, The Register 2009-07-03
If you own an iPhone, security researcher Charlie Miller can knock it off the network. And if his hunch is right, he just might be able to do a lot more, at least until Apple fixes the flaw.
Exploiting a bug in the way iPhones parse SMS messages, the principal analyst at Independent Security Evaluators has demonstrated how to crash a part of the phone that allows him to temporarily disconnect the device from the network, he told The Register. He's still trying to figure out if the vulnerability will allow him to remotely execute code, a feat that would allow attackers to do much more nefarious things, including sending malicious commands to monitor the phone's location or turn on its microphone so it becomes a remote bugging device.
"I can definitely make the thing crash," Miller said. "I have still to determine whether it's actually exploitable or not. This thing has the potential to be really serious, but I'm still looking at it and Apple is still looking at it."
Miller presented his findings at the SyScan conference in Singapore on Thursday and plans to offer additional details later this month at the Black Hat security conference in Las Vegas. Researcher Collin Mulliner was also instrumental in discovering the bug, Miller said.
If the vulnerability turns out to be exploitable, it would be significant because there are few measures iPhone users can take to prevent an attack, said Dino Dai Zovi, a security researcher who along with Miller is the co-author of The Mac Hacker's Handbook. Dai Zovi has yet to see technical details behind the vulnerability, but he has already experienced its effects last week.
While the two were speaking on a land line, Miller told Dai Zovi he found a new bug in the iPhone and, as a demonstration, instructed him to look at his own Apple handset. The display bore the words "No service." (The outage caused by Miller's proof of concept was only temporary).
"My reaction was that this has the potential to be a very serious vulnerability and likely the worst that has affected the iPhone to date," Dai Zovi told The Register. "I was very surprised that he had a vulnerability that was triggerable with just an SMS message."
Dai Zovi and several other iPhone experts we consulted said there is no way to prevent the iPhone from receiving SMS messages. While AT&T allows users to block text messages and multimedia messages sent as emails using this site, we found no way to block all SMS messages. An Apple representative didn't respond to our email requesting comment.
If you have tips or insights on this topic, please contact SecurityFocus.