Dan Goodin of The Register reports:
Researchers have uncovered a bevy of vulnerabilities in smart phones made by multiple vendors, including one in Apple's iPhone that could allow an attacker to execute malicious code without requiring the victim to take any action at all.
The iPhone bug allows an attacker to take complete control of the coveted device simply by sending the owner an SMS, or short message service, message, said Charlie Miller, principal analyst at Independent Security Evaluators. He said he informed Apple's security team of the vulnerability several weeks ago and has yet to receive an official response.
The vulnerability is the same one Miller discussed three weeks ago, when he said he wasn't sure if it would allow him to do anything other than remotely crash an iPhone. Now that he's had more time to analyse the bug, he says he's confident he can remotely hijack the devices by doing nothing more than sending a malformed SMS message.
The bug resides in CommCenter, a service that's responsible for handling SMS, wireless and other functions in the iPhone. By default, it runs as root and isn't limited by an application sandbox. That makes it an ideal vector for taking control of the device. What's more, the messages are delivered automatically and often aren't easy for users to block.
The attack is carried out by dropping the last byte or two from UDH, or user data header, contained in the message, something that's fairly trivial to do.
Miller's discovery is the result of an aggressive fuzzing endeavour he and fellow researcher Collin Mulliner carried out over the past few months and laid out during a talk at the Black Hat security conference in Las Vegas. It threw more than 500,000 specially manipulated SMS messages at smart phones running operating systems made by Apple, Google and Microsoft to see how they might react. To save the researchers a bundle in fees charged by the phone carriers, they created a man-in-the-middle channel between the devices' application processor and modem so the messages didn't have to be sent over the network.
Mulliner also reported several bugs that can cause smart phones running Google's Android and Microsoft's Windows Mobile operating systems to crash. Because SMS messages are stored on carrier servers until the recipient is online, hackers can create long-lasting denial-of-service attacks by queueing up a large number of the malformed SMS messages.
Their talk came on the heels of one given by researchers Luis Miras, reverse engineer for RingZero, and Zane Lackey, senior security consultant for iSEC Partners. They showed it was possible to deliver MMS, or multimedia messaging service, messages over rogue servers that completely bypass the systems carriers use to block communications containing malware, spam and other malicious content.
That makes it possible for them to spoof the phone numbers of the sender, allowing them to masquerade as a recipient's bank, friend or other trusted party. They can also spoof the date and time stamps that appear on the messages.
One possible attack might involve sending a message that purports to come from the victim's carrier that warns the phone needs to be updated immediately and contains a link to software that creates a backdoor on the device instead.
The attack works by manipulating certain fields in the message headers so they include values that are intended to be used only by the carriers
