Getting a text message is akin to someone sliding a piece of mail under your door: You may not have asked for it, you can't stop its delivery and you have to deal with it whether you want to or not. The fact that text messages appear on mobile phones without any interaction from the user, and sometimes with limited interference from the cellular network operators, can give criminals an opening to break into those devices, as three teams of researchers showed Thursday at the Black Hat security conference here. Their targets ran the gamut. Apple Inc.'s iPhones and phones running Microsoft Corp.'s Windows Mobile and Google Inc.'s Android operating systems were all shown to be vulnerable. In some cases, the problems weren't with software, but the way cellular networks process messages. The findings are troubling as people increasingly use their phones for handling sensitive data, like e-mail and online banking. Phones are morphing into mini-computers, which means they're going to start getting attacked like PCs. The techniques demonstrated Thursday show that even disciplined and safety-conscious users could have their phones hacked because they can't totally control what's coming into them. Innocent people could have their smart phones knocked offline, commanded to visit sites hosting pornography or viruses. Take this example about the iPhone, from Charlie Miller, a well-known hacker of Apple Inc. and other products, and his co-presenter Collin Mulliner. They showed how they can disconnect an iPhone from the cellular network by sending it a single, maliciously crafted text message, a message the victim never sees. The messages exploit bugs in the way iPhones handle certain messages and are used to crash parts of the software. Miller said messaging attacks are so attractive, and are going to become more common, because the underlying technology is a core phone feature that can't be turned off. “It's such a powerful attack vector,” Miller said. “All I need to know is your phone number.” Apple said it couldn't immediately comment. Microsoft said it is investigating the matter. Google confirmed that its vulnerability was fixed.
