Blog Archives

Hacking Alive and Well When It Comes To iOS

 

The dark art of iOS app hacking presented at Black Hat.

 

Español: Este es un logo para IOS (Apple). Más...

(Photo credit: Wikipedia)

 

There are three ways to hack an iOS app. One involves a zero-day exploit, a previously-unknown security hole. These are rare but not unheard of for iOS apps. The other two involve getting physical access to the phone, Zdziarski said.

“You can infect the phone without a passphrase. The virus or bit of code sits on the phone, waiting for the user to unlock it.” Or, he explained, “Give me two minutes with somebody’s phone and I can dump the entire file system from it.” From there, he said he could look at apps for an exploit to take advantage of remotely.

He argued that this could become a serious problem as iPhones and iPads continue to increase in popularity. Enterprise use of iOS is growing, he said, as is government use.

 

All due to a double-edged sword.

 

The problem, Zdziarski explained, comes from the double-edged sword that is the iOS monoculture. It has benefits, he said, including a reduced attack surface, rapid prototyping, and fewer holes to blame on the developer. But, he added, its homogeneous attack surface means that if you can hack one iOS device, you can hack nearly all. (While it’s true that there are different versions of iOS in use, there are significantly fewer than the different flavors of Android.)

Zdziarski noted that security has become an afterthought for iOS app developers, since they’re trusting Apple’s iOS Keychain and runtime to be secure. Keychain is the iOS feature that stores passwords, certificates, and other security-related items under encryption. “Anybody with freely available open source tools can get around that encryption now,” said Zdziarski, who said the encryption has been busted for two years. Zdziarski also showed how he didn’t even have to have the passcode to an iPhone to break its encryption. With a phone in his possession, he was able to drop a small piece of code from his computer onto the otherwise-locked phone. The code sits on the iPhone idle until the owner enters in the passcode, decrypting the file system and giving the malicious code access to the entire file system. “Developers are not turning on the encryption for most of their apps, and most users defer to a four-digit PIN, or a simple keyboard friendly passphrase.” So, although the phone’s operating system may be protected, the level of data security on the phone presumes that iOS won’t be hacked.

Source: iOS app hacking alive and well | The Download Blog – CNET Download.com.

 

A great illustration of how developers need to understand the need for security trumps all.

 

 

 

Advertisements

Enterprise: Securing iPads

iPad is a Wi-Fi 64 GB version (another one beh...
Image via Wikipedia

IT organizations have come to a stunning realization: There is no stopping the great iPad enterprise invasion. Risks abound as companies must deal with securing iPad apps without much help from Apple, says Julie Palen, senior VP of mobile device management at Tangoe, a telecom expense management software and services provider.

Palen’s group develops software that helps companies such as Wells Fargo and Coca-Cola manage BlackBerrys, iPhones, Android devices, and iPads — any devices connecting to a company’s back-end computing environment via Active Sync, BES, and Good Mobile Messaging.

The iPad, in particular, has had a rapid rise in enterprise adoption. More than 65 percent of Fortune 500 companies are deploying or piloting the iPad, Apple said during its most recent earnings call. Around 60 percent of Tangoe’s new business deals in the last quarter involve companies that have already deployed iPads or are planning to do so.

But the iPad isn’t really enterprise ready, in terms of manageability and security, says Palen, a 10-year veteran of mobile device management. She says IT organizations are buckling under pressure to support the iPad, even though the iPad wouldn’t have passed last year’s enterprise security requirements. (Source: InfoWorld)

Be sure to read the entire interview.  Very interesting that the biggest obstacle to “security” in the enterprise with iPad’s is Apple itself.

Powered by ScribeFire.

Enhanced by Zemanta

 

In case you weren’t aware …

Mac’s are vulnerable to exploits too.

Proof of concept exploit code was posted today by a security researcher at SecurityReason to demonstrate a vulnerability in versions 10.5 and 10.6 of Apple‘s Mac OS X operating system.

The vulnerability is a potential buffer overflow error arising from the use of the strtod function Mac OS X’s underlying Unix code. It was first reported by researcher Maksymilian Arciemowicz last June.

SecurityReason’s advisory describes a flaw in the libc/gdtoa code in OpenBSD, NetBSD, FreeBSD, and MacOS X, as well as Google Chrome, Mozilla Firefox and other Mozilla software, Opera, KDE, and K-Meleon.

SecurityReason’s advisory rates the vulnerability’s risk as “high” and claims that the flaw can be exploited by a remote attacker.

A spokesperson for SecurityReason wasn’t immediately available to characterize the likelihood that this vulnerability could be exploited.

The vulnerability was addressed in FreeBSD and NetBSD last last summer.

And shortly thereafter Google and Mozilla, among other vendors, did the same.

But Apple apparently has not yet updated its software to incorporate the fix.

Apple did not immediately respond to a request for comment.

It looks like Apple devices could be targeted more frequently, so Mac users may want to start taking security seriously.

In their respective predictions for 2010, computer security companies Symantec, Websense, and Zscaler all said that they foresaw more attacks being directed at Macs and other Apple devices this year.

To some extent, such predictions represent wishful thinking. But Mac users should give some thought to security, if only in terms of using the built-in Mac OS X firewall and exercising caution in the Web sites they visit and the e-mail messages they open. (Source: Information Week)

Reblog this post [with Zemanta]

You may have had problems …

Windows 7
Image via Wikipedia

installing Windows 7 if you got through a promotion.

