SMS hack could leave "every" iPhone vulnerable

124

Comments

  • Reply 61 of 88
    Quote:
    Originally Posted by roncraft


    don't understand why SMS exists at all.



    Well that's the way I see it. Except



    1) you get them free with your plan (like many european providers do) but if you are on prepaid, SMS-costs are the same as calling. I'll never understand, why people send me SMS then.



    2) you can send SMS for free (at least when you are on wlan), cause there's an app for that too (Global.AQ) .

    But these suckas just raised the price of the app from 1,59€ to 5,99€. Damn!





    Oh, and paying for receiving something one never requested is sick. This surely wouldn't be allowed in germany (I hope )
  • Reply 62 of 88
    This thread is getting slightly off topic. Let's get back to the point. I really hope Apple releases OS 3.1 with all this security patches and other stuff fixed.



    Carry on..
  • Reply 63 of 88
    irnchrizirnchriz Posts: 1,617member
    Quote:
    Originally Posted by sapporobabyrtrns View Post


    Let's see:



    Unlimited data: €14.90 (not the fair usage crap but real unlimited)

    3.6 to 7.2 mb/s (free)

    1000 mins talk time: €20.90

    500 SMS: €4.90



    Oh, did I mention unlocked iPhone as well.



    Sonera makes it simple in Finland. Thank you State Department for sending me here. Another year please.



    What did it cost you for your iPhone?



    It was also

    €36.90 for 900 mins

    €9,90 for 500 sms

    €9,90 for unlimited data (normally €14,90)



    There are also actual iPhone plans which cost

    Small - €31.69 100 mins, 100 sms, 10 MMS

    Medium - €51.49 250 mins, 250 sms, 25 MMS

    Large - €89.99 1000 mins, 1000 sms, 100 MMS

    Plus €9.90 for unlimited data (normally 14,90)



    Plus the cost of the iPhone.
  • Reply 64 of 88
    jahonenjahonen Posts: 364member
    Quote:
    Originally Posted by Logisticaldron View Post


    I think AT&T charges $15 a month for unlimited. That would mean that you send and receive more than 1500 a month. That is quite excessive for the average person, but if that is how you like to communicate, I certainly have no problt. At 1501 text messages (that means they are just under 1¢ each on AT&T) each at the max of 140Bytes you get a whooping 205.21KB of data for that entire month of SMS data for $15. That doesn?t seem very smart when I can send robust emails with images, audio, video and rich text with a maximum limit of 20MB per email on my device with plenty of other options to choose from.



    Don't just look at the US market. In most of the world, a lot of people don't have E-mail or at least don't access it every day (think of the 50+ croud, the poor, the non-office-worker etc. out there). SMS on the other hand is just as available (and is push-type) a contact's phone number. Therefore SMS is the more reliable form of text-oriented communication by far in other locations except the US (and maybe Canada). So the cost per Byte is not the real issue, it's the cost per message. SMS in practise is the Instant Messaging system for most of the "others" out there as it has been well before IM came along (not counting IRC for a limited user space in the late eighties- early nineties).



    Regs, Jarkko
  • Reply 65 of 88
    Theres a certain level of premeditation required to use this exploit, first the hacker would need to find your number and secondly they would have to know that you have an iPhone.
  • Reply 66 of 88
    shaun, ukshaun, uk Posts: 1,050member
    Quote:
    Originally Posted by Wiggin View Post


    Yeah, and we have to use minutes to receive phone calls, too. I believe much of the rest of the world does not, correct? You only have to pay for out going calls. That's why comparing plan costs is tricky. It may look like our per minute and per text prices are reasonable, but we pay for both incoming and outgoing.



    I would throw my phone out of the window if I had to pay to receive calls and texts!



