A ping of death for the iPhone

Thursday

Jul232009

Thursday, July 23, 2009 at 5:16PM

The release of the 3rd generation of the iPhone was the reason for me to rush to the TMobile store to get the 32G version. I had to wait for about one week first, but finaly got one, and I love it! But there is one thing that worries me a bit. I was able to remotely drain the battery in 30-45 minutes, just by pinging the public IP address, assigned by TMobile, to the GPRS/3G interface of the phone. Is your battery draining for no reason? Is your iPhone running hot when in standby modus? Then read on...

I was curious to see what IP address I was using during 3G networking. It turns out that on the Dutch TMobile network you are assigned a random IP within a block of TMobile mobile internet users. You can check this out by going to a site like whatsmyip.org, or installing the iStat app, which also shows you the 'cell IP' of the iPhone. To see if my iPhone was pingable, I issued the ping command on the OSX terminal on my MacBook, to which it responded. I was also be able use an app like Datacase, to share documents over the internet via FTP and HTTP from my iPhone. An Nmap to the device even reported that port 21 was open. Wtf? In other words, there is nothing between your device and the evil outside world when you switch on your iPhone, at least on the TMobile network in the Netherlands. Scary stuff.

When I was done experimenting, I noticed after 30 minutes that my fully charged iPhone ran a little hot and the battery suddenly was as good as empty, even though I had put it to rest by pressing the top button. It turned out that the ping I did half an hour before on my MacBook was still running and had kept the 3G module alive, sucking the energy from my phone. Crap!

I tried the same thing with a Nokia E71 on the same network, but this trick did not work. The E71 switches the 3G networking on when needed, for instance when the browser starts. Close the browser, and the device goes offline. I haven't tried other phones yet, but I'm curious to see how an Android reacts...

So, how could an attacker do harm to you and me remotely? Well, I used a nice tool called xprobe to do a remote ICMP fingerprint of the OS. One run of the tool against my public iPhone IP showed that the device was probably "Apple Mac OS X 10.3.x". Apparently, the iPhone responded with OSX characteristics. Easy catch! Someone can just scan the IP block with xprobe, and ping all iPhones he finds to death. Another, more targeted approach would be to lure you to his webserver, tailing and grepping his logs to see if any iPhones come along and then ping the device to death. He could also send you an email, containing a remote image to do this. Remote image loading is switched ON by default on the iPhone Mail app, so this method would be easier. Why would someone do this? For fun? An iPhone hater? Or just because?

Other networks in the Netherlands that offer GPRS/3G do not seem to be vulnerable to this problem because of the use of NAT or blocking inbound traffic. I hope that TMobile will do the same soon. Please share your experiences on other networks here.

Shizzle

72 Comments |

Permalink | |

Print Article |

Email Article

View Printer Friendly Version

Email Article to Friend

References (7)

References allow you to track sources for this article, as well as articles that were written in response to this article.

Response: Hitachi Service Manual

at Hitachi Service Manual on August 9, 2009

HP finally came out with the official information on the heavy duty blade for use in VMware environments. This blade for the c- Chassis is the BL495c which has 16 slots for Memory DIMMs and two AMD Opteron processors. Its the official Virtualization Blade.
Response: ביטוח רכב מקיף השוואת מחירים

at השוואת ביטוח רכב on May 26, 2010

... השוואת מחירים ביטוח רכב - בשנים האחרונות למרות שחלפו למעלה מ -25 שנה מאז חקיקתו של חוק ביטוח רכב מקיף השוואת מחירים, לנפגעי ביטוח רכב מקיף השוואת מחירים. ההשתתפות העצמית הינה לגרום לבעל הפוליסה שימוש עסק... A ping of death for the iPhone - Dutchtechies blog - dutchtechies ...
Response: The Lost Arts Of War

at The Lost Arts Of War on August 9, 2010

...an interestin post over at . . .
Response: billig parajumpers salg

at Parajumpers Simona PJS E87Parajumpers Angie on November 6, 2014

Soprano top quality, extra-durable products are used po Parajumpers Simona pular production, with styles incorporating awfully technological elements f Parajumpers Angie ashioned with a Parajumpers needs popular mind; discrete pockets,Parajumpers Simona, parachute the collar and throat f parajumpers jakke a
Response: cheap air max

at cheap air max on September 30, 2018

A ping of death for the
Response: heap nike shoes

at cheap air max shoes on October 10, 2018

A ping of death for the
Response: heap nike shoes

at cheap air max 90 on October 11, 2018

A ping of death for the

Reader Comments (72)

Can you tell me the IP address range of t-mobile netherlands?

