The author of this blog post Never trust SMS: iOS text spoofing says that: The sender of an SMS message may provide arbitrary sender information using low level protocol features. Furthermore the sender may set a header, to indicate, that replies should be sent to a third number.
Apple takes security very seriously. When using iMessage instead of SMS, addresses are verified which protects against these kinds of spoofing attacks. One of the limitations of SMS is that it allows messages to be sent with spoofed addresses to any phone, so we urge customers to be extremely careful if they're directed to an unknown Web site or address over SMS.
My understanding is that Apple is saying this is not a design flaw on their part, but one on the part of the SMS, and the way the payload is designed.
This reaction poses a number of questions:
- Is it true, that the receiving phone cannot verify whether the sender information is correct?
- Is the reply to header an issue that users should be warned about when the user tries to reply to an SMS message?
- How do other vendors handle this situation?
- Both issues (arbitrary sender information and reply-to-header) apply to plain old email, as well. How do email clients deal with it?