Experts warn against iPhone security flaw

August 05, 2010 04:17 pm | Updated 04:17 pm IST - London

Security firms have warned of vulnerability in Apple's iOS for iPhone, iPad.

Security firms have warned of vulnerability in Apple's iOS for iPhone, iPad.

A hole in Apple’s iOS for iPhone, iPad and iPod could make the devices vulnerable to remote attackers, warned security firms.

Symantec said that it could be exploited by remote attackers to take complete control of a vulnerable device.

Experts said that the threat, at present, only exists on paper but Apple should issue a fix before it becomes a reality.

Apple said that the company was aware of the report and was investigating. The problem lies in the way Apple’s Mobile Safari handles Adobe Acrobat PDF documents.

As the browser automatically opens PDF files, a hacker could embed malicious code into this file.

Graham Cluley, a computer security expert with Sophos, said that the exploit used the same principle as Jailbreakme — a utility that lets iPhone 4 owners run non-Apple approved applications — although it uses the exploit in a benign way.

“It uses the same tricks as you do when jailbreaking,” the BBC quoted Cluley as saying.

“We always thought that Apple’s Mobile Safari would be the main vulnerability. At present, we have yet to see any of these exploits out in the wild, but it is only a matter of time,” he warned.

However, in an ironic twist, the only way of preventing Mobile Safari from automatically opening PDF files is by jailbreaking a phone and installing an application, called PDF Loading Warner, which then asks for permission every time the browser tries to open a PDF file.

U.S. authorities declared it was legal for users to jailbreak their phones. “I personally wouldn’t want to jailbreak my phone to get the fix,” said Cluley.

“Right now, its all eyes on Apple who we hope are going to fix this problem as soon as possible. Historically, Apple has been slow to fix problems on their Mobile browser. “This has been a concern of ours in the past and continues to be,” he added.

Apple has yet to release a patch that would either prevent jailbreak from working or close the highlighted security flaw.

Top News Today


Comments have to be in English, and in full sentences. They cannot be abusive or personal. Please abide by our community guidelines for posting your comments.

We have migrated to a new commenting platform. If you are already a registered user of The Hindu and logged in, you may continue to engage with our articles. If you do not have an account please register and login to post comments. Users can access their older comments by logging into their accounts on Vuukle.