Visual Voicemail Implemented via IMAP
Visual Voicemail on iPhone is …an IMAP email account behind the scenes, with each voicemail message being an email message with an attached audio file
When someone leaves a message, your mobile network sends a silent SMS to iOS; so it knows to download it.
This is how the old Exchange 2003 Activesync protocol used to work... SMS to mobile device, which in turn would fetch emails from server. All different after always-on connections... But very old idea
Many years ago, I was responsible for writing the VVM spec at Apple to distribute to carriers - it was pretty clear that an off-the-shelf solution would allow adoption faster than anything custom and there was no need to reinvent the wheel (and the chase bugs involved therein).
So IIRC we provided the spec, carriers to implement, but there is an industry of 3rd party software for carriers, so I think a lot has to do with whether your carrier’s solutions supplier supported it and agreed to license it.
Also some had their own separate VVM implementations and were resistant to have another one.
Here’s the specification.
The first thing we recognized was the format of the account name (as already seen in network traffic) as well as the password, which is stored in cleartext. Knowing the server IP address, we already reach the critical amount of sensitive information becoming available through sniffing the network traffic. As the IMAP protocol on port 143 is used for communication, we were able to test the retrieved connection data and credentials by using a standard email client. Unsurprisingly it worked out well. The screenshots show how we used thunderbird to read the folder structure of the mailbox itself. Voice calls are basically implemented as emails with an .amr audio file attached.
Previously:
1 Comment RSS · Twitter
Is there any way to easily extract the login information to be plugged into a standard email client? I saw in the last link that the information is stored in /var/mobile/Library/Voicemail/com.apple.voicemail.imap.parameters.plist, but I'm wondering how that could be accessed.
