[Swordmaker]

Note, this vulnerability and exploit works on all MSM on all phones on GSM systems (AT&T and T-Mobile in the US). The presenters of the exploit stated they used the iPhone only because it made a sexier more presentation. Here are both an iPhone and a Sony Ericsson being exploited.

[Richard Kimball]

Okay, finished reading through the article. I'm not particularly concerned, but will, as usual, not turn off the brain to the possibility of exploits.

Here's the steak on the iPhone with the sizzle removed.

The text message program can spoof the phone number being called from, to make it appear that the text message comes from someone else. You still have to click on a link and go to the web site and agree to install the software. With the exception of the number spoof, there's not much there. Also, if I'm reading correctly, the spoof takes place on the server side at the phone company, NOT inside the phone itself. Now, all that being said, it seems to a dweeb like me that it's probably not that tough to hack a cell phone in your possession to send out a fake phone number. I can get my cell phones to function as different numbers by changing the Sim cards.

On the prompting to install programs, in the original article it says "(in this case, a iPhone Sony (NYSE: SNE) Ericcson phone user)" the iPhone is struck through, indicating that the phone that was spoofed to install a program was the Sony. There is no other mention of the iPhone being spoofed to install updates. As the iPhone updates are usually through the iTunes store, and are run through specific Apple programs, I suspect the iPhone was not hacked in this way.

If I'm reading the article wrong, please correct me. For iPhone users (myself, which is why I'm most interested in the iPhone) the only "fix" that seems necessary is not to follow links from text messages.