7

The author of this blog post Never trust SMS: iOS text spoofing says that: The sender of an SMS message may provide arbitrary sender information using low level protocol features. Furthermore the sender may set a header, to indicate, that replies should be sent to a third number.

Apple comments:

Apple takes security very seriously. When using iMessage instead of SMS, addresses are verified which protects against these kinds of spoofing attacks. One of the limitations of SMS is that it allows messages to be sent with spoofed addresses to any phone, so we urge customers to be extremely careful if they're directed to an unknown Web site or address over SMS.

My understanding is that Apple is saying this is not a design flaw on their part, but one on the part of the SMS, and the way the payload is designed.

This reaction poses a number of questions:

  • Is it true, that the receiving phone cannot verify whether the sender information is correct?
  • Is the reply to header an issue that users should be warned about when the user tries to reply to an SMS message?
  • How do other vendors handle this situation?
  • Both issues (arbitrary sender information and reply-to-header) apply to plain old email, as well. How do email clients deal with it?
Improve this question
2
  • 2
    @blunders I generalized the question because it is not Apple specific, as you said. Furthermore I tried to improve the summary of the blog posting, to make both issues clear.
    – Hendrik Brummermann
    Commented Aug 19, 2012 at 16:29
  • 3
    @HendrikBrummermann I think you extracted the essence of the question. Great work. (And I never make compliments to mods, cause, well,... I don't fell like doing that.)
    – curiousguy
    Commented Aug 19, 2012 at 17:25

4 Answers 4

Reset to default
6

Apple did not create the SMS standard that was provided to them by the industry. The industry indicated that an SMS transaction can include a reply-to field. Apple has designed their software to use what the industry told them existed (and what industry equipment is compatible with as it relays it intact). As long as Apple isn't using the provided standard incorrectly, they can't be to blame. If a reply-to field is included, and is different than the from field, what exactly is the purpose of the reply-to field if not to prevent you from sending the SMS to the "from" originator? What would everyone expect behavior to be exactly?

An example: Apple builds computers. My Mac Book Pro (running OS X 10.8) can be fooled by a spoofed MAC address. Is that Apples fault? My MBP can be fooled by a spoofed IP address. Also Apples fault? No in both cases, the IP stack was designed long before Apple had anything to do with networking computers. MAC control being spoofed is not something easily detectable (unless you know for sure what MAC address you should expect to see). Apple is using provided standards.

EDIT: If customers want a secure platform, they use iMessage. If compatibility is the concern, they use SMS. SMS is not, and has never been designed to be a secure platform.

I'm of the opinion that @blunder can not compare SSL (a known secure system) to SMS (a known insecure system). Telnet is an unsecured communications medium and would be a closer comparison. How many computers pop up a notification that says, "Are you sure you want to use telnet, it sends passwords in cleartext?" Is Apple liable because OS X doesn't have a popup that notifies someone trying to use telnet that it isn't secure?

My turn to ask a question. Why are we bent on finding excuses to make Apple fix this, instead of having the cause of the problem (the SMS standard) fixed? Why is fixing the symptom logical when you can cure it at the cause (the carriers)?

Improve this answer
1
4

The blog post you link to seems to imply that this is a design flaw that could reasonably be called Apple's fault.

The blog post says that every SMS comes with the equivalent of a "from" field (the phone number of the person who sent it) and, optionally, the equivalent of a "reply-to" field (the phone number that replies will go to). Apparently, the sender can set the "reply-to" field but not the "from" field. If the iPhone receives a SMS containing a "reply-to" field, it ignores the "from" field and treats the "reply-to" field as the sender of the message. This makes it easy to spoof the apparent sender of the SMS message.

I have no first-hand knowledge, but if the blog post is correct, then this does sound like a design shortcoming in the iPhone that could be fixed by Apple, simply by always using the "from" field as the sender and not allowing the "reply-to" field to override the "from" field.

Improve this answer
3
  • 1
    Thanks, but your answer is just speculation and restating what's already stated in the blog.
    – blunders
    Commented Aug 19, 2012 at 1:46
  • Have to agree with @blunders on this one.
    – Everett
    Commented Aug 19, 2012 at 14:41
  • 2
    @D.W. Thanks for providing an accurate summary of the blog posting. The description in the question was very confusing.
    – Hendrik Brummermann
    Commented Aug 19, 2012 at 16:34
2

TECHNICALLY, it is not Apple's problem, indeed.

What is "Apple's problem" ? It is something which in some way prevents Apple from pursuing its ultimate goals, which can be summarized as "making a lot of money". There are two main classes of "problems" for a big company like Apple:

  • Image issues, which may deter potential customers from buying the products.

  • Legal issues, which can result in substantial amends, and, even more importantly, may turn into image issues if they become too visible. Some legal issues, such as patents, do not harm image because customers do not care about intellectual property; they look at the Apple vs Samsung lawsuit as a kind of entertainment. But any legal issue which can be cast in such a way that some customers may have been swindled (and security issues fall into that category) can deal some damage to Apple's Image.

The purported Apple stance ("the problem is in the standard") can be interpreted as a "bring it on" from Apple's lawyers. Their defense is ready. Their shields are up. So, no problem to Apple that way. Similarly, blows to image can be deflected by using the time-honoured tactic of designating a scapegoat, in this case the SMS standard. Image-wise, Apple looks like the White Knight: they do offer a "better" way (the iMessage) and can easily look blameless in the matter.

What this all amounts to is that Apple is big enough to define reality. The world of technological gadgets is sufficiently malleable and magic-looking that a big player can tell things what they are, instead of being told what things are. Indeed, Apple's substantial treasury has been built by Apple doing just that for more than a decade. SMS from/reply-to are not Apple's problem because Apple says so. I see no reason why they would stop doing it, and I see no reason why this strategy would fail them.

(Notice that I am speaking from the technical point of view; I am not talking at all about ethics.)

Improve this answer
0
2

It's worth noting that it is possible to fix the issue without breaking the standard. Here's an example of what an alert might look like that does not break the SMS standard, but warns the user via a security alert message:

enter image description here

Improve this answer
1
  • BTW, I disagree with this statement, " Apple was aware of a security threat, decided not to create a solution, or warn customers." To the best of my knowledge, there has been no indication Apple was aware of security problems with SMS (or just this security problem). iMessage was a response to ecosystem unification, not SMS's security shortcomings. The fact that Apple can point at iMessage and say, "see, this doesn't have the problem SMS does," is not the same as, "we looked at SMS's shortcomings and responded with iMessage."
    – Everett
    Commented Aug 19, 2012 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .