3 ms·
Does this mean it’s trivial to spoof iMessage from arbitrary phone numbers not already registered with iMessage, or hijack any non-iPhone users SMS messages by
by skygazer 3y ago
Does this mean it’s trivial to spoof iMessage from arbitrary phone numbers not already registered with iMessage, or hijack any non-iPhone users SMS messages by tricking the iPhones they communicate with to send replies via iMessage to the spoofer rather than SMS? If this is true, (edit: probably not true,) and I’m just speculating without specific knowledge, it seems Apple would shut this down for legitimate security reasons, and perhaps re-engineer things to prevent this.
- brenns10 3y agoI just tried out the app - an SMS challenge was sent to my phone number, and the app sends a response via SMS. By challenge, I mean there's several fields with encoded data (not just a 6-digit OTP). I have no idea how it's implemented by Apple but I'd hope there's some sort of expiry time. I'm sure they've thought of SIM-swapping as a way to take over people's accounts.
- skygazer 3y agoDoes that challenge seem to come from Apple or Beeper? I hope Apple. That would largely allay my concern. I guess I should have given Apple more credit, because this “vulnerability” would likely have come to light much earlier otherwise, as they’ve always needed reliable means to establish ownership of a number — it’s just been automatic and invisible on the iPhone.