Vulnerabilities / Threats
7/29/2009
07:08 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Black Hat: Android, iPhone SMS Flaws Revealed

Security researchers have identified several SMS vulnerabilities that can be used to deny service to mobile phones. They're presenting on Thursday but their findings have been published.

In a presentation at the Black Hat security conference in Las Vegas on Thursday, security researchers Charlie Miller and Collin Mulliner are scheduled to discuss SMS vulnerabilities that affect various mobile platforms, including Android, iPhone, and Windows Mobile.

Using the Sully fuzzing framework, the researchers have developed a way to identify flaws in SMS systems in mobile devices. Fuzzing is a form of automated software testing that involves entering random or unexpected data. Crashes or unexpected behavior arising from such input can then be analyzed as a potential vulnerability.

"Until now most of the SMS related security issues have been found by accident," state Miller and Mulliner in a paper that describes their approach. This, they explain, is because sending SMS messages costs money and because lack of access to source code for SMS implementations has meant hunting for bugs by trial and error.

The two researchers created a layer, called the injector, just above the bottom of the telephony stack that performs a man-in-the-middle attack by intercepting communication between a mobile device's modem and multiplexer.

The pair state that they found multiple SMS vulnerabilities on Android and iPhone systems and are still working on Windows Mobile systems.

In iPhone OS 2.2 and 2.2.1, they were able to crash the iPhone's SpringBoard window management application and the iPhone's CommCenter, which manages iPhone connectivity.

"This bug can be utilized for a serious denial-of-service attack since the victim can be effectively barred from making and receiving phone calls," the researchers claim.

They found a similar bug that affects Android OS 1.0, 1.1, and 1.5. "The bug is similar to the second iPhone bug in the way that it kills the telephony process (com.android.phone) and thus kicks the Android device from the mobile phone network," the pair state in their paper. "On Android the bug is a little more interesting since it will permanently kick the target device off the network if the SIM card residing in the phone has a PIN set."

Apple did not respond to a request to confirm reports that it is working on a fix for the iPhone vulnerabilities.

Google confirmed that the Android issue has been patched.

Miller and Mulliner are scheduled to present on Thursday, from 11:15 A.M. to 12:30 P.M., in the Milano Ballroom at Caesar's Palace in Las Vegas, where Black Hat is being held.

Black Hat is owned by TechWeb, which also publishes InformationWeek.

Update: Article updated to reflect Google's comment.

InformationWeek has published an in-depth report on smartphone security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6278
Published: 2014-09-30
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and m...

CVE-2014-6805
Published: 2014-09-30
The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6806
Published: 2014-09-30
The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6807
Published: 2014-09-30
The OLA School (aka com.conduit.app_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6808
Published: 2014-09-30
The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.