Researchers Collin Mulliner and Charlie Miller shortly before they proved they could attack my iPhone with a text message, even after a beer or two.
(Credit: Elinor Mills/CNET News)LAS VEGAS--Researchers have discovered a way to take complete control over an iPhone merely by sending special SMS messages and demonstrated it on my iPhone at the Black Hat security conference on Wednesday.
Although an attacker could exploit the hole to make calls, steal data, send text messages, and do basically anything that I can do with my iPhone, the researchers were kind and merely rendered it temporarily inoperable.
Here's what happened: While I was talking on the phone to Charlie Miller, his partner, Collin Mulliner, sent me a text message from his phone. One minute I'm talking to Miller and the next minute my phone is dead, and this time it's not AT&T's fault. After a few seconds it came back to life, but I was not able to make or receive calls until I rebooted.
My iPhone is not jailbroken and it is running iPhone OS 3.0.
The attack is enabled by a serious memory corruption bug in the way the iPhone handles SMS messages, said Miller, a senior security researcher at Independent Security Evaluators.
There is no patch, despite the fact that Apple was notified of the problem about six weeks ago, he said. All current versions of the iPhone operating system are affected.
The attack is similar to an SMS attack demonstration CNET News wrote about in April in which mobile security firm Trust Digital was able to send an SMS to a phone that opened up a Web browser and directed the phone to a malicious Web site where malware could be downloaded.
In the more recent research, Android-based phones were found to be similarly susceptible to an SMS attack, only an attacker could temporarily knock the phone off the cell network but not take control, according to Mulliner, who's getting his PhD at the Technical University of Berlin. Google patched the hole last week within a day or two of being notified of the problem, he said.
Meanwhile, a bug in the code written by HTC that controls the user interface on Windows Mobile devices could also be exploited via the SMS messages to make it so there are no buttons to push so the phone can't be used, said Miller.
For the attack to work, an attacker must send hundreds of SMS control messages, which are different from regular SMS messages, according to Miller. Only the initial SMS may be seen, he said.
The researchers will demonstrate the attack on an Android phone and an iPhone during their presentation on Thursday.
Previous iPhone attacks required an attacker to lure the iPhone user to visit a malicious Web site or open a malicious file, but this attack requires no effort on the part of the user and requires only that an attacker have the victim's phone number, Miller said.
Once inside a victim's phone, the attacker could then send an SMS to anyone in the victim's address book and spread the attack from phone to phone, he said.
Previously, Miller discovered a hole in the mobile version of Safari shortly after the iPhone was launched in 2007 and earlier this year he won a contest at CanSecWest by exploiting a hole in Safari.
Asked what an iPhone user can do when attacked, Miller replied: "Rebooting wouldn't be a bad idea. It would stop all but the most sophisticated attacker. However, it doesn't take but a second to grab all your personal info from the device, and as soon as you turn it back on, the bad guy could attack you again. That's why I think this is so serious."
Updated July 30 at 4:45 p.m. PDT to include that phone attacked was not jailbroken and was running iPhone OS 3.0, and at 8:18 a.m. with Miller talking about what a victim can do when attacked.
TextPlus not only sends text messages for free, it also supports group messaging.
Lots of apps let you sidestep iPhone SMS to send and receive text messages for free. But in most cases the apps themselves cost at least a few bucks. Enter TextPlus, a free, ad-supported app that offers unlimited texting.
That's reason enough to celebrate, but TextPlus has one other trick up its sleeve: group messaging. You can send a text to multiple recipients, and their replies will stay grouped together like in a chat room. (Obviously this works best if everyone uses TextPlus, but even nonusers can receive messages from the app.)
When you create a new message, TextPlus lets you choose one or more of your contacts or enter numbers manually. Turn your iPhone sideways and you get a landscape keyboard--always a welcome option.
Of course, the hassle with any third-party SMS app is that you don't get notifications of new messages unless the app is running. iPhone OS 3.0 promises to allow developers to remedy this problem, but for now the common workaround--and the one offered here--is getting new-message notifications via standard SMS.
Needless to say, that's not an ideal solution, as you still incur SMS charges for those notifications. But that's par for the course with SMS apps, and you're still able to save on outbound messages.
