Latest Podcast



Featured Articles

Friday, August 24, 2012

Apple iPhone SMS text spoofing: whose fault is it?

Mark Bridge writes:

Last week, French iOS security researcher pod2g revealed a potential security risk with the Apple iPhone’s handling of SMS text messages.

All text messages can be sent with an optional ‘reply to’ telephone number that’s different from the sender’s number. It’s not a standard option with most mobile phones and is most likely to be used by SMS gateways sending large volumes of promotional or service messages.

The majority of text messages don’t use this feature - and many phones either ignore the extra data or display both numbers - but Apple’s iOS seems to handle it in a potentially risky way. Customers with an iPhone are shown SMS messages that appear to have been sent from the ‘reply to’ number... which isn’t necessarily the actual sender.

Apple responded to tech news site Engadget with a recommendation to use its own Apple-only iMessage service instead. “When using iMessage instead of SMS, addresses are verified which protects against these kinds of spoofing attacks. One of the limitations of SMS is that it allows messages to be sent with spoofed addresses to any phone, so we urge customers to be extremely careful if they’re directed to an unknown website or address over SMS.”

However, mobile security company AdaptiveMobile says blame should be directed at Apple, not at mobile network operators.

Cathal McDaid, a security consultant at AdaptiveMobile, said “Device manufacturers, like all members of the mobile ecosystem should aim to take security seriously and ensure their devices comply with a wide range of standards and technical recommendations. For SMS to remain a trusted, clean channel, companies need to be vigilant that their products both properly conform to standards and don’t inadvertently expose flaws that can compromise their customers.”

“We know conclusively that this is not a network problem because the 3GPP specification - which outlines how modern mobile phones and networks operate today - discusses the security implications of this field in all phones and give recommendations on how to avoid malicious use of this. We have tested this issue on Android, Windows Mobile, BlackBerry and Symbian phones and most of them simply ignore the ‘reply address’ field or display both the ‘real’ originating address and the reply address as per the specification recommendations. The iPhone, so far, is the only device which does not comply with these security recommendations.”

The iPhone’s SMS handling could be used in a number of malicious ways. Criminals could send a message that appears to come from the customer’s bank or credit card company, inviting the users to reply with personal information or submit security information via a fraudulent web site. Alternatively, a spoof message could be used for social engineering to manipulate a customer’s behaviour - perhaps appearing to be from a trusted friend or a colleague.

It’s certainly not inappropriate to highlight Apple’s handling of SMS messages - but it’s also important to realise that spoofed SMS messages could affect other devices as well. Spam email messages often appear to be from legitimate addresses, requiring a combination of common sense and filtering software to determine whether or not they’re genuine. How long before SMS filtering becomes as much of a necessity... or will network operators and handset manufacturers solve the problem first?

Print
Author: The Fonecast
0 Comments
Rate this article:
No rating

Leave a comment

This form collects your name, email, IP address and content so that we can keep track of the comments placed on the website. For more info check our Privacy Policy and Terms Of Use where you will get more info on where, how and why we store your data.
Add comment

Opinion Articles

World class, my a**e!

Iain Graham writes:

I recently had to, as a last resort, call the customer service department of a large communications company about a problem I currently have with a piece of equipment. I know I could have looked in the 150-page accompanying instruction manual but I haven't got half my life to spare! (as I mentioned in my previous blog piece on handsets!)

Businesses these days are telling us "Customer service has been outsourced to the Indian subcontinent and technologically streamlined in order to offer our customers a better, more efficient service"!

Author: The Fonecast
0 Comments
Article rating: No rating

Don’t be a not-so-early adopter

Mark Bridge writes:

So – you’re thinking about buying a new mobile phone. A smartphone. And yes, I mean a real smartphone, not just something with a touchscreen that looks nice.

I know, I know. You’re tempted by the iPhone. It’s all those apps, isn’t it?  100,000 and counting.

Yet Android is catching up. Admittedly it’s still got a long way to go to match that six-figure total… but the signs are certainly there.

Author: The Fonecast
0 Comments
Article rating: No rating

Probably the best Bluetooth headset brand in the world

Mark Bridge writes:

I really don’t want to make a habit of pointing at surveys and laughing – or even scratching my head in the kind of theatrical gesture used by Stan Laurel – but I should imagine there was some wry amusement at Strategy Analytics this week.