August 18, 2009 |

dude

TMobile NL uses several IP blocks. At this moment, my iPhone ip is in the block 188.88.0.0 - 188.89.255.255 . I've seen 2 other blocks thus far, but do not remember them. I'll take a look, from time to time and post them here.

August 18, 2009 |

Shizzle

Some IP's I've found:

#Vodafone
62.140.128.0/17
62.140.137.0/24
#T-mobile
91.0.0.0/8
94.0.0.0/8
89.0.0.0/8
84.241.0.0/16
#KPN
#77.63.226.0/17

August 18, 2009 |

Captain Rtfb

Today I'm somewhere in between 95.99.0.0 - 95.99.255.255. Haven't seen that one before. TMobile must have a sh*tload of IP's!

August 19, 2009 |

Shizzle

Heh... Surprised you gave out your IP address after describing a working attack method...

February 2, 2010 |

Bedazzled

really good point. i do this subconciously with my nephew alot. i'll say stuff like: "wow, you are studying bar graphs in math!? it took me a week to figure them out but they are fun!" and i think it boosts his confidence to know that even his Aunt finds some things hard and that he doesn't have to feel bad when he struggles. i'm so glad if you click in my blog!my websiteA.Lange & Sohne replica watches

August 13, 2010 |

Tonino Lamborghini replica watches

this is a good article.I will keep it and share it whit my friends .I think thay will like it .Richard Mille named his newest uncover of RM011, Felipe Massa TitaniuBreitling replica watches
m Black DLC Grand Prix Brazil.

August 18, 2010 |

replica daytona watches

Replica Louboutin Shoes
Cheap Christian Louboutin Shoes
Christian Louboutin
Yves Saint Laurent
YSL
Manolo Blahnik
Jimmy Choo
Designer Shoes
China knockoff Louboutin Shoes
Replica handbags
louis vuitton bags
fake gucci handbags
lv bags
chanel purses
louis vuitton wallets free shipping
louis vuitton knockoffs accept Paypal
Cheap moncler
Moncler jackets
moncler
mens moncler
Moncler coat
Moncler clothing
Moncler down jackets
Moncler sale

September 27, 2010 |

replica handbags

October 21, 2010 |

chriatian louboutin

Moncler Jackets
Moncler
Moncler Coats
Moncler Vests
Moncler Boots
Moncler Bags
Polo Ralph Lauren
Ralph Lauren Polo Shirts
Discount Polo Ralph Lauren
Cheap Ralph Lauren Polo Shirts
Ray Ban
Ray Ban Sunglasses
Ray Ban Aviators
Ray Ban Wayfarer
True Religion
True Religion Jeans
Cheap True Religion Jeans
Discount True Religion Jeans

November 4, 2010 |

kevinroy

Your article is very good , i m like it ,thank you . there also other info
hermes bags
hermes birkin
hermes
hermes handbags

rosetta stone
rosetta stone software
rosetta stone language

rosetta stone language
rosetta stone portuguese

Hermes Birkin 30cm

6088 handbags light blue gold lock

Hermes Birkin 30cm 6088

handbags black gold lock

Hermes Birkin Faux Crocodile 30

hermes birkin 35

November 7, 2010 |

sale hermes

Nike Shox
Nike Air Max
Air Max 90
Nike Air Max 90
Nike Shox Rivalry

nike air max
nike air max 90
nike shox

rolex watch
IWC Watches
Rado Watches
rolex watches
Omega Watches
Cartier Watches

Louis Vuitton Handbags
Prada Handbags
Chanel Handbags
Balenciaga Handbags
Gucci Handbags

