iPhone security flaw offers complete control
updated 01:00 pm EDT, Mon July 23, 2007
iPhone security flaw
A new security flaw in Apple's iPhone could allow attackers to access personal information such as SMS text messages and voice mails stored on the device, and could even provide malicious users with a means of recording the iPhone owner or taking photos with the handset's built-in digital camera. The exploit, which was discovered by a group of security researchers who plan to detail the hole at the BlackHat conference in Las Vegas on August 2nd, offers complete unfettered access to the phone with administrator privileges. The experts who discovered the flaw at Independent Security Evaluators are refusing to provide extensive details on the security flaw but said iPhone users need only access a maliciously crafted website or forum post to hand over complete control of their phone to that site's owner.
Attackers gain access to the iPhone in one of three ways: any iPhone that automatically connects to an attacker-controlled wireless access point with the same name and encryption type as a trusted network would be compromised; an improperly configured forum on any website could allow insertion of the exploit; and iPhone users opening a link delivered via email or an SMS message could unknowingly open a hostile website.
ISE researchers have already alerted Apple to the presence of the security flaw, and have offered a patch to the Cupertino-based company to repair the issue. A video is available showing the compromise of an iPhone's security.
Fresh-Faced Recruit
Joined: Oct 2006
Give me a break!
What the article failed to also say was......
that the aforementioned hacker / attacker would have a better chance of success by simply jumping me on the street, putting a gun to my head, and jacking my iPhone from me.
I mean, come on, all these "ifs and coulds" are enough to make me laugh. I know which networks I am connecting to and I know which websites I am browsing with my iPhone.
If you carelessly jump around the internet and click on any and every link you come accross, then you might need to worry about this. However, just as on your computer, if you are a smart web citizen, you have nothing to worry about.
By the way, I am sure this study / hacker group is being funded by MicroShaft to find this and any other flaw. I mean, who else has enough time to sit around for two weeks without pay and find an exploit... that even if it works in the wild... gets them information that most likely would not reap any financial rewards. I mean, once you get the names and numbers of my infamous friends and family... what are you going to do with them? Sell them for top dollar... or try to blackmail my mother to not post her meatloaf receipe that she emailed me on the net?