Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
iMessage Major Problem that Apple can't fix!
- Thread starter xorjo
- Start date
- Sort by reaction score
Honestly, this. Except for the beat down part. See if you can get him to meet "your wife" somewhere, and just keep an eye on the place from afar to see if the dude you sold your phone to shows up.
Glad I read this, though. I'll be extra careful if/when I sell my iPhone 4.
Good find!
So even though you completely wiped the phone, when you inserted your SIM in the phone it added your phone number to the messages "receive at" setting in iOS 5. This makes sense. Then you removed the SIM and iMessage continued to work via WiFi when texting to your phone number. That also makes sense since iMessage is a data only app.
So I am thinking that as soon as this guy with your old iPhone gets a new SIM card and puts it in the phone it will replace the messages phone number setting and he will no longer be able to iMessage using your phone number.
Seems to me that Apple should fix this BUG so that the only way to iMessage a phone number is if the iPhone has a valid matching SIM. Its also interesting that more than one device can iMessage with the same phone number. Makes sense with email addresses (works great with my iPhone and iPad) but not a phone number.
Looks like your only option is to wait for this guy to buy a new SIM, get yourself a new phone number or wait for Apple to fix this bug. I don't think the remote wipe is going to work.
Note to self: Reset all settings before handing old phone to new guy.
So even though you completely wiped the phone, when you inserted your SIM in the phone it added your phone number to the messages "receive at" setting in iOS 5. This makes sense. Then you removed the SIM and iMessage continued to work via WiFi when texting to your phone number. That also makes sense since iMessage is a data only app.
So I am thinking that as soon as this guy with your old iPhone gets a new SIM card and puts it in the phone it will replace the messages phone number setting and he will no longer be able to iMessage using your phone number.
Seems to me that Apple should fix this BUG so that the only way to iMessage a phone number is if the iPhone has a valid matching SIM. Its also interesting that more than one device can iMessage with the same phone number. Makes sense with email addresses (works great with my iPhone and iPad) but not a phone number.
Looks like your only option is to wait for this guy to buy a new SIM, get yourself a new phone number or wait for Apple to fix this bug. I don't think the remote wipe is going to work.
Note to self: Reset all settings before handing old phone to new guy.
Yes same here, just fired up my IP4 (No Sim) send a message to my 4S also via iPad and both phones received the messages.
IP4 (No Sim )
4S (With Sim)
The same phone number is stored in both phones after checking, although settings are greyed out on the non-sim phone.
This could cause BIG problems for peeps who have sold recently IOS5 updated phones
Hope you get your problem sorted.
IP4 (No Sim )
4S (With Sim)
The same phone number is stored in both phones after checking, although settings are greyed out on the non-sim phone.
This could cause BIG problems for peeps who have sold recently IOS5 updated phones
Hope you get your problem sorted.
Yes same here, just fired up my IP4 (No Sim) send a message to my 4S also via iPad and both phones received the messages.
IP4 (No Sim )
4S (With Sim)
The same phone number is stored in both phones after checking, although settings are greyed out on the non-sim phone.
This could cause BIG problems for peeps who have sold recently IOS5 updated phones
Hope you get your problem sorted.
This might be a big problem but I would think most people would activate the old phone with a new SIM thus fixing the problem. This guy is using the OPs old iPhone 4 as an iPod Touch since he has not put in a new SIM. Still a bug however.
Another thing to keep in mind is that your old SIM card still has your number stored even though it's deactivated after the new iPhone activates.
Look, I said it before and I will say it again. You MUST go to the police. Do you not understand that your wife has a stalker? If it is true and this all came about because of your old phone then this person knows more about you than just your old phone number. He knows where you live!
All this crap about 'lure him and beat him up' is not right. Let me repeat, YOUR WIFE HAS A STALKER WHO KNOWS WHERE YOU LIVE. This guy may just be pulling your chain but he may also be a real threat. Stop screwing around and report it. I know you can't prove anything but you must put the police on notice.