    Don't you have a telecomms regulator in the US to stop this?
  • Reply 67 of 88
    al_bundyal_bundy Posts: 1,525member
    Quote:
    Originally Posted by LordNige View Post


    Theres a certain level of premeditation required to use this exploit, first the hacker would need to find your number and secondly they would have to know that you have an iPhone.



    since most of the viruses come from Eastern European organized crime gangs, it shouldn't be too hard. a lot of the information you can buy from ad firms
  • Reply 68 of 88
    Lol I don't believe it
  • Reply 69 of 88
    lilgto64lilgto64 Posts: 1,147member
    Sorry if someone already pointed this out as I did not read every post - couldn't AT&T simply detect the character being sent and block it before it is sent out? Or does the software used for handling SMS messages not have direct access to the content of the message?



    And in order for someone to send you an SMS they need to have your cell phone number - and to hack every iPhone ever they would need to have the phone number of every customer, right? or is the controlling of your phone allow them to forward itself to every in your contact list? or would they send the message to every phone number on the planet just to be sure? and how much in messaging fees would that rack up?



    Not saying there isn't a real risk - but how real is the risk that EVERY iPhone could be compromised? or even a significant fraction of them?
  • Reply 70 of 88
    Quote:
    Originally Posted by irnchriz View Post


    What did it cost you for your iPhone?



    It was also

    ?36.90 for 900 mins

    ?9,90 for 500 sms

    ?9,90 for unlimited data (normally ?14,90)



    There are also actual iPhone plans which cost

    Small - ?31.69 100 mins, 100 sms, 10 MMS

    Medium - ?51.49 250 mins, 250 sms, 25 MMS

    Large - ?89.99 1000 mins, 1000 sms, 100 MMS

    Plus ?9.90 for unlimited data (normally 14,90)



    Plus the cost of the iPhone.



    The price for the phone is separate from the contract. It seems that many to most people are opting for the personal customization plans. Pick this and that to get what you want. You can get the phone for ( I have to check to be sure ) 22 Euro/month/2 years or 48 euro/month/1 year. In my particular situation it does not matter as we negotiated to have our phones unlocked or we would not purchase them. This applies to all phones though. Not just the iPhone. Also I forgot to include: Teho Plus (3.6 mb/s guaranteed) for 2 years for free. Normally it would be: 14.90 Euro a month. Your rate table might be old as Sonera changed their tariffs a couple of months ago. All the operators are changing things to try and find the sweet spot where customers will stick.
  • Reply 71 of 88
    teckstudteckstud Posts: 6,476member
    I'll believe it when I see it.

    Email -yes.

    SMS- no.

    Who in their right mind would save a cryptic text message in the first place?
  • Reply 72 of 88
    teckstudteckstud Posts: 6,476member
    Quote:
    Originally Posted by lilgto64 View Post


    Sorry if someone already pointed this out as I did not read every post - couldn't AT&T simply detect the character being sent and block it before it is sent out? Or does the software used for handling SMS messages not have direct access to the content of the message?



    And in order for someone to send you an SMS they need to have your cell phone number - and to hack every iPhone ever they would need to have the phone number of every customer, right? or is the controlling of your phone allow them to forward itself to every in your contact list? or would they send the message to every phone number on the planet just to be sure? and how much in messaging fees would that rack up?



    Not saying there isn't a real risk - but how real is the risk that EVERY iPhone could be compromised? or even a significant fraction of them?



    Agreed- the whole concept is really stretching it.
  • Reply 73 of 88
    kennmsrkennmsr Posts: 100member
    Quote:
    Originally Posted by iCarbon View Post


    You can choose to block all texts -- just tell your wireless carrier to block all text messages, and they will be blocked.



    I agree that this sounds a wee bit hokey -- invisible texts or strange characters? I'm not sure that makes much of any sense, but I'm no expert -- I can only hope.



    If the carrier can block text messages entirely they should be able to do as the transporters do in Star Trek, activate a bio-filter and screen out malicious code from a text message or put the message in the bit bucket immediately. ISP's do that type of thing for junk mail they have spam blockers that prevent you from seeing suspicious emails or just sandboxing them and then letting you decide if you wish to risk opening that email. According to the description of how this DoS works the Sandbox technique is probably not wise. Maybe just a non-charged text from the carrier saying you received a text from such and such sender. It's a digital packet of information not analog so somewhere in the network a filter could be inserted to strip out the bad code or text. Having one entity being responsible for keeping an up to date filter is better than all of us loading some form of McAfee on our mobile devices.
  • Reply 74 of 88
    bigmc6000bigmc6000 Posts: 767member
    Quote:
    Originally Posted by Logisticaldron View Post


    I think AT&T charges $15 a month for unlimited. That would mean that you send and receive more than 1500 a month. That is quite excessive for the average person, but if that is how you like to communicate, I certainly have no problem with it.



