Bad RCS implementations are creating big vulnerabilities, security researchers claim

guest · Nov 29, 2019

Bad RCS implementations are creating big vulnerabilities, security researchers claim
Carriers are creating problems for users
November 29, 2019
https://www.theverge.com/2019/11/29...ig-vulnerabilities-security-researchers-claim

Security researchers at SRLabs have found a number of vulnerabilities with the way carriers around the world are implementing RCS, the new messaging standard designed to replace SMS, Motherboard reports. In some cases, these issues could compromise a user’s location data, they could allow their text messages or calls to be intercepted, or they might allow their phone number to be spoofed.

One issue identified on an unnamed carrier’s implementation could allow any app on your phone to download your RCS configuration file, for example, giving the app your username and password and allowing it to access all your voice calls and text messages. [...] These problems were found after researchers analyzed a sample of SIM cards from several different carriers.

SRLabs didn’t share which security holes were found with which carriers, but noted that the standard is being implemented by at least 100 carriers around the world, including the four US majors. “We find that is actually a step backwards for a lot of networks [compared to SMS],” Karsten Nohl from SRLabs told Motherboard. “All of these mistakes from the 90s are being reinvented, reintroduced.”
Click to expand...

Motherboard: SMS Replacement is Exposing Users to Text, Call Interception Thanks to Sloppy Telecos

Claire Cranton, a spokesperson for the GSMA, wrote in an email, "[...] The findings highlight issues with some RCS implementations but not every deployment, or the RCS specifications themselves, are impacted."
Cranton said the researchers will present their findings to an expert group at GSMA next week, and that an initial analysis of the research shows there are countermeasures to the uncovered issues.
Click to expand...

Log in or Sign up

Bad RCS implementations are creating big vulnerabilities, security researchers claim

guest Guest

Log in or Sign up

Bad RCS implementations are creating big vulnerabilities, security researchers claim

guest Guest

Useful Searches