Also if this iMessage stuff it true, even after wiping your phone this is a major flaw in iMessage and Apple needs to know exactly what it is and that it is a security risk. To be honest, if it were me I would go to the media. Contact a couple of tech blogs. Anyone who has ever been stalked will tell you the same thing.
All this crap about 'lure him and beat him up' is not right. Let me repeat, YOUR WIFE HAS A STALKER WHO KNOWS WHERE YOU LIVE. This guy may just be pulling your chain but he may also be a real threat. Stop screwing around and report it. I know you can't prove anything but you must put the police on notice.
Also if this iMessage stuff it true, even after wiping your phone this is a major flaw in iMessage and Apple needs to know exactly what it is and that it is a security risk. To be honest, if it were me I would go to the media. Contact a couple of tech blogs. Anyone who has ever been stalked will tell you the same thing.
I dunno if this is related, but keep in mind that caller ID is easily faked. I sure hope Apple isn't relying on caller-id.
There are actually two caller-ID mechanisms. One is the "caller ID" we are all familiar with. Users of Voice over IP services with a PSTN gateway can FAKE any caller ID they want. This is a "feature", not a "bug". It allows companies that use VOIP to set their main switchboard number, or a user's desk number or cell number as the caller-ID. Otherwise, call recipients would just get the phone number of the VOIP service outbound PSTN line.
The "other" caller ID (ANI) is basically impossible to fake. This is what the police department gets when you call 911, and what 800-numbers get when you call them.
Unfortunately, I don't think there's a way for Apple to capture the ANI on your iPhone.
FWIW, there IS a way YOU can use ANI, say if you are receiving harassing calls. (Not sure what if anything you can do about texts.) You need to subscribe to an inbound 800 service, which are cheap any more. Then you forward your phone to your inbound 800 number. The ANI comes along for the ride when the call is forwarded, so you will get the REAL phone number of anyone who calls your number.
I'm thinking there might be some potential for a man-in-the-middle attack in iMessage. iMessage uses open protocols, despite a lot of Apple hand-waving that makes it look proprietary. I think there is at least the possibility to have third-party software send iMessages. (With proper authentication, of course.) Not sure exactly what they do to associate a phone number with an email account, but if it involves logging-in and receiving a phone call within some time window, then if somebody has your password... then that might be a route. (Anybody try sending iMessages using Adium, etc?) Depends on whether Apple uses some secret built-in to the iMessage app as part of authentication to insure that only their app can connect to the IM server.
I think the SIM-related scenarios are more realistic, but thought I'd throw this out there for discussion.
BTW, ATT is essentially worthless when it comes to any kind of abusive calls. They wash their hands of it and tell you there's absolutely nothing they can do. File a police report. Years ago the phone company was helpful in these situations. Now they back away. Not sure if they are constrained by the law, or just don't want to be bothered.
The fact that people don't want to go running to the police and that they've better things to do means that only the most egregious cases are reported and followed-up on any more.
There are actually two caller-ID mechanisms. One is the "caller ID" we are all familiar with. Users of Voice over IP services with a PSTN gateway can FAKE any caller ID they want. This is a "feature", not a "bug". It allows companies that use VOIP to set their main switchboard number, or a user's desk number or cell number as the caller-ID. Otherwise, call recipients would just get the phone number of the VOIP service outbound PSTN line.
The "other" caller ID (ANI) is basically impossible to fake. This is what the police department gets when you call 911, and what 800-numbers get when you call them.
Unfortunately, I don't think there's a way for Apple to capture the ANI on your iPhone.
FWIW, there IS a way YOU can use ANI, say if you are receiving harassing calls. (Not sure what if anything you can do about texts.) You need to subscribe to an inbound 800 service, which are cheap any more. Then you forward your phone to your inbound 800 number. The ANI comes along for the ride when the call is forwarded, so you will get the REAL phone number of anyone who calls your number.