ED Hardy
ED Hardy Clothing

November 12, 2010 |

Nike Air Max

JPEG to PDF Converter

November 16, 2010 |

anna

Although to some it may feel oh-so-far-off, spring is on it's way, and here are the louis vuitton to prove it!
New Christian Louboutin spring shoes are hitting the shelves and they are colorful, whimsical and playful,perfect for a spring or summer wedding looking for a little jolt of fun! and now discount for Gucci,Which are your faves?

louis vuitton
lv
louis vuitton wallets
louis vuitton purses
louis vuitton sunglasses
louis vuitton bags
louis vuitton handbags
lv
louis vuitton bags
louis vuitton outlet

louis vuitton
lv
louis vuitton wallets
louis vuitton purses
louis vuitton sunglasses
louis vuitton bags
louis vuitton handbags
lv
louis vuitton bags

louis vuitton
lv
louis vuitton wallets
louis vuitton purses
louis vuitton sunglasses
louis vuitton shoes
louis vuitton bags
louis vuitton handbags
lv
louis vuitton bags

November 19, 2010 |

louis vuitton outlet

Nike Air Max
nike dunks
Nike Air Max 93
Nike Air Max 95
vibram five fingers shoes
Vibram Five Fingers Speed
Nike Dunks Low
Nike Dunks High

November 27, 2010 |

cheap ugg boots

There are different rembrandt paintings forms of abstract art and they can all look beautiful in renoir paintings your home. The
art can be either representational abstract oil paintings where there seems to be matisse paintings some forms that can be recognized in the painting, goya paintings or it can be non-representational where there are no obvious modern oil paintings forms visible. You can take a oil painting from photo look at abstract art and see whatever wholesale oil painting you want. If you want to oil paintings wholesale hang it in a contemporary living room it can work there flower oil painting because as an abstract form it can still life oil paintings take on a contemporary look. seascape oil paintings Hanging it in a kitchen can make it look like a very van gogh oil paintings domestic painting and oil painting supplies appropriate for the floral oil paintings surroundings.
iphone cases
iphone covers
iphone 3gs cases
iphone 3g cases
iphone 4 cases
white iphone 4
iphone 4 white
white iphone
white iphone 4 available

November 27, 2010 |

artrepro

cheap uggs
discount ugg boots
ugg boots uk
buy ugg boots
ugg boots on sale
ugg boots
wholesale ugg boots
cheap ugg boots
discount ugg boots
ugg boots for kids
Gucci Boots
moncler
moncler jackets

moncler uk
moncler down jacket
moncler down jacket
moncler coats
moncler clothing
moncler ski jackets
moncler vest
moncler shop
moncler online
moncler jacket
moncler jackets for men
moncler women
moncler coat
moncler shirts
moncler store
moncler mens
moncler jackets on sale
moncler jackets for women
moncler discount
moncler vest men
mens moncler jackets
moncler on sale
mens moncler
moncler shoes
moncler jackets women
moncler down coat
moncler men jackets
moncler wholesale
kids moncler
men moncler jackets
womens moncler
moncler down vest
wholesale moncler
moncler hoody
jackets moncler
uk moncler
new moncler
women moncler
moncler black
ugg boots
uggs boots
ugg boots on sale
uggs on sale
cheap uggs
discount uggs
discount uggs boots
wholesale uggs
wholesale ugg boots
ugg classic short boots
cheap ugg boots
kids ugg boots
ugg bailey button
ugg classic tall boots
ugg mini boots
cardy ugg boots
ugg slippers
ugg ultra short
UGG Payton
UGG Adirondack II
ugg ultimate boots
ugg ultra tall
UGG Roxy Tall
UGG Nightfall boots
UGG Sundance boots
ugg adirondack boots
ugg broome
UGG Seline
UGG Elsey
UGG Corinth
UGG Highkoo
UGG Knightsbridge
Ugg Stripe Cable
Ugg Argyle Boots
new ugg boots
UGG Delaine
UGG Langley
UGG Liberty
Ugg Bailey Button Triplet
ugg shop
ugg boots
wholesale ugg boots
cheap ugg boots
discount ugg boots
ugg boots for kids
Gucci Boots
ugg boots
wholesale ugg boots
cheap ugg boots
discount ugg boots
ugg boots for kids
Gucci Boots
ugg boots
cheap ugg boots
discount ugg boots
wholesale ugg boots
ugg classic boots
ugg bailey button
ugg cardy boots
kids ugg boots
ugg slipper
ugg 1886
ugg 5163
ultra short ugg boots
ultra tall ugg boots
ugg 5273
ugg 5359
classic tall ugg boots
classic short ugg boots
paisley short ugg boots
mini ugg boots
ugg 5899
ugg 5803
ugg 5819
argyle knit ugg boots
kids bailey button ugg
ugg 5304
ugg 5616
ugg 5822
Adirondacks II UGG Boots
Highkoo UGG Boots
Tan Payton UGG Boots
Knightsbridge UGG Boots

