French Hacker Claims Found Flaw In iPhone Messaging Service


Security on the iPhone is heavily dependent on Apple’s ability to vet all third-party apps before users download them. But a French hacker claims he has found a flaw in the smartphone’s text messaging service that bypasses the safeguard, InfoWorld reports.

The hacker, who calls himself “pod2g” and is best known for jailbreaking iPhones, said that the vulnerability could let an attacker send a message pretending to be from a bank, credit card company, or other trusted source.

Because the flaw does not involve code execution, an attacker does not need to get malware pass Apple, which approves all mobile apps before they are sold on the App Store, the only legitimate site for downloading software for Apple mobile devices.

Pod2g, a self-professed iPhone security researcher, said the flaw is “severe” and affects all current versions of iOS and iOS 6 beta 4. IOS is the iPhone and iPad operating system.

“I am pretty confident that other security researchers already know about this hole, and I fear some pirates as well,” he said in a blog post.

Apple did not respond to a request for comment.

Tyler Shields, a senior security researcher at Veracode, told the Kaspersky Lab blog that the flaw needs attention.

“At first glance, this type of flaw seems tame, but in reality it can be used very effectively in spoofing and social engineering based threat models,” Shields said. “I would rate this attack a medium severity because it relies on tricking the user into doing something specific based on a falsified level of trust.”

When a text message is sent through the iPhone SMS (short messaging service), the phone typically converts it to a protocol called Protocol Description Unit (PDU) before the carrier ships it to the telephone number of the recipient.

Within the text payload is a section called User Data Header (UDH) that enables someone to change the reply address of the text, pod2g said. An attacker could use this flaw to show a reply number that is different from where the responding text would actually go.

“In a good implementation of this feature, the receiver would see the original phone number and the reply-to one,” pod2g said. “On iPhone, when you see the message, it seems to come from the reply-to number, and you loose track of the origin.”

As a result, an attacker could send a message that seems to come from a bank or other trusted source. This would enable the criminal to either seek personal information or direct the recipient to a phishing website.


PanARMENIAN Network is the first Armenian online news and analytical agency and one of the most cited Armenian informational resources worldwide.

One thought on “French Hacker Claims Found Flaw In iPhone Messaging Service

  • August 21, 2012 at 1:55 pm

    Looks like Ipad is joining Microsoft with the distinction of having software versions like the well known XP virus addition 2012…
    There are many people talking today about what the uS government got away with using similar ethics to raise capital for themselves…but insisted it was to slow the progress of the Iranians building a bomb.
    Truth is…the uS is busy doing what they usually do. Example: the uS set up teams of men across the uS that went out into the public and convinced individuals to sell what the uS supplied themselves…drugs and guns. After a while the uS always turns in their new recruits and as always they are setting more…and advertises how well they have done in a drug war…
    Everyone knows what a bum is…That’s why people need a patent and copyright act. They patent junk and sell it for the most using commercials and public events. It’s like the cheap trick they did in Hollywood…they used a camera amde sex stars and placed a sign on the side of a hill. They then got all the senators, etc. to make sure they got a cut when people used a dvd or their choice codecs.
    That’s apple and windows in a nutshell. Pretty looking stuff that actually does not do much for women and children of the world…or there would be no hunger!


Leave a Reply

Your email address will not be published. Required fields are marked *