Until now, Textfree was my go-to app when my SMS count was nearing its monthly limit. But the freebie Lite version tops out at 20 messages per day, doesn't have a landscape keyboard, and doesn't do group messaging. Needless to say, TextPlus has replaced it.
Is there an SMS app you like better? Tell me why in the comments!
The iPhone famously solves many of life's little problems--you can't decide where to eat, you've got nothing to read, you need to update your Facebook status right now--but who's going to solve the iPhone's problems?
For instance, maybe it's low on storage. Or it's having trouble connecting to a Starbucks hot spot. Here's a list of five common iPhone ailments and the apps that aim to cure them.
Why let music consume precious iPhone storage when Simplify Media can stream your entire library from home?
- You're running out of storage. Apple may have a 32GB iPhone waiting in the wings, but how does that help you and your storage-strapped model now? Here's one radical idea: delete all your music. Then install Simplify Media, a $3.99 app that streams your entire music library from your Windows, Mac, or Linux PC. I've been test-driving the app for a few days and it works like a charm. Just think of how much space you'll free up for apps, videos, photos, and the like.
- You're texting your way to the poorhouse. Tired of dropping an extra $20 per month for unlimited texting? How about a one-time fee of $5.99 instead? That's the price of Textfree Unlimited, which, true to its name, lets you send and receive an unlimited number of text messages. It's not perfect--you need to enable "push" mail if you want new-message notifications--but it'll definitely save you money.
- There's no way to check your SMS count. Prefer to stick with old-school texting? It would be nice if you could see how many messages you have left for the month. Pageonce just took the wraps off Cell Minute Tracker, a 99-cent app that shows not only your SMS usage, but also your AT&T account balance, rollover minutes, and more. (You can even pay your bill.) Check out Jessica Dolcourt's full review.
- There's no to-do list. Third-party apps to the rescue! Chapura's KeyTasks provides robust task management, and it syncs with Outlook. (But $9.99? Ouch!) Appigo's Todo offers iCal syncing for Mac users for an equally ouchy $9.99. If you'd rather sync your tasks to the Web, try Remember The Milk. The app's free, but you need a $25/year pro account.
- Connecting to Starbucks' Wi-Fi is a hassle. Oh, the hoops you must jump to tap a Starbucks Wi-Fi network. For a mere 99 cents, Easy Wi-Fi lives up to its name, making AT&T hot-spot connections a one-tap affair. No monkeying around with text messages and all that: you'll be online faster than you'll be sipping your latte.
VoIP provider Skype plans to announce Tuesday that it will be working with SpinVox to provide its users with voice-to-SMS messaging in four languages.
This adds another option to Skype's messaging notifications for both Windows and Mac, and it includes a free e-mail notification or a simple SMS notification when a contact leaves a message.
Converting the messages from voice to text won't be cheap, however. Users will pay 25 cents per message, not including the standard Skype text message rate, and long voicemails could be spread out over as many as three messages. If the entire voicemail won't fit into three texts, then the message will be cut off. Also, if the message is garbled or otherwise unconvertible--because of poor signal quality, for example--SpinVox and Skype will still charge you for the failed conversion effort.
Words that cannot be understood will be converted into question marks or spaces in the body of the message. Fortunately for the cost-conscious, there are several options for cutting down on quickly running up a massive bill. Users can configure which of their Skype contacts will have their voice messages converted, so it's not an all-or-nothing deal. Messages will also only be sent after a 10-minute delay, so you don't have to worry about getting a text if you walk away from your desk for a few minutes. You'll have the option of configuring a maximum number of voicemail conversions per day, too. An obvious problem with that is missing that must-get voicemail, but at least the option will be there.
SpinVox with Skype will support English, Spanish, French, and German, and there are plans to incorporate SpinVox's current support for Italian and Portuguese, as well.
Although text messaging is still one of the favorite pastimes for children and adults alike, software firm Geodesic believes that mobile instant messaging will cannibalize SMS and become the de facto form of communication through cell phones, going forward.
The company offers a tool called Mundu IM, which recently entered its fourth iteration. The software provides users with an IM service that works with AIM, Google Talk, ICQ, MSN, Yahoo, and Jabber accounts, with collaboration across the Web and wireless devices.