I'm thinking there might be some potential for a man-in-the-middle attack in iMessage. iMessage uses open protocols, despite a lot of Apple hand-waving that makes it look proprietary. I think there is at least the possibility to have third-party software send iMessages. (With proper authentication, of course.) Not sure exactly what they do to associate a phone number with an email account, but if it involves logging-in and receiving a phone call within some time window, then if somebody has your password... then that might be a route. (Anybody try sending iMessages using Adium, etc?) Depends on whether Apple uses some secret built-in to the iMessage app as part of authentication to insure that only their app can connect to the IM server.
I think the SIM-related scenarios are more realistic, but thought I'd throw this out there for discussion.
BTW, ATT is essentially worthless when it comes to any kind of abusive calls. They wash their hands of it and tell you there's absolutely nothing they can do. File a police report. Years ago the phone company was helpful in these situations. Now they back away. Not sure if they are constrained by the law, or just don't want to be bothered.
The fact that people don't want to go running to the police and that they've better things to do means that only the most egregious cases are reported and followed-up on any more.
Hey, exact same thing happening to my sister. I just posted this on MacRumors. Apple said the same thing to us "never heard of this, it's not a breach on Apple's secure network... instructed us to change apple id (email) and password. Assured that this "should" work. This did not work. So, my sister is going to do a complete wipe of her iPhone 4S. Here's the link to my post (just yesterday)! It makes me feel "better" that she isn't the "only" case... By the way where do you live? we live in the Greater Philadelphia / Chester County area. Wondering if it's a local situation?
https://forums.macrumors.com/showthread.php?p=13839930&posted=1#post13839930
Please keep me informed with the status, how you resolved this issue, I'll do the same!
DKDMac69
----------
One more thing. She turned off iMessage on her phone, it's been 24 hrs and no sign of the hacker/rogue texting.
https://forums.macrumors.com/showthread.php?p=13839930&posted=1#post13839930
Please keep me informed with the status, how you resolved this issue, I'll do the same!
DKDMac69
----------
One more thing. She turned off iMessage on her phone, it's been 24 hrs and no sign of the hacker/rogue texting.
Fake!
That thread with written ten minutes earlier than this one? I say this is a total fake! He just registered to post junk
That thread with written ten minutes earlier than this one? I say this is a total fake! He just registered to post junk
This is pretty much how iMessage is supposed to work.
THAT is what you need to check. And, even without iMessage, you really should wipe your phone before selling ti anyway, unless you're totally okay with the buyer having full access to all your personal info.
So how did he pay you? He walked out the door with your phone knowing it worked.
Cashiers check? Cash? Must not of been check or you would have his address
You should go to pipl.com and enter his email address and see what you get. There are many websites who can give you details of an email address.
You want to get this bug resolved for others..... Send this threads link to Cult of Mac, BGR, and a few other media sites claiming a security breach in the iPhone. They will get a hold of it and makeit well known for sure. Those media sites are just hankering for a good story on Apple. Especial a privacy issue? Push the issue and make Appleresolve it for you and others. But especially for your family.
Last edited:
What the OP is saying is true. My hubby gave his 3GS (iOS 5.0.1) to one of our daughters and she could see his and my iMessage conversations. Thank goodness we didn't sell it. I can't imagine the damage since we use it for confidential business related stuffs as well as the personal ones. Immediately made an appointment at the Genius Bar for today to resolve this.
What the OP is saying is true. My hubby gave his 3GS (iOS 5.0.1) to one of our daughters and she could see his and my iMessage conversations. Thank goodness we didn't sell it. I can't imagine the damage since we use it for confidential business related stuffs as well as the personal ones. Immediately made an appointment at the Genius Bar for today to resolve this.
what did they say?
Like many others, I just wanted to add my (somewhat lengthy) two cents with my personal experience.
