July 23rd, 2007
iPhone Owned by Hackers
By Jimmy Daniels
Contributing Writer, RealTechNews
Looks like the first reported iPhone vulnerability is a doozy, they said they can read the log of SMS messages, the address book, the call history and the voicemail data, and they can take control of the iPhone and dial phone numbers, send text messages, or record audio (as a bugging device) and transmit it over the network for later collection. Almost like there is no security at all.
Three security researchers claimed Sunday that they have found the first exploitable vulnerability in Apple Inc.’s iPhone, a flaw that allows them to steal any data from the device or even turn it into a remote surveillance tool.
According to a paper posted by the three, they rooted out a vulnerability in the iPhone’s version of Safari using “fuzzing” tools and wrote a proof-of-concept exploit that can be delivered from a malicious Web site or using “man-in-the-middle” tactics to trick users into connecting to a malicious wireless access point. Source: ComputerWorld
We Say: The hackers gave Apple until August the 2nd to fix the vulnerability as they will release the vulnerability and exploit at the upcoming Black Hat 2007 security conference, that opens next Saturday, July 28, in Las Vegas. No pressure Apple, take your time.
Will Sheward says:
We found another security hole whsilt looking into the phone’s IMAP support. The proprietary mechanism that Yahoo mail uses to authenticate with the iPhone leaves it wide open to a replay attack, anyone could gain access to your Yahoo email account. More details at http://blog.isode.com/2007/07/iphone-signific.html
July 23rd, 2007 at 2:18 am
mark says:
Wow, they better patch this soon or I’m switching to Blackberry.
July 23rd, 2007 at 8:53 am
VPNs May Be an Answer for Smart Phone Security - Network Sentry says:
[…] The attention being paid to smart phone VPNs is an extension of the reaction to the iPhone. The bad guys follow the news, too, and have taken aim at the device. RealTechNews says the first iPhone vulnerability is “a doozy” that can enable what seems like unfettered access to the device. The vulnerability can let outsiders read the SMS message log, address book, call history and voicemail data and basically control the device as if there is no security at all. […]
August 12th, 2007 at 10:35 am