Is a new facet of Apple's iMessage for iOS 5 leaving iPhone owners vulnerable to losing control of who sees their text messages?
Writer Sam Biddle of the popular tech site Gizmodo has highlighted what he deems a major security and privacy issue in a post titled "The Apple Bug That Let Us Spy On A Total's Stranger's iPhone." The "bug" of the title refers to an apparent hole in iOS 5 that potentially allows strangers, thieves, stalkers and oblivious buyers of stolen iPhones to read every incoming and outgoing message that a certain iPhone owner sends over iMessage, whether they want to or not.
Biddle's article provides a real-life example of how this works: Apparently, a friend of Biddle's took her son's iPhone into an Apple store for a mundane repair. After the employee at Apple's Genius Bar had finished his work on the son's iPhone, he inserted his own SIM card into the iPhone he was repairing to ensure that his repairs had worked. After finding that they had, he removed his SIM card and replaced the son's SIM card into the slot, returning the iPhone to the family as good as new.
Alas, this is not the end of the saga. Afterward, the son was able to see every iMessage that this Apple store Genius was both sending and receiving -- some of them lewd and decidedly inappropriate for a minor. Everything the Apple store employee, who Biddle identifies only as Wiz, was sending on his own iPhone was being duplicated on the son's iPhone. Wiz was presumably unaware that his personal life, and the personal lives of his friends and lovers, were being broadcast to the high school student whose iPhone he had fixed days prior in the Apple store where he worked.
Biddle provides a frightening summary of what this bug could mean should your SIM card happen to get inserted into another iPhone:
You probably underestimate how much of yourself you casually pour into texts each day. We know enough about this guy to stalk him, blackmail him, and harass him, using nothing more than what we've picked up. Based on only a handful of chitchat breadcrumbs and some Google work, we pinned down [his] home address, his Facebook profile, email address, personal information about friends, where he exercises, and�drumroll�the Apple store where he works. Yep! This Apple bug screwed an Apple employee�at the same store where our pal took her phone.
So, who does this affect? Well, people who have their iPhones stolen, certainly. Ars Technica examined the still-nascent issue of iMessages appearing on stolen iPhones back in December, and a guess by iOS security expert Jonathan Zdziarski back then as to what is happening with iMessages and stolen phones seems spot-on two months later:
"I can only speculate, but I can see this being plausible," Zdziarski told Ars. "iMessage registers with the subscriber's phone number from the SIM, so let's say you restore the phone, it will still read the phone number from the SIM. I suppose if you change the SIM out after the phone has been configured, the old number might be cached somewhere either on the phone or on Apple's servers with the UDID of the phone."
In other words, iMessage may be pulling the old phone number from a cache somewhere and continuing to use it on the device if the SIM was removed after it was configured as a new phone.
If your old phone number remains imprinted to the phone itself, then, you are presumably at risk of revealing all of your iMessages to the thief and whoever he or she sells your phone to no matter what you do. Extrapolating outwards, the risks for privacy intrusion are also rather high -- if Gizmodo's report is true, then, hypothetically anyone with access to your iPhone could simply remove your SIM card, momentarily place it in his or her own iPhone, and then return the SIM to yours, and your iMessages would automatically be copied to that person's iPhone without your complicity or knowledge at any point. A frightening scenario, if true.
Apple responded to the fracas in a statement to Jim Dalrymple, an Apple watcher who writes for The Loop, saying that the employee simply "didn't follow protocol" (MG Siegler of Techcrunch points out that Apple Geniuses are supposed to use test SIMs, not personal SIMs, when fixing customer's iPhones). From The Loop:
�This was an extremely rare situation that occurred when a retail employee did not follow the correct service procedure and used their personal SIM to help a customer who did not have a working SIM,� Apple representative Natalie Harrison told The Loop. �This resulted in a temporary situation that has since been resolved by the employee.�
Dalrymple called the resulting situation in which the customer received all of the employee's incoming and outgoing iMessages a "perfect storm" with three easy fixes (via Techcrunch):
Remote Wipe and then call your carrier/de-active your SIM (de-register must be within 24 hours after Remote Wipe) or Activate a replacement phone with a replacement SIM using your same phone number or Change your Apple ID password (only works if you use an Apple ID with iMessage)
Gizmodo isn't satisfied with this response. This still does not address what happens to iPhone owners with stolen phones, or iMessage users who aren't aware that their SIM card has been placed in a different phone -- the fact that your personal messages are turning up on another device without your knowledge still feels like a major security and privacy lapse. With the upcoming iOS 5.1 having entered Beta testing, we'll have to see if Apple's developers are able to resolve the great iMessage kerfuffle of 2012 and come up with a more satisfactory solution to what, for many, remains a dangerous, too-shadowy facet of an otherwise beloved, cash-saving iPhone feature.
0 Comments:
Post a Comment