Mundu IM is currently supported on most mobile phones running Symbian, BlackBerry, Windows Mobile, Palm OS, and Java platforms. The service also has a iPhone Web interface, which allows users of the Apple smartphone to log in to their favorite IM application without requiring a download through the App Store.
(Credit:
Geodesic)
I had the opportunity to use the Mundu IM service on my iPhone 3G and found that it worked quite well. I was able to log in to my instant-messaging services without a problem, and upon doing so, I found that chatting with others through the software was quick and just as simple as chatting with them on my desktop.
But where Mundu IM really shines is in its extras. The service allows you to share pictures taken from your phone with friends, transfer files, and cross-conference with contacts across IM services, making it much simpler to talk with people, regardless of their preferred IM software.
Mundu's design is second to none. It features stylish icons that make it easy to choose your IM service, and the interface during chat was simple, which made the experience far more usable.
(Credit:
Geodesic)
Although the software itself is simple and elegant, I'm not quite sold on the implementation. It's nice to have a full-fledged IM service on my iPhone that will help me save money on SMS, but why not make it an iPhone app and offer it on the App Store? Making Mundu Web-based seems a bit odd and takes away from an otherwise fine service, due to Safari's annoying quirks and hiccups, which become frustrating after some time.
When evaluating Mundu's competitive environment, it becomes clear that its IM service takes aim at Agile Messenger, which currently charges customers $44.95 for lifetime use. Based on my findings, the experience is similar, but Mundu IM's $11 one-time fee puts it over the top and makes Agile Messenger less appealing.
(Credit:
Geodesic)
It would have been nice if Mundu IM were free, like Meebo, but I understand that Geodesic needs to turn a profit too, and $11 is more than affordable, considering that you'll have your phone for at least two years.
With all the versions Mundu IM offers, it should be noted that "your mileage may vary" depending on the version of the software you use. Although the iPhone version works as advertised, and provides an experience that would make me want to use it on a regular basis, phone differences, mobile-OS quirks, and other considerations become an issue when applying that opinion to all versions of the software.
Because of that, I need to qualify my recommendation when I say that Mundu IM is worth using on the iPhone if you use multiple IM services, and you don't mind accessing them through the Safari browser. But if you only use AIM, I simply don't see a reason to use Mundu IM--access the App Store, and download the AIM app instead. It's free.
Don Reisinger is a technology columnist who has written about everything from HDTVs to computers to Flowbee Haircut Systems. Don is a member of the CNET Blog Network, and posts at The Digital Home. He is not an employee of CNET. Disclosure.
This morning, SMS reminder service Kwiry is adding a new tool to its repertoire called shortcuts. It goes beyond the original implementation of adding keywords and photos to look up later, and turns it into a tool that links up with various Web services you might be using.
The first implementation of that is with Netflix. If you're a subscriber of the DVD-by-mail service, you're now able to simply send an SMS to the service with "Netflix" and the movie title and it will automatically be added to your queue. This is one of those things that's just genius--if you overhear someone talking about a movie you can simply send a quick text message and have it show up on your doorstep. There's no need to log in to Netflix from your phone (which only works on a few handsets) or scribble it down somewhere for later.
Amazon.com users also have their own shortcut that's not nearly as sexy as the one for Netflix, but still useful. Texting "Amazon" with a product name will add it to your wish list. Like the Netflix implementation, this has been set up to let you track it down later just like you would a search query, but with the eventual intent to buy. As part of a promotion, the company will be buying a Kwiry'd item someone's put on their wish list each week for the next few months.
Besides Netflix and Amazon, Kwiry has also added some GTD tasking utilities, including support for writing a to-do list and adding events to your Web calendar using the same shortcode. It will convert things like days of the week into the proper date and time in whatever calendaring tool you're using. Likewise, the to-do list you put together can be edited and rearranged back in Kwiry. I think these two items are going to be used less than the Netflix and Amazon look-up, but it's a sign of other things to come from this search look-up tool.