ugg boots
wholesale ugg boots
cheap ugg boots
discount ugg boots
ugg boots for kids
Gucci Boots
cheap ugg boots
cheap ugg boots uk
kids ugg boots
chestnut ugg boots
cardy ugg boots
black ugg boots
discount ugg boots
classic tall ugg boots
ugg classic short boots
ugg style boots
bailey button ugg boots
womens ugg boots
ugg slippers

pink uggs
chestnut uggs
short uggs
knitted ugg boots
sundance ugg boots
mini ugg boots
nightfall ugg boots
ugg sandals
black uggs
ugg knightsbridge
knitted uggs
ugg ultra tall
ugg ultra boots
nightfall uggs
wholesale ugg boots
ugg ultimate
ugg sundance

UGG Bailey Button Boots
UGG Classic Tall Metallic
UGG Classic Tall Boots
UGG Tall Boots
UGG 5817 Boots
UGG Roxy Tall Boots
UGG Classic Cardy Boots
UGG Stripe Cable Knit Boots
UGG Classic Short Boots
UGG Classic Short Paisley
UGG Classic Short Metallic
UGG Classic Tall Paisley
UGG Classic Mini Boots
UGG Classic Argyle Knit Boots
UGG Bailey Button Triplet Boots
UGG Evera Shoes
UGG Kids Boots

GHD Hair Straightener
instyler rotating hot iron
Gucci Boots for women
Gucci Boots for men
UGG Ultra Short LE
UGG Women's Upside Boots
ugg women boots
UGG Ultra Short Boots
UGG Suede Boots
UGG Ultra Tall Boots
UGG Style Women Boots
UGG Classic Sundance II Boots
UGG Nightfall Boots
UGG Sundance LE
UGG Classic Tall Romantic Flower
cheap nfl jerseys
cheap NHL Jerseys

December 7, 2010 |

cheap ugg boots

Myefox worked with the second string all preseason and is listed accordingly on the team’s depth chart.
RC Hubschrauber
Windows Mobile
airphones

December 21, 2010 |

Windows Mobile

investigation ugg boots States Embassy in Italy. ugg boots Italian Prime Minister cheap laptop battery Silvio Berlusconi is holding its annual press conference time of the incident, wholesale Compaq Laptop Battery he said that Interior Minister

December 24, 2010 |

wholesale laptop battery

The Beats by Dr. Dre have a chunky, padded, shiny black headband that slopes down and expands almost seamlessly into circular earcup supports. The large, oblong earcups are extremely comfortable and can swivel gently, back and forth and from side to side. Thin accents of silver and red wrap round each earpiece?aa subtle, handsome touch.

December 24, 2010 |

white iphone 4

Post a New Comment

Enter your information below to add a new comment.

My response is on my own website »

Author:

Author Email (optional):

Author URL (optional):

Post:

↓ | ↑

Some HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>