MMS vulnerability allows Sender to be spoofed

September 14, 2009 | By Surur

Michael Mueller a.k.a. c0rnholio has discovered a wide spread vulnerability in mobile phone MMS software, including Windows Mobile versions, where the software will trust the meta data of a MMS message to generate the From Address, instead of the actual number of the sender.

This vulnerability does not affect all networks, only ones where the MMS notification is sent directly from one phone to another.

On these networks this problem can be particularly dangerous however, as a MMS network can claim to be from a trusted sender such as your carrier and ask you to download software which can compromise your phone.

The vulnerability affects Windows Mobile, RIM , Sony Ericsson and likely other platforms also.

Read the full disclosure at SilentServices.de here.

4

About Surur

Site Admin and Windows Phone enthusiast, he has been using Windows Mobile devices since before they were called PocketPC’s. He is currently sporting a HTC 7 Trophy.

Tagged security, software, vulnerability

http://twitter.com/rohansingh @rohansingh

Really? This is a vulnerability now? This is exactly how email works as well.
smotrs

Well, Sprint phones should be safe, they don't have a real MMS network.
Thommas

Who cares ? MMS is useless and overpriced !!!
http://www.avianwaves.com Parrotlover77

It's a vulnerability because carriers can (and do) use SMS and MMS to deliver updates to phones. In addition, people are fairly savvy enough now to know that an email containing a .dll from even a known source is cause for concern. In further addition, virus scanners on desktops will catch that stuff easily. In even further addition, every modern mail client will not allow executables to be run from attachments. In even more further addition, email trust can still be verified via SPF or an examination of the headers (or both), this is not possible via MMS.

Scan QR Codes, UPC, EAN, Code 39/128 or ITF barcodes on your Windows Phone 7 to find best prices online.

Enjoy slots? Blackjack? Video Poker? Play Crazy Casino FREE!

#1 FREE Solitaire on WP7

If your a fan of Pong then you will love this game. Heavenly Skies. Save the universe! Are you ready?

A rewarding mix of match 3 and tetris gameplay

Free, Live Tile support for Word Of The Day and so much more. Why NOT try it out?

Set up reminders with only two taps. Supports also text reminders and voice reminders.

Download the best puzzle game in WP7 Marketplace for FREE!

Are you a good Alchemist ? Use your brain to discover Atomic Energy, Chuck Norris, Angry Birds and 1400 more !

Fun puzzle game with over 150 levels!

Fully featured, beautifully designed WP7 YouTube app.

u.n.i MEGA PACK (FREE), the ultimate addictive top GAMES bundle for Windows Phone 7! 7+ and growing!

Highly addictive word game designed for adrenaline junkies. Practice locally, but then are you fast enough to compete online?

The smartest Google reader app.

Air Soccer Fever - Realtime Online Multiplayer casual soccer game for FREE

Beat the Story Mode. When your done Bring your skill online. Rank up by winning online matches. Have 1 on 1's with anyone! Global Online Multiplayer!

Newest devices leaks, online charts and ultimate performance benchmark for every Windows Phone.

Every day, get great app deals from Windows Phone developers pushed to you!

Quick Tiles, a fully featured live tile editor for Windows Phone.

Great sports app for NFL, NBA, MLB, NHL. Pin scores/games to live tile on your home screen.

MobileFax gives you the opportunity to send fax pages from your mobile phone anytime, anywhere !

WP7 Exclusive version of Hanging with Friends

Fabulously fun, lovable, crazy! Bubble Pong Championship

A remake of the classic snake game. The snake wants to grow so don't wait and help her!

Promote your app on WMPoweruser.com