According to prominent Jailbreak hacker Pod2g (via iDownloadblog), a discrepancy in the way Apple’s iOS messaging platform interprets key SMS data may allow scammers and malicious third parties to gain sensitive information from iPhone users, affecting all versions of Apple’s mobile OS.
Inside the numerous protocols associated with translating and sending text message data lies a unique field, a field that allows a user (with the right tools) to modify the reply-to address/number for a text message.
According to Pod2g, Apple’s iOS messaging platform recognises this data, but instead of showing the sender, it displays the reply-to address instead:
In the text payload, a section called UDH (User Data Header) is optional but defines lot of advanced features not all mobiles are compatible with. One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer to the text, he will not respond to the original number, but to the specified one.
If the feature was to be implemented correctly, the user would either see the original number — which would identify an unknown sender immediately — or be able to view both the original number and the reply-to number.
Effectively, it could enable scammers to spoof the sender of the message (be it your bank or other private account) and send you to a website address that has the sole intention of capturing your details. While SMS spam is less prominent than say email spam (at least it is where we are), it could still be used to leverage sensitive data from unwitting iPhone owners.
We have contacted Apple for comment and will update the article should we receive a reply.
[Image Credit: Frank Spin]
Get the TNW newsletter
Get the most important tech news in your inbox each week.