3

I am subject to legal proceedings where fake iMessages (not SMS) are being introduced by the opposing party and proclaiming to have come from me. I read about spoofing SMS messages. Is it possible for iMessages to be spoofed? If not through spoof, what other ways can someone make a screenshot of iMessages with a fake phone number in the "contact" region?

Improve this question

3 Answers 3

Reset to default
1

what other ways can someone make a screenshot of iMessages with a fake phone number in the "contact" region?

  • A screenshot is no proof at all. As opposed to a photo, you can easily produce a pixel-perfect forgery of a screenshot, e.g. by putting two screenshot halves together, one with your phone number and one with the forged messages.

  • The chat log files on their machine are no proof either. Manipulating them is trivial as well. A quick search turned up that iMessages chat logs are stored in a chat.db file in the library, using the non-proprietary SQLite format. So, a moderately skilled user can just open the database, change some entries (such as messages or timestamps) and load it back into iMessages. There is no mechanism by Apple that prevents tampering with the logs.

One entity that could maybe prove if these messages were sent is Apple. If they keep independent message logs on their own servers, these could serve as evidence. But it's unclear if such logs exist and if they would be available to you. Apple claims they do end-to-end encryption, so there is no way for them to verify the message contents either way (although they might know if any messages were sent at all through metadata).

Improve this answer
9
  • dang it, you had 28 seconds on me.
    – Allison
    Oct 27, 2017 at 2:01
  • @Sirens Heh, and we're even in the low-traffic hours. :)
    – Arminius
    Oct 27, 2017 at 2:06
  • I am the OP. And I also just realized that it doesn't even require going as far as editing the screenshot to show a certain phone number. I just tested it on my phone and you can literally save a phone number as a different phone number. I.e., you can save +1 (111) 111-1111 as +1 (222) 222-2222 and the screenshot would look exactly as if the message came from the latter #.
    – user162388
    Oct 27, 2017 at 3:10
  • Also, I went through Apple's privacy and legal policy. They claim that iMessages are end-to-end encrypted and they do not store timestamp information, content information, and really, anything of value.
    – user162388
    Oct 27, 2017 at 3:12
  • @Iamanon Great to know! (Although I wonder if the iMessages logs are part of an automatic cloud backup and in this case would still effectively be accessible to Apple.)
    – Arminius
    Oct 27, 2017 at 3:49
2

Other than blatant photo editing (online tools exist for this!), it's possible to modify the message database to create seemingly native messages. All data is stored in an SQLite database and while the format is pretty complex (so as to support advanced features such as attachments, interactive apps, etc). This would mean that a sufficiently advanced person could modify their local database and insert messages from a person that never happened. They could literally present their phone to the judge and jury and unless an advanced security analyst were brought in no one would be the wiser.

As far as I know there are no known (or publicly known) exploits which allow iMessage to be spoofed before it is received on the end user device. This would be a major, ultra valuable vulnerability.

Here's what a row in the database looks like. There is more info to the left but the good stuff is pictured (click for the full size): enter image description here

Improve this answer
13
  • Thanks. I think I should correct my question. iMessages sent messages show up as blue. SMS sent messages show up as green. All received messages (whether SMS or iMessages) show up as Gray. My question should actually be, would it be possible to spoof messages such that it looks like an iMessage (i.e., blue text message boxes)? Or does spoof only provide the green text message boxes?
    – user162388
    Oct 27, 2017 at 3:08
  • Yes, as I said, any message (SMS or iMessage) can be inserted into the local database and it'll look like whatever you set it up as. There is a column in the database called service which is either iMessage or SMS. You simply add a new row and fill it out and bam.
    – Allison
    Oct 27, 2017 at 3:10
  • Is this inside the chat.db file?
    – user162388
    Oct 27, 2017 at 3:21
  • Yes, you can open it with any SQLite editor. See my edit for an example row.
    – Allison
    Oct 27, 2017 at 3:24
  • I'm going to take a look. Is this for macs only? I can find the chat.db file for my macbook, but I can't seem to find it for my iPhone when I plug it in to my mac.
    – user162388
    Oct 27, 2017 at 3:31
0

With the introduction of stickers you can cover text and make it look like someone said something they didn't. Check out this TechCrunch article about a prank app that does just that.

Improve this answer

You must log in to answer this question.