    What I do have a problem with is the justification of $15 a month for such a small amount of data that is being sent over the carrier?s control channel when it?s not being used to connect with a cell phone tower. THe only real cost is the store and forward servers, but for the amount of data the cost is obscene, which is why i won?t pay for it.



    At 160 characters you have 140Bytes using a 7 bit character (at least according to Wikipedia). While I doubt that the average of using all 160 characters is quite small, while using only a handful characters is most common, I?ll use the larger for the sake of your argument. At 1501 text messages (that means they are just under 1¢ each on AT&T) each at the max of 140Bytes you get a whooping 205.21KB of data for that entire month of SMS data for $15. That doesn?t seem very smart when I can send robust emails with images, audio, video and rich text with a maximum limit of 20MB per email on my device with plenty of other options to choose from.



    I understand that most phones don?t have real email capabilities, but that isn?t the issue. The issue is the price gouging and the defense by people willing to pay so much for so little.



    It actually runs me $20 a month but between incoming and outgoing I average about 2300 a month. And yes, I think it's expensive and it sucks that I have to pay to send negligible amount of raw data but it's still not the 20 cents a message some people were talking about.



    I'm thinking I should, at most, be paying $10 a month for unlimited text but I really don't have a choice as it is the preferred method of communication for so many of my friends. (As a frame of reference I'm in my late 20's so it's not some teen thing IMO).
  • Reply 75 of 88
    Quote:
    Originally Posted by floccus View Post


    Problem with that is that you then need all of your contacts to have only your GV #, which is fine, but in my case, everyone has always had my current cell #, and having them all switch is a pain for everyone. Also, if someone SMSs your GV #, the default setup is to forward that to your cell #, again via SMS. If ATT allowed Apple to approve the GV app for the iPhone, things would be different for sure, but right now I can't be bothered to log into GV via safari and use the horrible site layout (it really is bad on the iPhone for those who don't yet know) to send and receive SMS messages.



    The idea behind Google Voice is that it's your permanent SINGLE phone number FOR LIFE. So, yes, a hassle to get everyone to start using it now, but once that once in a lifetime small hassle is complete, you will never have to go through it again (assuming GV actually lasts your lifetime), no matter how many different physical phone/cell lines you go through. That shoots down your first objection.



    Objection # 2 easily dealt with as well: AT&T allows you to allow SMS from only white-listed phone numbers. So you only white-list your GV number. Voila.



    Objection #3: Google will surely make a more iPhone friendly web interface for the service now that the app has been blocked, or, if your a bit more adventurous, you just jailbreak the phone and get the same app by the same developer that was on iTunes for free off of Cydia.
  • Reply 76 of 88
    kennmsrkennmsr Posts: 100member
    Quote:
    Originally Posted by jahonen View Post


    Don't just look at the US market. In most of the world, a lot of people don't have E-mail or at least don't access it every day (think of the 50+ croud, the poor, the non-office-worker etc. out there). SMS on the other hand is just as available (and is push-type) a contact's phone number. Therefore SMS is the more reliable form of text-oriented communication by far in other locations except the US (and maybe Canada). So the cost per Byte is not the real issue, it's the cost per message. SMS in practise is the Instant Messaging system for most of the "others" out there as it has been well before IM came along (not counting IRC for a limited user space in the late eighties- early nineties).



    Regs, Jarkko



    I take umbrage with the 50+ crowd reference you might be safer with a 70+ reference because a lot of us below 70 were taking computer courses as part of our math/science courses on college back in the early 60's so we are not afraid of the technology as were our mentors back in the 60's. I do training in NUrsing homes to 80 and 90 year olds who wish to communicate with non local children, grand and great grandchildren. It might take several repeat classes but they do have a desire to acquaint themselves with the technologies. So respect your elders and don't relegate them to checkers and knitting take time and share your knowledge and desire to communicate with them. You will get great joy as one of those senior citizens receives a note or picture from a distant relative and their face lights up with the ease in which it was received.