As I've said before, I think Kwiry is a fun little tool if you don't have the time to fire up your phone's Web browser, or if you're one of the millions of folks with an older handset. The only crux here is that SMS fees continue to go up, and using this a few times a day can really add up unless you've got a good texting plan from your carrier.
Kwiry users can now add Netflix movies to their queue and items from Amazon onto their Amazon wish lists with shortcode messages.
(Credit: Kwiry)
Cellity Communicator (download) is an e-mail, SMS, and calling client and service for Java cell phones that's better than it looks. That may not sound terribly heartening, but it's no derisive knock. Designing an app that crams phone calls, conference calls, various tiers of texting, and e-mail into a mobile application and still manages to look simple is quite an achievement.
It is arguably overly so. Compared with other mobile communication applications, like EQO and Fring, Cellity Communicator reveals a rather dressed-down interface that requires a few too many clicks to get contacts added and messages started. To Cellity's credit, the interface can be expanded to include more options with an expert mode. Higher-end Java MIDP2 phones support contact-importing, but BlackBerrys don't, so those folks will labor to enter contacts by hand.
(Credit:
Cellity)
When it comes to performance, Cellity Communicator does deliver on promises of sending and receiving e-mail and SMS messages through various approaches, and of providing cheap international calling through purchased credit. At this point, phones calls are placed through a ring-back bridge.
Cellity's selection of text services is wide, but potentially confusing. Besides shooting an e-mail to a contact's address, there's free SMS texting to other registered users using Cellity's integrated FreeSMS product, and a glorified version of FreeSMS that is positioned as an e-mail message one addresses to a cell phone number. Nonregistered users receive teasers from these two message types with a prompt to download the communicator. Sending a regular text message is a workaround, though depending on your plan, Cellity's charge could exceed your carrier's cost.
Since Cellity Communicator begins by giving you a unique Cellity.com e-mail address, the app could function as a person's only e-mail client. However, there's not much in the way of message management, so I'm hesitant to recommend it for those with other options. The program also supports Web mail-forwarding and replying through another e-mail address.
Sounds like a fine app, right? It is, at least on paper. Despite its demonstrable uses for both low-end and high-end devices, Cellity Communicator simply fails to grab me. It doesn't help matters that a couple of obvious bugs have been allowed to slip through and that I'm biased against multiple clicks to accomplish a simple task. All things said and done, it is a quite decent app that has a strong following and could secure a stronger future, but which still feels more unfinished and less engaging than its peers.
This morning Web-SMS service Joopz is launching a new Outlook plug-in that turns your desktop e-mail client into a one-stop SMS hub. Once tied into your Joopz account, you can send and receive text messages like you would e-mail. The tool also syncs up with your Outlook contacts, to let you send notes to anybody with a phone number.
(Credit:
MobileSphere)
The service is flouting the new plug-in as a handy way to keep in touch with friends, but for business users who use SMS to communicate with their colleagues while out on the road, this could be a handy, finger-saving tool for those with their PC handy.
In addition to one-on-one SMS messaging, you can send out messages to groups of friends like you'd do with an e-mail. There's also a group chat feature that mimics the "reply-all" feature to send the response back to everyone on the list, be it e-mail addresses or phone numbers.
Since launching in December (coverage), the service has launched profile modules for MySpace and Facebook, and is currently working on a desktop application that acts like an IM client.
My father's Motorola E815 from Verizon is suffering chronic SMS, or text message, spam. At first, the unwanted messages trickled in--religious messages with pictures of saints one time, pharmaceutical marketing another. Then the spam rate escalated. After one spammy text message yesterday and two this morning, Dad decided he wanted out.
Carriers let you block messages, but won't filter spam.
(Credit: CNET Networks)"Out" in his case, and in the case of most North American mobile phone users, is as much about the phone bill as it is receiving unwanted texts. Service providers like Verizon and T-Mobile charge for inbound and outbound SMS activity, either per message, generally 10 cents to 15 cents per outgoing text message, or as part of a larger service, usually between $5 and $10 more per month depending on the plan. Data downloads cost extra too, so spam texts with image attachments ratchet up the bill. "This was becoming an expensive habit," says Dad.
The kicker, of course, is that it's not his habit.... Read more
- prev
- 1
- next
