SMS messages could be used to hijack a phone
Be careful who you give your mobile phone number out to. An attacker with the right toolkits and skill could hijack your phone remotely just by sending SMS messages to it, according to mobile security firm Trust Digital.
In the Trust Digital demo on YouTube, an attacker sends an SMS message to the victim phone (on the left) which opens up a Web browser and downloads an executable file that directs it to send an SMS to the attacker's phone (on the right).
(Credit: Trust Digital)In what it calls a "Midnight Raid Attack" because it would be most effective when a victim is asleep, an attacker could send a text message to a phone that would automatically start up a Web browser and direct the phone to a malicious Web site, said Dan Dearing, vice president of marketing at Trust Digital. The Web site could then download an executable file on the mobile phone that steals data off the phone, he said.
Dearing demonstrates how this can be done in a video on YouTube.
In another type of attack, an attacker could hijack a phone by sending a type of SMS message called a control message over the GSM network to a victim's phone that is using a Wi-Fi network and then use special toolkits to sniff the Wifi traffic looking for the victim's e-mail log-in information. This attack is explained in another YouTube video.
While the attacks at this point are proof-of-concepts, they could be done if someone has the requisite knowledge and toolkits, said Dearing. Trust Digital recently announced software called EMM 8.0 that can help organizations protect employee phones from these types of attacks, he said.
"This is a completely real threat," said Philippe Winthrop, a director in the global wireless practice at Strategy Analytics. "We will see these attacks. It's a matter of time."
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
No Apple has never been hacked... ever in any competition. Look at the way these competitions are run. When it comes to Apples suddenly the the rules are changed. In the last competition it was widely reported that the Apple was hacked in 20 minutes. When did 3 days become 20 minutes? After 3 days of trying the Apple was the only computer that was still secure. The Lixux box was cracked in 12 hours the Windows computer was cracked in 15. In order for the Apple to be cracked the rules of the contest had to be changed, and the keys to the encryption had to be reveled as well as the DNS codes. Thats like giving a person 3 days with lock picks only having to tell them the key is really under the mat. Then lift up the mat for them.
You have it all wrong
@parent commenter
No one said this was a WinMo only exploit.
You really need to check your facts and keep up with the news. Yes, the Apple products were hacked. You can try to explain it away however you wish and deny reality, but the results are still the same- they got hacked.
Big freaking deal. Get over it.
Geez.
http://news.cnet.com/8301-13579_3-9905095-37.html?tag=mncol;txt
http://news.cnet.com/8301-1009_3-10199652-83.html?tag=newsEditorsPicksArea.0
When did 2 min [for one hack] or 10 seconds [for the other] become 3 days? And I didn't notice anyone "leaving the key under the mat" for this guy.
1) Well, no network is really secure no matter the OS.
2) It is all Apples fault
3) If 1 and 2 fail stick fingers in ears and go lalalalallalalala
Considering the methods used apply to Windows Mobile, Blackberry, Palm and... yes, the iPhone, then it really a cross platform method.
It's a demonstration of the technique which is cross platform.
It baffles me. I use the phone for calling, and I text only when I know that that individual is at work and cannot be disturbed, at times, I leave a message. Easy, and simple.
What gets me about this story is the fact that it said, "In what it calls a "Midnight Raid Attack" because it would be most effective when a victim is asleep..." Wait a minute, isn't the phone turned OFF!! and charging? Then it says, "automatically start up a Web browser.." Let me get this straight, your phone turns ON!! automatically?? Be for real! First of all, when you turn on your phone, the first thing you'll see is a pop up telling you that you received a call (in missed call) then that you have a text message, and if you want to view it. Nowhere, does it say you want to connect to the internet, unless, you yourself have "clicked" an assigned button to connect. So, unless I am mistaken and these newer phones seem like an AI kind of phone that do all the clicking for you then i am still living the dinosaur age with a simple and easy phone with no "frills" (although I do have web capable, i do not use it).
As a word of caution, read what it says on you display before you click or answer, it may save you from saying, "****! What have I done!"
First, this is the first time hear that someone turns his phone off when he goes to sleep."
I turn my cell phone off when I go to sleep. Heck, I usually turn it off the minute I get home from work! I'll venture a guess that the people that leave their phones on at night probably don't have landlines or have a real need to be reached by cell in the middle of the night (instead of a landline).
I love technology, but sometimes the security issues get to be a real headache. Oh well, gotta take the bad with the good, right? ;-)
- by harh1972 April 22, 2009 2:57 PM PDT
- This reporting is not responsible. I can write code to do bad things on ANY machine. If I ask you to let that code on to your machine - you're done. The reporting makes it sound like we will starting getting sms attacking our phone. Simply not true.
- Like this Reply to this comment
-
(30 Comments)