Apple device security flaws revealed by German government watchdog
iPhone, iPad and iPod Touch have 'critical weaknesses' that could be exploited by criminals, federal agency warns
Charles Arthur and agencies
guardian.co.uk, Wednesday 6 July 2011 23.09 BST
The software running Apple's iPhones, iPads and the iPod Touch has "critical weaknesses" that could be used by criminals to gain access to confidential data on the devices, Germany's IT security agency has warned.
Clicking on an infected PDF file "is sufficient to infect the mobile device with malware without the user's knowledge" on several versions of Apple's iOS operating system, the Bundesamt für Sicherheit in der Informationstechnik (federal office for information security) said.
The problem may occur on iPhone 3GS, iPhone 4, iPad, iPad 2 and the iPod Touch with software versions including iOS 4.3.3, and it "cannot be excluded" that other iOS versions – including the iOS 5 due in September – have the same weakness, said the Bonn-based federal bureau. The warning is published in German on its site .
The problem could occur when opening a website that carries an infected PDF file, possibly allowing criminals to spy on passwords, planners, photos, text messages, emails and even listen in on phone conversations.
»
www.guardian.co.uk/techn ··· revealedRelated....
JailbreakMe Hackers Expose Gaping Security Hole In iPhones–And Fix It Only For JailbreakersAndy Greenberg
Jul. 6 2011 - 12:54 pm |
The security industry has long warned that jailbreaking iPhones to install whatever unapproved applications the user wants leaves the device open to cybercriminals. But now, for the moment, the opposite may be true: The latest advances in jailbreaking has left those who hack their own phones safer from a major security exploit than those who don’t.
On Wednesday, the hacker who goes by the name Comex released JailbreakMe 3, a simple jailbreaking tool that allows iPhone and iPad users to break the protections that prevent unauthorized app installs simply by visiting Jailbreakme.com.
But there’s a darker side to that tool. Jailbreakme uses security vulnerabilities in how iOS handles PDF files that can also be exploited by any hacker who reverse engineers Comex’s work. That potentially leaves iPhone users vulnerable to a new and dangerous attack that could be used to gain complete control of the phone, what the security world calls a “zero day” flaw, warns F-secure researcher Mikko Hypponen. “What happened today is that these jailbreaking people announced a zero day vulnerability without warning the vendor at all,” he says.
In fact, a patch does exist for that vulnerability. But Comex’s hacking team, not Apple, created it and made it available in the unofficial app store Cydia, in essence covering their tracks to prevent other hackers from using their PDF bug. And that patch, called PDF Patch 2, can only be installed on jailbroken iPhones and iPads, leaving other users vulnerable to a copycat PDF attack. That means, for this latest exploit at least, jailbroken and patched iPhones and iPads are potentially safer than unaltered devices. “Normally, jailbreaking your phone breaks a bunch of the security that Apple has built into it,” says Charlie Miller, a security researcher for Accuvant. “Here it’s the opposite.”
»
blogs.forbes.com/andygre ··· reakers/
