Vulnerabilities / Threats
7/29/2009
07:08 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Black Hat: Android, iPhone SMS Flaws Revealed

Security researchers have identified several SMS vulnerabilities that can be used to deny service to mobile phones. They're presenting on Thursday but their findings have been published.

In a presentation at the Black Hat security conference in Las Vegas on Thursday, security researchers Charlie Miller and Collin Mulliner are scheduled to discuss SMS vulnerabilities that affect various mobile platforms, including Android, iPhone, and Windows Mobile.

Using the Sully fuzzing framework, the researchers have developed a way to identify flaws in SMS systems in mobile devices. Fuzzing is a form of automated software testing that involves entering random or unexpected data. Crashes or unexpected behavior arising from such input can then be analyzed as a potential vulnerability.

"Until now most of the SMS related security issues have been found by accident," state Miller and Mulliner in a paper that describes their approach. This, they explain, is because sending SMS messages costs money and because lack of access to source code for SMS implementations has meant hunting for bugs by trial and error.

The two researchers created a layer, called the injector, just above the bottom of the telephony stack that performs a man-in-the-middle attack by intercepting communication between a mobile device's modem and multiplexer.

The pair state that they found multiple SMS vulnerabilities on Android and iPhone systems and are still working on Windows Mobile systems.

In iPhone OS 2.2 and 2.2.1, they were able to crash the iPhone's SpringBoard window management application and the iPhone's CommCenter, which manages iPhone connectivity.

"This bug can be utilized for a serious denial-of-service attack since the victim can be effectively barred from making and receiving phone calls," the researchers claim.

They found a similar bug that affects Android OS 1.0, 1.1, and 1.5. "The bug is similar to the second iPhone bug in the way that it kills the telephony process (com.android.phone) and thus kicks the Android device from the mobile phone network," the pair state in their paper. "On Android the bug is a little more interesting since it will permanently kick the target device off the network if the SIM card residing in the phone has a PIN set."

Apple did not respond to a request to confirm reports that it is working on a fix for the iPhone vulnerabilities.

Google confirmed that the Android issue has been patched.

Miller and Mulliner are scheduled to present on Thursday, from 11:15 A.M. to 12:30 P.M., in the Milano Ballroom at Caesar's Palace in Las Vegas, where Black Hat is being held.

Black Hat is owned by TechWeb, which also publishes InformationWeek.

Update: Article updated to reflect Google's comment.

InformationWeek has published an in-depth report on smartphone security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7178
Published: 2014-11-28
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

CVE-2014-7850
Published: 2014-11-28
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

CVE-2014-8423
Published: 2014-11-28
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.

CVE-2014-8424
Published: 2014-11-28
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

CVE-2014-8425
Published: 2014-11-28
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?