Frustrated researcher details iPhone security bugs
Pushes Apple to patch by revealing more about phishing, spamming flaws
Computerworld - Tired of getting the brushoff from Apple Inc., Israeli researcher Aviv Raff today disclosed technical details about a pair of iPhone security flaws that he first reported more than two months ago.
Raff, best known as a browser vulnerability researcher, told Apple in July that he had uncovered bugs in the iPhone's Mail application as well as in its version of Safari that could be used to trick users into clicking on malicious links and boost the amount of spam they face.
But after Apple continued to defer patching and declined to set a date for fixing the flaws, Raff decided to go public. "Two and a half months later, and still there is no patch for those vulnerabilities," he complained in a post to his blog. "I've asked Apple several times for a schedule, but they have refused to provide the fix date. Three versions (v2.0.1, v2.02, v2.1) have been released since I provided them with the details, and they are still 'working on it.'"
In an interview today, Raff said that although he's used this tactic before to pressure a vendor into patching, he's reserved it for companies that "act irresponsibly, as Apple did this time and other vendors have done other times." Raff said he last contacted Apple a week ago.
Apple last patched the iPhone on Sept. 12, when it issued fixes for eight security vulnerabilities as part of the v2.1 update.
Both Mail and Safari truncate URLs to accommodate the iPhone's small screen, said Raff, a bug that hackers could exploit by feeding malicious links via HTML messages. Because Mail cuts out the middle portion of a long URL, the attacker could spoof a legitimate domain by using a legitimate service such as Facebook to provide the first bits of the address but tuck the malicious part of the URL after the iPhone's cutoff.
Raff demonstrated a possible exploit by creating a link that, at least to an iPhone owner, appeared to be a URL to Facebook's sign-in site, but was actually a link to an image he'd posted on his own domain.
"The user will have to look carefully at all links that he clicks," said Raff when asked for advice on deflecting such attacks. "But this takes a lot of effort as Safari automatically jumps to the end of the URL when clicking on the address bar."
He called the other iPhone bug "a pretty dumb design flaw" that made it easier for spammers to identify valid e-mail accounts, and thus mark them for more spam.
Because the iPhone automatically downloads images attachments, it would be a cinch for spammers to identify a working e-mail account. "The spammer who controls the remote server will know that you have read the message and will mark your mail account as active in order to send you more spam," said Raff. Since there is no way to disable auto-image download on the iPhone, he recommended that iPhone users refrain from using Mail until Apple patches the problem.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Macintosh White Papers | Webcasts