Breaking Barriers and Boundaries: Free, Global, and Stealthy SMS Communication via Satellite on iPhones

Satellites enable communication when other wireless services are unavailable. Apple has integrated satellite communication to their newest iPhones, enabling emergency communication, roadside assistance, and location sharing with friends. We successfully reverse-engineer the satellite communication protocol and analyze its security and privacy properties. Despite various safeguards Apple put into place, we demonstrate the possibility of using satellite communication in iPhones to send SMS for free from anywhere in the world.

Communication over satellites poses restrictions on bandwidth and delay, making it challenging to use modern communication protocols with their security and privacy guarantees on iPhones. For their new satellite communication feature, Apple designed and implemented a proprietary protocol to address these limitations. We are the first to reverse engineer its protocol internals, including highly optimized formats and compression to save on every possible bit transmitted over satellite. Further, we create a simulation-based testbed, enabling a safe environment to try out roadside assistance and emergency texting without alarming first responders in the real world.

In this talk, you will gain deep insights into Apple’s satellite communication ecosystem, and learn about its security and privacy design goals. We will then show how to bypass various restrictions within that ecosystem. Our attacks allow bypassing regional restrictions, allowing satellite communication worldwide, including features that are not available in certain countries. Moreover, the ecosystem’s modularity allows usage beyond the designed use cases – we will demonstrate a method to send custom SMS-sized text messages over satellite, transforming the iPhone into a worldwide, satellite messenger. We also analyze the actual satellite signal and demonstrate insights on how satellite messages are encoded.