iPhone iPad vulnerable to remote attack.
This is significantly scary stuff. A vulnerability has been discovered in iOS 4 that allows a remote party to compromise an iPhone or iPad simply by visiting a website.
The vulnerability has been made available by well intentioned ‘hackers’ to jailbreak iPhones and iPads such that applications other than those approved by Apple can be run on the devices. Its possible to jailbreak your own device by visiting a website set-up by the hackers (Google for it, if you want to.)
The problem is that the same vulnerabilty could be used for malisious purposes. The exploit method is to load a specially crafted PDF file into Safari, that installs code on the phone and ‘opens’ it up for further exploit. The attack could be activated by pressing a link on a web page, via email, or even a link sent in an SMS.
There is no such thing as third party anti-virus or anti-malware for the iPhone and there is no way to switch off the vulnerable PDF reader, so right now the only defense for iPhone and iPad users is to practice safe browsing, and not to load PDF’s from untrusted sources.
To see the location of a link before clicking on it, press and hold the link, the URL will be displayed in the slide up menu, however even this can not be relied upon as long links get truncated and URLs often don’t disclose the type of media it links to.
iPhone vulnerabilities have been found in the past. iOS 1 (then called iPhone OS 1) had a very similar flaw that was again used to jailbreak the iPhone. And back at CanSecWest’s Pwn 2 Own competition an iPhone 3GS was hacked, but the exploit was far more involved.
I try to be careful not to overstate security issues, but this is a real threat and needs to be taken seriously. Its not a matter of if, but when this vulnerability will become ‘weaponised’. iPhone users are at the mercy of Apple to release a fix, and this is something that Apple has been slow to do in the past.
Filed under: Apple, iPad, iPhone | Leave a Comment
Tags: Apple, hack, ipad, iPhone, jailbreak, pwn, security, vulnerability
No Responses Yet to “iPhone iPad vulnerable to remote attack.”