The iPhone's SMS vulnerability: What we learned

07.08.2009
The last week of July and first week of August is always an interesting time in the security world. That's when the annual and take place, initiating a flurry of software patches and news stories, as the world's leading security researchers release their latest findings. (DefCon is the world's biggest hacker conference, and is always preceded by the closely-tied Black Hat, which focuses on enterprise security professionals).

Most of the presentations at Black Hat are dedicated to exploring new research techniques and methods of finding--then fixing--security issues. Some of these are broad, industry-wide problems (such as new ways of attacking web sites), while others affect only a specific platform, such as Microsoft Windows.

Every year there are usually one or two security issues revealed at Black Hat that grab the consciousness of the security industry and fill the headlines. Some result in sudden gag orders and legal drama, while others shatter through our current understandings, unleashing entirely new categories of attack and defense. As one of the most popular devices in telecommunications history, it's no surprise that this year we found the focus shifting to the iPhone with a new, creative, and concerning form of attack that affects multiple phones.

This year, security researchers Charlie Miller and Collin Mulliner demonstrated a new technique for exploring mobile phone vulnerabilities by . In the process, they discovered multiple vulnerabilities in multiple kinds of phones, including a way to remotely attack and control iPhones. the day after the researchers presented, but it created a bit of panic as attendees rushed to disable SMS until Apple released the fix.

Many of us in the research community knew about the research ahead of time (it wasn't a secret), but once Charlie and Collin presented details, rumors instantly started circulating that it was being actively exploited by bad guys and it created a mini-panic of people disabling SMS and turning off their phones. While it doesn't look like the vulnerability was ever exploited in the wild, it highlights some interesting issues and the power of modern smartphones.