Bad RCS implementations are creating big vulnerabilities, security researchers claim


Security researchers at SRLabs have found a number of vulnerabilities with the way carriers around the world are implementing RCS, the new messaging standard designed to replace SMS, Motherboard reports. In some cases, these issues could compromise a user’s location data, they could allow their text messages or calls to be intercepted, or they might allow their phone number to be spoofed.
One issue identified on an unnamed carrier’s implementation could allow any app on your phone to download your RCS configuration file, for example, giving the app your username and password and allowing it to access all your voice calls and text messages. In another case, the six-digit code a carrier uses to verify a user’s identity was vulnerable to being guessed through brute force by a third-party. These problems were found after researchers analyzed a sample of SIM cards from several different carriers.
RCS is a new messaging standard that’s designed to one day replace SMS as a means of sending text messages. It supports many of the features introduced by modern messaging clients like iMessage and WhatsApp including read receipts and typing indicators (although not end-to-end encryption), in a cross-platform standard that different companies can integrate with. The researchers did not identify any problems with the standard itself; it’s the way carriers are rolling it out that’s the problem.
SRLabs didn’t share which security holes were found with which carriers, but noted that the standard is being implemented by at least 100 carriers around the world, including the four US majors. “We find that is actually a step backwards for a lot of networks [compared to SMS],” Karsten Nohl from SRLabs told Motherboard. “All of these mistakes from the 90s are being reinvented, reintroduced.”
When contacted for comment, a spokesperson for the trade body that represents network operators, the GSMA, told Motherboard that researchers from SRLabs will be presenting their findings to the organization next week, and that they believed their are countermeasures available to fix the issues they’ve identified. “We are grateful to the researchers for allowing the industry the opportunity to consider their findings. The GSMA welcomes any research that enhances the security and user confidence of mobile services,” the spokesperson said.
Despite its advantages over SMS, RCS has been slow to roll out. The standard was announced last year, but it wasn’t until this month that Google started making it the primary texting platform for Android Messages, and that change won’t affect the best-selling Android phone manufacturer in the US, Samsung, because by default it offers its own messaging client. AT&T, Verizon, T-Mobile, and Sprint are also planning on offering support via their own texting app next year. Meanwhile, Apple has declined to comment on whether it will support the standard.
SRLabs will be presenting its findings at the Black Hat Europe conference in December, after showing off some of its work at the DeepSec conference today.

Comments

Post a Comment

Popular posts from this blog

Linktree’s free workaround lets you add multiple links to your Instagram bio

Image
Instagram only gives you one opportunity to link to outside resources inside its photo sharing platform. This might not be a problem for a majority of the users, but for those wanting a little more customization and even more options, it leaves much to be desired. Enter  Linktree , a free tool for Instagram designed to improve traffic to your outside link, be it a blog, portfolio, or store. How it works is fairly straightforward. After connecting Linktree to your Instagram profile, you’ll receive a single link to place in your Instagram bio. Once that link in place, you can customize what it’s linked to within your browser, be it a single website, or a collection of sites you’re looking to direct followers to Say you’re a photographer who’s using Instagram as a marketing tool for your wedding photography. Using Linktree, you can direct Instagram followers to your blog, your portfolio site, and even your other social media accounts. Until now, you would’ve been stuck choosing b
Read more

EVERYTHING WE KNOW ABOUT THE PIXEL 4, THE MOST-LEAKED PHONE EVER

Image
Google’s  Pixel 3 might have been the  most-leaked phone in history . Long before its unveiling, we knew practically everything about it from unboxing videos, photo comparisons, even a full review of the device. Surely, for the Pixel 4, Google would clamp down on leaks to leave some surprises for its debut on  October 15th , right? Let’s just say, if that was the plan, it didn’t exactly work out. We’ve now seen the Pixel 4 XL from every angle and in three different colors. At least seven different sources have touched this phone, many of them confirming the same specs. We not only know which cameras it’ll have, but also what they may be capable of, including air gestures (go figure). That doesn’t even count information Google has already shared  on purpose. So if you want to know almost everything about the Pixel 4 nearly a month before it’s announced, buckle up. We’ve sifted through all of the rumors and information we can find to compile everything we know — and everything we
Read more

Our favorite iOS apps for the iPhone and iPad in 2018

Image
As 2018 comes to a close, it’s time to look at some our favorite apps of the year. While not all of these are brand new, many of them popped up onto our radar for the first time in 2018, and are definitely worth the attention. Others are some of our favorites that are still best-in-class despite having been around for some time now. We aim to do things differently at TNW, and as such you’re not going to find the recommendations you’re probably used to seeing: Gmail, Skype, Dropbox, and the like. Instead, we want to focus on the best-of-the-best that you may not have heard of, and others that are just special enough to warrant a mention. As always, we’d encourage you to share some of your favorites in the comments below, or on Facebook. Enlight Pixaloop (Free Pixaloop  is one of my favorite apps on the market. Unlike typical image editors that allow you to remove red eye or apply a filter, Pixaloop allows you to create stunning photo animations with a few clicks on your
Read more