    P.S. I do find Apple's OS easier to teach because of Steve's use of the desktop metaphor is closer to what these folks used in their working days.
  • Reply 77 of 88
    justflybobjustflybob Posts: 1,337member
    Quote:
    Originally Posted by Rot'nApple View Post


    Sorry I can't lol with you, I don't get it?



    Sadly, neither did the USA... for 8 long insufferable years.
  • Reply 78 of 88
    chronsterchronster Posts: 1,894member
    Quote:
    Originally Posted by OC4Theo View Post


    Yes, the world will come to an end one day. So what? Stop living? Hell, no!



    What were these idiots doing when they discovered these softwares holes? Well, look at it this way; a house can burn down no matter what materials were used to build it. All you have to do is set fire to it.



    These guys need to get a real job, and stop scaring people for every nonsense just to get publicity. May be they should stop holding their stupid Black Hat "insecurity" conference and have a White conference instead.



    Yeah! What next? May be the nuclear war will be started with an iPhone! I hate you bastards!!



    This can't be a real thought. There's no way you're serious!



    ...Are you serious?



    I mean, what you said is like borderline believable. Something someone would say to get as many replies as possible. What's that called again?



    I could pick your comment apart and show you why it was one of the worst things I've ever read here, but I'm still uncertain that you weren't just yanking everyone's chain.
  • Reply 79 of 88
    chronsterchronster Posts: 1,894member
    Quote:
    Originally Posted by teckstud View Post


    Agreed- the whole concept is really stretching it.



    Ah, but if the exploit was found on Windows mobile, imagine how this discussion would look.



    The point of this article is that with as sophisticated as the iphone is, there's a simple method to get into it and do some damage. The exploit is so simple to execute that it makes you wonder what else there is (well it made me wonder at least.)



    I don't think these guys were trying to spread hysteria throughout the iphone community by any means. Just point out something interesting.



    It is kind of peculiar that after 6 weeks, Apple hasn't pushed out a patch. Most of the time, security vulnerabilities go unpublicized though so maybe Apple has the fix, but they feel the probability of anyone being effected by this exploit is so low, it can wait for 3.1. For all we know, some of the security vulnerabilities they patched with 3.0 might have been known about since just after the previous os release.
  • Reply 80 of 88
    jahonenjahonen Posts: 364member
    Quote:
    Originally Posted by KennMSr View Post


    I take umbrage with the 50+ crowd reference you might be safer with a 70+ reference because a lot of us below 70 were taking computer courses as part of our math/science courses on college back in the early 60's so we are not afraid of the technology as were our mentors back in the 60's. I do training in NUrsing homes to 80 and 90 year olds who wish to communicate with non local children, grand and great grandchildren. It might take several repeat classes but they do have a desire to acquaint themselves with the technologies. So respect your elders and don't relegate them to checkers and knitting take time and share your knowledge and desire to communicate with them. You will get great joy as one of those senior citizens receives a note or picture from a distant relative and their face lights up with the ease in which it was received.

    .



    Sorry about that one. It sounded worse than intended. I originally was typing 40+ (being 38 myself ), then thought, nope, almost wrote 60+, but then for some odd reason wrote 50+. In honesty, the only thing I was trying to point out (in a politically incorrect way) was that the older people get out there, the less likely they are of having an E-mail account that they check regularly (let alone via their phone).



    However they do want (and do have) a mobile phone for the reasons you stated. Push SMS is there as soon as you have a mobile (which most do to be in contact with their relatives) and as an example many of our family's elders have been overjoyed when a picture of the kids doing something arrives directly on their phone (via MMS) without them having to do or configure anything or go to the computer etc. Most of them do not have E-mail at all (they don't need it for anything).



    With the U.S. recipient charging mechanisms I do understand why SMS or MMS is not common there, but the U.S. seems a "special case" in that regard.



    Regs, Jarkko
Sign In or Register to comment.