They’d been talking to car owners in Europe and the USA about their preferred brand for Bluetooth headsets and speakerphones. In the United States, 45% of respondents said Bose was their preferred brand. Excellent news for Bose. Excellent news for Bose stockists. Except...

Author: The Fonecast
0 Comments
Article rating: No rating

Movon MB80 Bluetooth handsfree wristband review

Mark Bridge writes:

I’m always on the lookout for technology that’ll make life easier. That’s one of the reasons the Movon MB80 caught my eye. It’s a Bluetooth handsfree unit that you wear on your wrist. The MB80 is designed for the times your phone’s not convenient and you don’t want to miss a call – but you also don’t want to wear a Bluetooth headset. Perhaps you’re playing sports or are out for an evening with friends. The Movon Bluetooth wristband rings or vibrates when someone calls – and then can be used as a handsfree loudspeaker.

Author: The Fonecast
0 Comments
Article rating: 4.0

"Cancer" mobile phone headlines don't help anybody

James Rosewell writes:

"Mobile: new cancer alert" - The Daily Telegraph

The front page of Saturday's Telegraph led with the headline "Mobiles: new cancer alert" re-igniting fears about mobile phone usage. The centrepiece of the article is "a £20 million, decade long investigation, overseen by the World Health Organization (WHO) will publish evidence that heavy [mobile phone] users face a higher risk of developing brain tumors later in life". How should this topic be reported and what will it mean for our industry?

Author: The Fonecast
1 Comments
Article rating: No rating
RSS
First105106107108110112113114Last

Recent Podcasts

Reviewing our 2015 mobile industry predictions... and looking forward to 2016

Podcast - 15th January 2016

Iain Graham, James Rosewell and Mark Bridge return to review their mobile industry predictions from last year. Which mergers, partnerships and developments did they forecast correctly... and which didn’t work out as planned?

Later in the programme, the team anticipates some of the topics that will be hitting the headlines during 2016.

Author: The Fonecast
0 Comments
Article rating: No rating

Podcast from Mobile World Congress 2015

Podcast - 6th March 2015

Mark Bridge learns about the mobile technology trends at Mobile World Congress 2015 by chatting to James Rosewell of 51Degrees, Dr Kevin Curran from the IEEE and Chris Millington of Doro.

They talk about wearable devices, wireless charging, mobile operating systems and much more... including some of their favourite products from the exhibition.

Author: The Fonecast
0 Comments
Article rating: No rating

Looking back at February: from security scares to multiple MVNOs

Podcast - 27th February 2015

We're taking a look back at the biggest mobile industry news stories from February 2015, including allegations that the UK's security service tried to breach SIM card security by hacking into one of the world's biggest SIM producers.

We also talk about the planned BT and EE merger, the creation of two new UK virtual networks, some acquisitions in the mobile payment arena and a new Ubuntu smartphone.

Author: The Fonecast
0 Comments
Article rating: No rating

Interview with Chris Millington of Doro about mobile retailing, wearables and technology for older consumers

Podcast - 24th February 2015

In today's programme Mark Bridge talks to Chris Millington, who's Managing Director for Doro UK and Ireland.

They discuss the state of mobile retailing in the UK, the future of wearable devices and - as you might expect - smartphones for seniors.

Author: The Fonecast
0 Comments
Article rating: No rating

A month of mobile: O2 counts on 3, Microsoft counts to 10 and Apple counts its profits

Podcast - 30th January 2015

We're back with a month of mobile industry news, including takeover talks and takeover rumours. O2 and Three are said to be discussing a merger... but is there any truth in the suggestions that BlackBerry could be up for grabs?

We also discuss Apple's record-breaking quarterly figures, the highlights of CES and the launch of Microsoft Windows 10, as well as saying farewell to the current version of Google Glass.

Author: The Fonecast
0 Comments
Article rating: No rating
RSS
12345678910Last

Follow thefonecast.com

Twitter @TheFonecast RSS podcast feed
Find us on Facebook Subscribe free via iTunes

Archive Calendar

«February 2025»
MonTueWedThuFriSatSun
272829303112
3456789
10111213141516
17181920212223
242526272812
3456789

Archive

Terms Of Use | Privacy Statement