14 
After iPhone text messages were found to be hackable, meaning that text for your Mum might easily be from a filthy scammer, Apple’s answer is to just use iMessage, because everybody uses an iPhone, right?
In a statement released to Engadget, Apple took the opportunity, not to apologise about the vulnerability in iOS and promise a fix, but to remind everyone that iMessage is superior and everyone should be using it:
“Apple takes security very seriously. When using iMessage instead of SMS, addresses are verified which protects against these kinds of spoofing attacks. One of the limitations of SMS is that it allows messages to be sent with spoofed addresses to any phone, so we urge customers to be extremely careful if they’re directed to an unknown website or address over SMS.”
Alright, so the humble text message might be pretty antiquated, and vulnerable to spoofing, but honestly, Apple, until you allow everyone to use iMessages, who’s going to solely rely on your proprietary messaging service? I have a load of friends using all sorts of phones, some don’t even use a smartphone, so SMS is the way forward. So don’t give us the “you should be using iMessages” spiel, just fix the vulnerability and let us get on with our texting, OK? [Engadget]
iMessage Keeps Texting Stolen iPhones Even After Wipeout
Dear Apple: Please Set iMessage Free
Apple Explains the iMessage Bug (Updated)
So basically iOS is using the “Reply To” number as the From number, rather than their actual number?
So basically Apple are saying “You’re texting it wrong”
Oh and Welcome back Sam, Did you have a nice holiday?
Very nice thanks, anything exciting happen while I was away, you folks had an unofficial meetup right?
Yeah, A great time was had by all. Pity you missed it. Since you are in the Giz UK circle you should be able to see all the photos though.
Good stuff, I shall take a gander.
Hang on a sec, is Apple doing something proprietary here? I thought they were just using optional headers that the SMS standard makes available to hardware manufacturers?
Yup – iMessage is like BBM, the messages pass through Apple’s servers rather than the usual mobile network channels.
Nope, you’re referring to iMessages and not SMS where the security issue is. As far as I know, Apple is not doing anything proprietary with SMS texts.
I doubt Apple are doing anything proprietary with the SMSs themselves (though never say never…), but just as when virus writers target Windows for the lowest common denominator, these spoofers are targeting a vulnerability in the iPh SMS client for the same reason.
I do love the shocked response that I get when people text me for the first time on a new iPhone and they realise that I’m not on iMessage. It’s almost as if they’re thinking:
“You know what you’re talking about technically, and you’re not using an iPhone. I don’t understand it.”
The peeps at Apple can be such wankers.
Congratulations, not even 11am on Monday and you have already won “Understatement of the week”
I was going to write a big long whinge, but couldnt go past the simplicity…
But, once u go mac, you never go back
Considering the SMS protical vulnerability has been known for years, regardless of your device, how is this Apples fault? Android, W7, RIM, all have the same problem with SMS’s being open to any hacker worth his salt.
Because iOS handles it differently to other OS’s by displaying the “Reply To” as the From Name. If Apple changed it that the Name displayed was the actual number the text was sent from (like other OS’s) this wouldn’t be a problem.
Apple is just using headers available to hardware manufacturers by the SMS standard. You still haven’t answered how it is Apple’s fault or, indeed, problem.
Read what he wrote and think again. Yes the headers are part of the standard and are available to all hardware manufacturers. Yet Apple UNIQUELY (afaik) are using the “reply to” header as the “from” name. That is a fault and since it is a fault in their OS it’s their problem.
Nope, unless they are doing something proprietary with the technology, they are using what is made available to them by a de facto industry standard. That is not their fault, although, judging by some of the comments here, it does appear to becoming a bit of problem for them.
Sorry, I really cannot understand how you cannot see what’s wrong with displaying the wrong information in the wrong field. If the SMS App had the name in the number field you would hopefully acknowledge that was a fault. Apple are putting the “reply to” data in the “from” field. If they were not doing this (and It obviously needs reiterating NO ONE ELSE DOES) then the possibility of being spoofed by this would be zero.
Pardon? How would that make it more secure Darrell? You will just be sending texts to a spoofed recipient instead of receiving from a spoofed sender. The vulnerability will still be there!
But if the sender is unknown to you why would you be responding? the whole point of this vulnerability is that it allows people to pretend to be someone else.
I’m beginning to think this guy is just trolling now..
We have to agree to disagree. Information is constructed from any data or metadata available at my disposal and if need be I can even concatenate a number of fields in order to put together the information consumed via the presentation layer. The reasoning behind the decision to use that field is irrelevant – it is a piece of metadata that is available for me to use. Not using metadata freely available to me the way I want is like saying “you’re holding it wrong” ;-p
Every phone with SMS capabilities is prone to this type of phishing and there is nothing that can be done about it. Just as you can’t stop phishing scams in your email. All Apple is doing is pointing to iMessage as a more secure alternative. So before you start to lambast Apple, use your brain.
Sorry Alex, but my understanding its that everyone else uses the data correctly, otherwise this would be a problem on all other phones. Only iPhones are using the wrong data in the from field.
No no no. If someone texts me, their number comes up as their actual phone number. If someone texts you on iOS their number comes up as whatever they set their ‘reply to’ number as. This means if someone wants to be nasty they can set their ‘reply to’ number as the same one as your bank and ask for your pin number, etc.
If they tried this on any other platform it would come up with a random number asking for your pin code rather than your banks number. (Or at least that is how I understood the source articles)
I don’t know exactly how SMS messages work, but in regular telephony (analog and ISDN), you have the User Provided Number (UPN) and the Network Provided Number (NPN). These two numbers are always transmitted across the network when building a call. For regular people, the UPN is what shows up on the Caller ID. For government agencies/telephone providers, the NPN is able to be read out and displayed. With some forms of telephone lines and providers, it’s possible to change the UPN to basically whatever you want. For example, if you have a company with a big PBX and lots of voice capacity, you can choose to have only the main number be displayed or the number of the individual telephone when calling out. Or: you can tell your PBX to send some random shit, and random shit is what people will get on their phones.
That’s probably what this is, and has probably less to do with Apple and more to do with an insecure telephone system (like E-Mail, it’s sometimes easily exploitable). Sure, Apple might want to try to read out the NPN to get better accuracy, but it’s not their fault that the Caller ID information that gets passed to handsets is essentially insecure.
Additionally, in order for this hack to actually work properly, a hacker would have to know the telephone number of someone close to you or in your contact list, which pretty much rules out any sort of mass spam.
At most it could be used to prank someone into thinking a text message came from someone when it really didn’t. And even then, I imagine more phones would react the same way, seeing’s how, as stated above, the system is inherently insecure.