link to a phishing site, which pulls all the assets from the legit bank, but redirects the password form
3) trigger an SMS event just like the real bank, to send you the token needed to log in to the phishing site
4) harvest your account info.
5) Profit!

However, it'd make more sense to just make the phishing site a proxy and let the actual bank send the SMS token to the customer. That way, the customer logs in for them, and they can then do whatever they want....