College students who took advantage of a “deal too sweet to pass up” have run into a bit of trouble.

The $29 electronic version of Windows 7 Home Edition sold for Microsoft (MFST) through Digital River (DRIV) doesn’t seem to install properly on some 32-bit Vista machines.

Apparently the download files weren’t properly packaged and when some users tried to “unload the box” they got an error that read:

“We are unable to create or save new files in the folder in which this application was downloaded

If you were one of the unlucky ones there is a fix available that can be found here.

Kudos to Microsoft for acknowledging there was an issue.  Kudos as well for a fix being provided, though some would claim the fix is difficult.

Microsoft acknowledged the problem Thursday evening and by Friday was reportedly offering refunds. Meanwhile, however, Microsoft technicians are pointing users to a five-step Download Squad workaround (pasted below the fold) that might be enough to send students screaming to the nearest Apple Store. (Source: Windows 7 student upgrade hell – Fortune Brainstorm Tech)

But in all seriousness making an ISO really isn’t that hard.  Unless you’re Microsoft apparently.

Reblog this post [with Zemanta]

New attacks targeting Macs …

Apple Mac Carabiner
Image by acordova via Flickr

were uncovered last week.

Security experts have discovered two new attacks targeting Mac users, a new version of a worm and a Trojan hidden inside a porn site.

Antivirus firm Sophos on Wednesday discovered a new version of the Mac OS X Tored worm, according to a Sophos blog post.

On Tuesday, Paretologic warned about a porn site that was downloading malware that targets both the PC and the Mac. Mac users get redirected to the pagemac.php page, which downloads a QuickTime.dmg file, the blog post says.

Sophos explained in blog post on Thursday that visitors to the malicious porn site are told they have to download an ActiveX component to view the videos. Instead, a Trojan, dubbed OSX/Jahlavc, gets downloaded.

“As we’ve demonstrated before, and as we’ll no doubt explain again, the Mac malware threat is real,” writes Sophos security researcher Graham Cluley. “Hackers are deliberately planting malicious code on Web sites, and using social engineering tricks to fool you into installing it onto your computer.” (Source: Two new Mac attacks surface – CNET Security)

A reminder that NO system is totally safe from attacks so steps must be taken to protect it.

Reblog this post [with Zemanta]

Interesting technology articles …

Image representing FriendFeed as depicted in C...
Image via CrunchBase

highlighted on FriendFeed.

Israeli Government Sites Attacked in January (June 15, 2009) – http://www.sans.org/newslet…
Vuln: Apple Safari ‘parent/top’ Cross Domain Scripting Vulnerability – http://www.securityfocus.com/bid…
Vuln: WordPress Photoracer Plugin ‘id’ Parameter SQL Injection Vulnerability – http://www.securityfocus.com/bid…
NASA Heads Back to the Moon for First Time in Decade – http://www.foxnews.com/story…
Intel toots its research horn for chips–and more – http://news.cnet.com/8301-10…
A facelift for Facebook in-boxes, but is it enough? – http://news.cnet.com/8301-13…
Microsoft’s free antimalware beta on the way – http://news.cnet.com/8301-10…
Database monitoring, encryption vital in tight economy, Forrester says – http://searchsecurity.techtarget.com/news…
Virtual appliances boost flexibility, improve security – http://searchsecurity.techtarget.com/news…
Clocking Windows netbook performance – http://www.infoworld.com/d…
Vuln: Linux Kernel ‘/proc/iomem’ Sparc64 Local Denial of Service Vulnerability – http://www.securityfocus.com/bid…
Vuln: Multiple Browsers Cached Certificate HTTP Site Spoofing Vulnerability – http://www.securityfocus.com/bid…
Legal Issues are Hazy for Cloud Computing – http://information-security-re…
MasterCard Beefs Up Security Requirements – http://www.cio.com/article…
No Virtualization Skills? Better Get Started – http://www.cio.com/article…
Spammers Cashing in on Twitter, Iran and New IPhone – http://www.cio.com/article…
Microsoft veteran launches Twitter search engine – http://news.cnet.com/8301-13…
Criminal network to trade botnets and malware uncovered – http://www.scmagazineus.com/Crimina…
Why did Amazon open-source its Kindle software? – http://www.infoworld.com/d…
Slowloris HTTP DoS – http://ha.ckers.org/blog…

Reblog this post [with Zemanta]

Recent article highlights 6/9/09

Image representing FriendFeed as depicted in C...
Image via CrunchBase

From FriendFeed:

Ice Energy to cool data centers – http://news.cnet.com/8301-11…

Spam reduces following Pricewert shutdown, reports say – http://news.cnet.com/8301-10…

DTV transition: Avoiding an e-waste ‘tsunami’ – http://news.cnet.com/8301-11…

CNET: Can $99 iPhone make Apple affordable? – http://www.cnn.com/2009…

New iPhone to hit stores June 19 – http://www.cnn.com/2009…

Juniper revs Ethernet to 100Gbps – http://news.cnet.com/8301-10…

UK hacker asks judges to stop extradition to US – http://www.wbay.com/global…

Apple Unveils Faster iPhone, Drastic Price Cuts – http://www.foxnews.com/story…

Reblog this post [with Zemanta]
%d bloggers like this: