James Banogon

Hackers find new iPhone vulnerability

Posted on July 30, 2009 in Technology

A join up of security experts has found vulnerability in the iPhone that permits a hacker to take control of an iPhone through an SMS attack.

Researchers Charlie Miller and Collin Mulliner gave details about the security hole at the Black Hat cyber security conference in Las Vegas. They said they have already informed Apple about the bug a month ago but the problem has not been patched, according to Forbes, which said Apple has refused to comment on the issue.

The iPhone, they said, can be controlled by a remote hacker through a string of mostly invisible text messages bursts. That would give someone control over the phone, text messaging, browsing, mic and camera functions. There is also a comparable fault in Windows Mobile phones.

The attack exploits the lack of protection in the phone that would thwart code in the SMS from inserting in an executable file in the phone’s memory. Users who were under attack would only get a text message with a square in it.

A 2nd vulnerability would also let a hacker take the phone off the network through a type of denial of service attack through SMS. Android phones were also vulnerable to this, but it seems that Google has already patched the hole.

So what iPhone users ought to do? MyMobiSafe founder Eric Everson said it’s very implausible that they will be targeted. He said the attack would need hundreds of text messages sent to the targeted phone. He said if any of the text messages are erased before the attack is done, then the hack won’t be effective.

Just to be safe, if you happen to obtain an SMS with a square in it, turn off your phone or switch it into airplane mode.