Got a tip for us? Share it...

iMessage Bug Sends Texts to Stolen iPhones

It appears that a bug in iMessage allows texts to be sent to a stolen iPhone, even after a remote wipe and disabling the SIM card, reports Ars Technica.

iMessage, introduced in iOS 5, is similar to RIM's BlackBerry messaging service. It sends text, picture, and video messages over Apple's servers instead of via the carrier's SMS service. This can lower the user's text messaging charges and adds features like delivery confirmation. It also allows users of non-cellular devices, like the iPad and iPod Touch, to send and receive text and picture messages -- as featured in a recent iPod Touch television ad.

According to Ars Technica:
Our attention was drawn to this story by Ars reader David Hovis, whose house was recently burglarized and his wife's iPhone 4S was stolen. According to Hovis, his wife deactivated her iPhone with her carrier, remote wiped it, and immediately changed her Apple ID password—"we picked up a new iPhone the next day, figuring that our insurance would end up paying for it," Hovis told Ars.

For most users, this would be the end of the story. The phone number had been transferred to a new device and the old one had been deactivated; what more is there to say? A lot, apparently, and in the form of iMessages. The thief who stole Mrs. Hovis' iPhone had sold the device to an unsuspecting buyer elsewhere in the state, and the buyer had begun sending and receiving iMessages from the phone as Mrs. Hovis—even though the stolen phone had apparently now been activated under a new number.
Hovis sent messages to new "owner" of his wife's old phone, with the messages going to both the old and new phone, but the other person was uncooperative. He discovered a thread on the MacRumors forums with several readers reporting the same issues.

Apple has not commented on the matter, but it's possible that the iMessage servers permanently links the UDID number of a particular handset to a phone number, so it knows what handset to deliver iMessages to. When the phone is remotely wiped, and a new SIM card installed, the iMessage servers don't update and messages continue to be sent to the stolen phone.

Top Rated Comments

(View all)

Posted: 19 months ago
What the hell is 'burglarized'? Its burgled!!
Rating: 11 Positives
Posted: 19 months ago
It's a feature to be able to tell the thief pleasantries from time to time.
Rating: 9 Positives
Posted: 19 months ago

I'd expect it to be a more common word when it comes to statistics...the US has a much, much higher population than the UK ;) For us, it really does sound almost made up, the equivalent of say... Robberized (assuming thats not an actual word) instead of robbed.

Its interesting how languages & cultures work out :)


To a American or Canadian ear, "burgled" sounds like something made-up through a bit of whimsical word-play.

The key difference with your example is that "robber", the noun, is derived from "rob", the verb. (Yes, it's an historical thing.)

With "burglar", the noun came first -- it's not derived from "burgle"; rather, "burgle" is a back-formation (http://en.wikipedia.org/wiki/Back-formation) based upon it.

But back-formations are much more the exception than the norm when it comes to deriving verbs from English nouns. The more customary way to derive a verb is to add -ize (or -ise) to the end. Thus, "burglarize".

What's interesting is how, when American and British English really started to diverge, "burglar" was a part of the lexicon but a verb form of the word was not. The route each took in doing so is perfectly legitimate -- neither inherently more "right" than the other -- but a century later, the alternate word from the other side of the pond seems silly, for both sides.

Of course, one can question the necessity of any verb form, given lots of alternate words like rob, stole, broke into, etc. Off the top of my head, I'd say burglarize / burgle are more specific in their connotation, used normally in the passive voice, to refer to the specific act of person(s) entering a building (typically a domicile), in secret and without permission, and stealing items from within.

Ex:
"I was robbed" versus "I was burglarized". In the absence of any other context, the latter paints more detailed picture -- we can safely assume several more details about how and where the theft occurred from "burglarized" than we could from "robbed".
Rating: 6 Positives
Posted: 19 months ago

What the hell is 'burglarized'? Its burgled!!


It must be an American thing. I was just about to write the same thing ;)
Rating: 6 Positives
Posted: 19 months ago

What the hell is 'burglarized'? Its burgled!!


I'm assuming its a made up word from the US ;)

(No offence...we've got some stupid words too!)
Rating: 6 Positives
Posted: 19 months ago

It sends text, picture, and video messages over Apple's servers instead of via the carrier's SMS service.


Very often it fails to send pictures.. and I end up having to wait a while or e-mail them
Rating: 5 Positives
Posted: 19 months ago

If verified that this is a bug then it is something that needs to be fixed. But on the other hand it could be something that could come in handy. Think about it....your iphone is lost or stolen and someone wipes it or replaces the SIM so they can use it. But you are still able to send an iMessage to it. How cool would that actually be if that could actually lead to the phone being returned to you.


The new owner gets to see every iMessage I send/receive. That may result in an occaional returned phone, but the rest of the time it is a huge privacy risk. It could go on forever. Every single iMessage you send/receive will be visible to the thief.
I have been following this issue for a while, and there have been lots of threads about this happening. In some cases users were getting sexually explicit messages from random people.
Apple needs to resolve this problem.
Rating: 3 Positives
Posted: 19 months ago
I guess it makes sense to assume that any person could be identified by N number of UDIDs on the server side of iMessage. (My iPhone, my iPad, my iPod Touch, etc -- that's three right there!)

But for this to be a permanent linkage is clearly a design flaw/oversight. The remote wipe should have nuked the UDID from iMessage's server-side database (or where ever the hell it's stored).
Rating: 3 Positives
Posted: 19 months ago

I'm assuming its a made up word from the US ;)

(No offence...we've got some stupid words too!)


"Burglarize" is what most people say in the US. I've never heard anyone here say "burgle" before, I've only seen it in British publications.

(interesting info on the word: http://english.stackexchange.com/questions/17655/which-is-more-correct-burgled-or-burglarized#answer-20859 (http://english.stackexchange.com/questions/17655/which-is-more-correct-burgled-or-burglarized#answer-20859))
Rating: 3 Positives
Posted: 19 months ago

That can't be true.. I have done this with a few different phones. Replaced the sim card with another and sent a message, it was delivered with that number. Using iMessage. It could be, maybe that it gets remote wiped. Did they try a Restore...???


Restore what? They don't have the iphone, it's stolen remember? This is a fact and I was a victim of this back in October. Unless the person with the stolen iphone puts a new sim card on the phone and uses it or he restores it, there's nothing you can do unless you change your phone number. Simple as that.
Rating: 3 Positives

[ Read All Comments ]