App security flaw makes your iPhone call without asking

jmke · 25th August 2014, 16:35

If you're an iPhone user, you may want to be cautious about opening messages that contain phone numbers in the near future; they may cost you a lot of money. Developer Andrei Neculaesei notes that maliciously coded links in some apps will abuse the "tel" web handler (which covers dialing) to automatically make a phone call the moment you view a message. Potentially, an evildoer could force you to call an expensive toll number before you've had a chance to hang up. The exploit isn't limited to any one app or developer, either. Facebook Messenger, Gmail and Google+ all fall prey to the attack, and it's likely that other, less recognizable apps exhibit similar behavior. Apple's Safari browser will ask you before starting a call, but FaceTime's behavior lets you pull a similar (though not directly related) stunt.

http://www.engadget.com/2014/08/24/a...=rss_truncated

25th August 2014, 16:35	#1
jmke Madshrimp Join Date: May 2002 Location: 7090/Belgium Posts: 79,010	App security flaw makes your iPhone call without asking If you're an iPhone user, you may want to be cautious about opening messages that contain phone numbers in the near future; they may cost you a lot of money. Developer Andrei Neculaesei notes that maliciously coded links in some apps will abuse the "tel" web handler (which covers dialing) to automatically make a phone call the moment you view a message. Potentially, an evildoer could force you to call an expensive toll number before you've had a chance to hang up. The exploit isn't limited to any one app or developer, either. Facebook Messenger, Gmail and Google+ all fall prey to the attack, and it's likely that other, less recognizable apps exhibit similar behavior. Apple's Safari browser will ask you before starting a call, but FaceTime's behavior lets you pull a similar (though not directly related) stunt. http://www.engadget.com/2014/08/24/a...=rss_truncated __________________

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
App security flaw makes your iPhone call without asking	Stefan Mileschin	WebNews	0	25th August 2014 12:26
College Student Finds Another eBay Security Flaw	Stefan Mileschin	WebNews	0	2nd June 2014 09:54
Facebook grants $33,500 to security researcher who discovers fatal security flaw	Stefan Mileschin	WebNews	0	27th January 2014 10:16
Google Plugs 'Master Key' Security Flaw	Stefan Mileschin	WebNews	0	11th July 2013 09:56
Student kicked out for exposing huge security flaw	Stefan Mileschin	WebNews	0	22nd January 2013 07:57
Facebook security flaw allows account access without passwords	Stefan Mileschin	WebNews	0	5th November 2012 07:48
HP Sued Over Security Flaw in Printers	Stefan Mileschin	WebNews	0	12th December 2011 09:06
Apple Kicks Developer That Found iOS Security Flaw	Stefan Mileschin	WebNews	0	8th November 2011 08:21
Xbox 360 flaw makes machine hackable	jmke	WebNews	0	16th March 2006 09:35
Windows XP Security flaw	jASjE	Hardware/Software Problems, Bugs	5	11th September 2002 20:51