2

I am subject to legal proceedings where fake iMessages (not SMS) are being introduced by the opposing party and proclaiming to have come from me. I read about spoofing SMS messages. Is it possible for iMessages to be spoofed? If not through spoof, what other ways can someone make a screenshot of iMessages with a fake phone number in the "contact" region?

1

what other ways can someone make a screenshot of iMessages with a fake phone number in the "contact" region?

  • A screenshot is no proof at all. As opposed to a photo, you can easily produce a pixel-perfect forgery of a screenshot, e.g. by putting two screenshot halves together, one with your phone number and one with the forged messages.

  • The chat log files on their machine are no proof either. Manipulating them is trivial as well. A quick search turned up that iMessages chat logs are stored in a chat.db file in the library, using the non-proprietary SQLite format. So, a moderately skilled user can just open the database, change some entries (such as messages or timestamps) and load it back into iMessages. There is no mechanism by Apple that prevents tampering with the logs.

One entity that could maybe prove if these messages were sent is Apple. If they keep independent message logs on their own servers, these could serve as evidence. But it's unclear if such logs exist and if they would be available to you. Apple claims they do end-to-end encryption, so there is no way for them to verify the message contents either way (although they might know if any messages were sent at all through metadata).

  • dang it, you had 28 seconds on me. – Sirens Oct 27 '17 at 2:01
  • @Sirens Heh, and we're even in the low-traffic hours. :) – Arminius Oct 27 '17 at 2:06
  • I am the OP. And I also just realized that it doesn't even require going as far as editing the screenshot to show a certain phone number. I just tested it on my phone and you can literally save a phone number as a different phone number. I.e., you can save +1 (111) 111-1111 as +1 (222) 222-2222 and the screenshot would look exactly as if the message came from the latter #. – user162388 Oct 27 '17 at 3:10
  • Also, I went through Apple's privacy and legal policy. They claim that iMessages are end-to-end encrypted and they do not store timestamp information, content information, and really, anything of value. – user162388 Oct 27 '17 at 3:12
  • @Iamanon Great to know! (Although I wonder if the iMessages logs are part of an automatic cloud backup and in this case would still effectively be accessible to Apple.) – Arminius Oct 27 '17 at 3:49
2

Other than blatant photo editing (online tools exist for this!), it's possible to modify the message database to create seemingly native messages. All data is stored in an SQLite database and while the format is pretty complex (so as to support advanced features such as attachments, interactive apps, etc). This would mean that a sufficiently advanced person could modify their local database and insert messages from a person that never happened. They could literally present their phone to the judge and jury and unless an advanced security analyst were brought in no one would be the wiser.

As far as I know there are no known (or publicly known) exploits which allow iMessage to be spoofed before it is received on the end user device. This would be a major, ultra valuable vulnerability.

Here's what a row in the database looks like. There is more info to the left but the good stuff is pictured (click for the full size): enter image description here

  • Thanks. I think I should correct my question. iMessages sent messages show up as blue. SMS sent messages show up as green. All received messages (whether SMS or iMessages) show up as Gray. My question should actually be, would it be possible to spoof messages such that it looks like an iMessage (i.e., blue text message boxes)? Or does spoof only provide the green text message boxes? – user162388 Oct 27 '17 at 3:08
  • Yes, as I said, any message (SMS or iMessage) can be inserted into the local database and it'll look like whatever you set it up as. There is a column in the database called service which is either iMessage or SMS. You simply add a new row and fill it out and bam. – Sirens Oct 27 '17 at 3:10
  • Is this inside the chat.db file? – user162388 Oct 27 '17 at 3:21
  • Yes, you can open it with any SQLite editor. See my edit for an example row. – Sirens Oct 27 '17 at 3:24
  • I'm going to take a look. Is this for macs only? I can find the chat.db file for my macbook, but I can't seem to find it for my iPhone when I plug it in to my mac. – user162388 Oct 27 '17 at 3:31
0

With the introduction of stickers you can cover text and make it look like someone said something they didn't. Check out this TechCrunch article about a prank app that does just that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy