Hacker found severe iOS SMS vulnerability on iPhone

The French iOS hacker extraordinaire Pod2g, who developed Apple iOS 5 untethered jailbreak exploits has found a severe SMS flaw in iOS which already exists since the initial release of iOS SMS text message function until the latest iOS 6 beta 4. It is believed other iOS security researchers and even pirates already know about this hole due to its long existence in iOS.

Pod2g explains:

"If you either own a smartphone, or a modem and an account in a SMS gateway, you can send texts in raw PDU format (some services also exist to send a text with an HTTP request in raw PDU format). For the easiest smartphone option, there are different tools available online. I made one for the iPhone 4 that I will publicize soon.

In the text payload, a section called UDH (User Data Header) is optional but defines lot of advanced features not all mobiles are compatible with. One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer to the text, he will not respond to the original number, but to the specified one. Most carriers don't check this part of the message, which means one can write whatever he wants in this section : a special number like 911, or the number of somebody else."

This SMS flaw will be a nightmare if the pirates implementing it for phishing and spoofing purposes on iPhone users around the globe. For now, do not simply trust any SMS received on iPhone until Apple has fixed it. Especially text message which is asking for your personally information since most of the organizations do not do that.

More info about this iOS SMS flaw can be found HERE on pod2g's iOS blog.

UPDATE: An Apple representative responds to iPhone text message spoofing:

"Apple takes security very seriously. When using iMessage instead of SMS, addresses are verified which protects against these kinds of spoofing attacks. One of the limitations of SMS is that it allows messages to be sent with spoofed addresses to any phone, so we urge customers to be extremely careful if they're directed to an unknown website or address over SMS."