Possible iPhone Vulnerabilities Identified
Despite its premium price, Apple’s iPhone has been selling like hot cakes last weekend, and and sales are still growing strong. No wonder security researchers are very interested in the smart gadget. Errata Security, a consulting and product testing company that offers expertise in cybersecurity has already spotted a flaw in the iPhone’s Safari browser less than 72 hours after its announcement. More are on the way as of this writing. I’ve compiled a list of possible and/or existing iPhone vulnerabilities based on the reports of different security blogs and news Web sites.
- “By effecting a buffer overflow in the application (Safari), an attacker can take control of the browser and run code on the device”. -Robert Graham, CEO of Errata Security.
- “The scenario that seems most attractive is to have the phone dial 900 numbers, an age-old attack that allows criminals with ties to fee-based phone services to profit each time an infected computer dial the number”. -Robert Graham
- “Our Bluetooth fuzzer1 locks up the device, so that’s an interesting sign”. -Robert Graham
- Currently making progress on unlocking the phone so it can be used on networks other than AT&T’s. -Antivirus Tools
- Working on getting the iPhone to run Linux. -Antivirus Tools
- Working on the possibility of allowing third party applications to the iPhone. -Antivirus Tools article
- iPhone root password is alpine and mobile user account password is dottie, although they’re useless at the moment since the iPhone has no terminal yet for remote access. -Hackint0sh forum
- “One underground site has collected information from the iPhone’s Macintosh OS X Disk Copy Disk image file.” -CNET News
- Crack open the service activation codes. -CNET News
- Support use of the iPhone as a modem. -CNET News
- Breaking iPhone’s digital rights management (DRM) functionality. -Antivirus Tools
1Fuzzer - A Security fuzzer is a tool used by security professionals (and professional hackers) to test a parameter of an application. Typical fuzzers test an application for buffer overflows, format string vulnerabilities, and error handling. More advanced fuzzers incorporate functionality to test for directory traversal attacks, command execution vulnerabilities, SQL Injection and Cross Site Scripting vulnerabilities. Web Vulnerability scanners typically perform all of this functionality, and can be considered an advanced fuzzer. -CGI Security
According to CNET News, the good news is that Apple, not AT&T will be in charge of iPhone security.
Apple has been pretty good about pushing out patches for its other Mac OS X platform products. Updates for the iPhone mobile OS will be pushed through iTunes when ready.
Robert Graham of Errata Security also mentioned in his blog:
We think Apple will win that battle. When we activated the phone, iTunes told us it was going to look for updates on July 5, 2007. That’s a good sign. We’ve reported a vulnerability in another smartphone 6 months ago that still hasn’t gotten patched, mostly because that carrier doesn’t want to. If Apple can push a fix for one of our bugs before this carrier fixes their bug, that might convince Wall Street that their strategy is better.
Nonetheless, which trick would you want to come out in the news first? I hear most of you say #4. Do you agree?
July 5th, 2007 at 23:19
regardless of the vulnerabilities, i still love iphone … hopefully it could be solved soonest possible …
July 6th, 2007 at 4:30
Hey StockTube,
Thank you for your comment!
iPhone is indeed a revolutionary device. The units sold in the first 72 hours were staggering! Because of the growing number of iPhone owners, many malicious individuals will surely have interest in the huge amount of information that these owners can potentially give out. Thus, they should be more responsible. And security is a big part of it.
April 11th, 2008 at 23:18
Top five shortcomings of the why iphone sucks? according to Newlaunches:
1. 2-megapixel camera when others have 5-megapixel shooters on board
2. 5-hour talk time: not enough battery life
3. No expansion slot. Go for the 8-gig model and that’s it.
4. No 3G: EDGE is so last year
5. No removable battery: You mean we can’t take along a spare battery? WTF?
April 30th, 2008 at 7:54
The good news is that Apple, not AT&T, will be handling iPhone security. Where mobile-service providers are traditionally slow to update their OS and firmware, Apple has been pretty good about pushing out patches for its other Mac OS X platform products. Updates for the iPhone mobile OS will be pushed through iTunes when ready. It is expected that Apple will start its updates for the iPhone by the end of this week.
June 17th, 2008 at 23:16
Hello, For me also security most importand thing. Because i am livin in middle east and here have many terror. More over every day can dies some body. And we are using the here many security protection and merarial.
June 18th, 2008 at 3:43
iphone’s also too big for my opinion…
June 24th, 2008 at 6:56
That is crazy, I can’t believe how many security problems that the iPhone has. I know that whenever you start a new product, there will be problems, but Apple has always been great with security on their Macs and on their apple iPhones. I hope that this is not the beginning of the decline of Apple.
July 3rd, 2008 at 3:44
This is old news but it sure panned out. I’m hoping with the new 3G iPhone coming out there will be more preperation for prevention of this type of stuff.
August 11th, 2008 at 15:40
Obviously, you are going to have people who feel coerced regardless, but that’s another issue, where perhaps education might come into play.
August 25th, 2008 at 16:14
iPhone is indeed a revolutionary device. The units sold in the first 72 hours were staggering! Because of the growing number of iPhone owners, many malicious individuals will surely have interest in the huge amount of information that these owners can potentially give out. Thus, they should be more responsible. And security is a big part of
August 27th, 2008 at 6:30
i dont trust any other phone, the iphone is a gift from the wordpress gods!
August 28th, 2008 at 7:56
travesti
August 28th, 2008 at 12:43
iPhone is not good. I prefer O2 then. It’s cheap and easy to use and many add-on softwares!