Vulnerabilities / Threats
7/29/2009
07:08 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Black Hat: Android, iPhone SMS Flaws Revealed

Security researchers have identified several SMS vulnerabilities that can be used to deny service to mobile phones. They're presenting on Thursday but their findings have been published.

In a presentation at the Black Hat security conference in Las Vegas on Thursday, security researchers Charlie Miller and Collin Mulliner are scheduled to discuss SMS vulnerabilities that affect various mobile platforms, including Android, iPhone, and Windows Mobile.

Using the Sully fuzzing framework, the researchers have developed a way to identify flaws in SMS systems in mobile devices. Fuzzing is a form of automated software testing that involves entering random or unexpected data. Crashes or unexpected behavior arising from such input can then be analyzed as a potential vulnerability.

"Until now most of the SMS related security issues have been found by accident," state Miller and Mulliner in a paper that describes their approach. This, they explain, is because sending SMS messages costs money and because lack of access to source code for SMS implementations has meant hunting for bugs by trial and error.

The two researchers created a layer, called the injector, just above the bottom of the telephony stack that performs a man-in-the-middle attack by intercepting communication between a mobile device's modem and multiplexer.

The pair state that they found multiple SMS vulnerabilities on Android and iPhone systems and are still working on Windows Mobile systems.

In iPhone OS 2.2 and 2.2.1, they were able to crash the iPhone's SpringBoard window management application and the iPhone's CommCenter, which manages iPhone connectivity.

"This bug can be utilized for a serious denial-of-service attack since the victim can be effectively barred from making and receiving phone calls," the researchers claim.

They found a similar bug that affects Android OS 1.0, 1.1, and 1.5. "The bug is similar to the second iPhone bug in the way that it kills the telephony process (com.android.phone) and thus kicks the Android device from the mobile phone network," the pair state in their paper. "On Android the bug is a little more interesting since it will permanently kick the target device off the network if the SIM card residing in the phone has a PIN set."

Apple did not respond to a request to confirm reports that it is working on a fix for the iPhone vulnerabilities.

Google confirmed that the Android issue has been patched.

Miller and Mulliner are scheduled to present on Thursday, from 11:15 A.M. to 12:30 P.M., in the Milano Ballroom at Caesar's Palace in Las Vegas, where Black Hat is being held.

Black Hat is owned by TechWeb, which also publishes InformationWeek.

Update: Article updated to reflect Google's comment.

InformationWeek has published an in-depth report on smartphone security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.