WatchGuard Wire
Improve Your Security IQ
Untitled Document
iPhone update fixes ten security vulnerabilities; some critical
If you've been following Steve Jobs' war
with iPhone hackers, you probably expected today's iPhone update. After
all, he's been warning unlockers for weeks. However, you may not
have realized just how many security vulnerabilities the update would fix,
nor how severe a risk some of them present. If you have an iPhone, you don't
want to miss this update.
Besides adding a new wireless iTunes Music Store and fixing a problem with
low speakerphone volume, Apple's
iPhone v1.1.1 update fixes ten security vulnerabilities. The scariest vulnerability
of the bunch involves an input
validation flaw in iPhone's Bluetooth server. If an attacker can get within
Bluetooth range of your phone (typically 30 feet, but hackers can
extend that), he can exploit this vulnerability to execute code on your
iPhone. Apple's alert doesn't
say what privilege that attacker's code runs with, but I assume the code can
do anything on your phone that you could, including dialing numbers without
your permission and racking up your phone bill. It's pretty scary to know your
phone can get pwned wirelessly, just because you're within range of a silent
attacker.
The other vulnerabilities include seven flaws in iPhone's Safari web browsers
(mostly Cross-Site Scripting (XSS) related) and two flaws in its Mail program. One of the Mail flaws allows attackers to dial phone numbers without your confirmation, assuming they can first entice you into clicking a specially crafted link. If you'd like to know more about these flaws, check out Apple's alert. If you want to know a little about the new features included in this update, you can also watch this Apple video. Unsurprisingly, the video doesn't mention the security flaws
Apple's only made the update available via iTunes. To get it, make sure you've
installed the latest version of Apple's media player. Oh, and if you happen
to have unlocked your iPhone, there are conflicting reports as to whether or
not this update will brick your phone. A Computerworld
article claims
the update breaks unauthorized apps you may have installed, and forces you
to switch back to your official AT&T SIM, but that you can restore your
iPhone into a working state (no longer unlocked though). However, an Infoworld article claims the update bricks unlocked phones. So unlockers
beware. That said, something tells me iPhone hackers will quickly find a way
around this update. I expect the iPhone unlocking arms race to continue for
months to come. -- Corey
Nachreiner, CISSP
Copyright© 2010 WatchGuard® Technologies, Inc. You may copy and distribute this article freely in any medium as long as you copy and distribute the entire article without change and preserve this copyright statement and notice.
|