I was using iOS 5 on my iPhone 4 until I bought a 4S at Best Buy a few days ago. At Best Buy, my SIM card was taken out of my 4 and put into the 4S. In the days I had both devices "activated" with my information, anytime both devices were on WiFi, any and all iMessages came to all devices (iPhone 4, iPhone 4S, and iPad 2). My iPhone 4 had NO SIM card, but had not been wiped or restored, I was still using it with all of my information. I then listed the phone on eBay. The night before the auction ended, I first did an "erase all content and settings" and then a restore as new through iTunes. That evening I only got iMessages on my iPhone 4S and iPad, they weren't coming through on my iPhone 4, even though they were still on the same WiFi network.
However, I am rather OCD and wanted to make sure all of my data was off the iPhone 4 (just as I did with my 3G when I sold it on eBay upon upgrading to the 4). All content and data was gone: camera roll was empty, contacts were blank, messages were empty, email wanted set up, everything. However, when I opened Game Center, my Apple ID was still in the username section. I WAS NOT logged in to game center, and it was asking for my Apple ID password, but my email address associated with my Apple ID was still in the username field. That was the only place I could find any remainder of my information, and I couldn't figure out how to get rid of it.
This is a really crummy situation to be in, and I do feel bad for the OP. As unfortunate as it is, I really think that the lack of a "complete" wipe or restore is the culprit in the situation. I haven't checked iMessage or phone settings to see if my number was still in there, and will do that tonight before I send the 4 out to the new owner. I would also like to add that when I did the "erase all content and data" there was no SIM card installed in the phone, and when I did the "set up as new iPhone" in iTunes, I had inserted the dummy, blank SIM card that came packaged with my 4S (since mine was just moved from the 4 to the 4s). So, it was restored and set up as new with blank information, nothing relating or attached to my phone number. Not sure if this has any influence on the information or not.
I was using iOS 5 on my iPhone 4 until I bought a 4S at Best Buy a few days ago. At Best Buy, my SIM card was taken out of my 4 and put into the 4S. In the days I had both devices "activated" with my information, anytime both devices were on WiFi, any and all iMessages came to all devices (iPhone 4, iPhone 4S, and iPad 2). My iPhone 4 had NO SIM card, but had not been wiped or restored, I was still using it with all of my information. I then listed the phone on eBay. The night before the auction ended, I first did an "erase all content and settings" and then a restore as new through iTunes. That evening I only got iMessages on my iPhone 4S and iPad, they weren't coming through on my iPhone 4, even though they were still on the same WiFi network.
However, I am rather OCD and wanted to make sure all of my data was off the iPhone 4 (just as I did with my 3G when I sold it on eBay upon upgrading to the 4). All content and data was gone: camera roll was empty, contacts were blank, messages were empty, email wanted set up, everything. However, when I opened Game Center, my Apple ID was still in the username section. I WAS NOT logged in to game center, and it was asking for my Apple ID password, but my email address associated with my Apple ID was still in the username field. That was the only place I could find any remainder of my information, and I couldn't figure out how to get rid of it.
This is a really crummy situation to be in, and I do feel bad for the OP. As unfortunate as it is, I really think that the lack of a "complete" wipe or restore is the culprit in the situation. I haven't checked iMessage or phone settings to see if my number was still in there, and will do that tonight before I send the 4 out to the new owner. I would also like to add that when I did the "erase all content and data" there was no SIM card installed in the phone, and when I did the "set up as new iPhone" in iTunes, I had inserted the dummy, blank SIM card that came packaged with my 4S (since mine was just moved from the 4 to the 4s). So, it was restored and set up as new with blank information, nothing relating or attached to my phone number. Not sure if this has any influence on the information or not.
Fair enough - and your AppleID might have come from the iTunes "restore as new" step. Perhaps if you'd just erased all content and settings, and left it there, no trace of your AppleID would be on the phone.
But what if the iPhone was stolen instead of sold? How does a user protect their privacy and deactivate iMessages then? I hate to say it, but it seems like someone at Apple maybe didn't think this through. There should be a control panel on iCloud somewhere that allows users to deauthorize iMessage on devices no longer in their posession.
The idea that a thief can steal your phone, and even after a remote wipe and deactivated SIM, still possibly access your iMessages and send iMessages while impersonating you, is a bit disturbing to put it mildly.