Apple iPhone password hole on fix list
In a week that featured a lot of news on security from apps that pierce it to Web sites that ignore it, Apple has acknowledged a flaw that makes it possible to gain easy access to iPhones, with a fix on the way.
This particular flaw, though, is serious enough that it should not get swept under the rug or lost in the shuffle. Apparently, the flaw allows absolutely anyone to gain access to the phone function without the need to enter a passcode by pressing some touchscreen buttons and a physical button. The flaw has been demonstrated to everyone’s satisfaction by the techies and non-techies alike, according to an SC Magazine story.
It appears that the passcode bypass security flaw will work on some iPhone models and not others. It looks like the iPhone 3G and 4 are susceptible and the iPhone 3GS is not, though there may be some debate on the handset model issue. Regardless, on those phones where it is possible to bypass the security code entry, it is possible to both make calls and send emails if you have simple physical access to the phone.
One security expert, Alan Bentley of Lumension, says, “The reported flaw in the iOS4 operating system comes as absolutely no surprise. With the mass adoption of high profile devices like the iPhone, it was only a matter of time before cyber criminals turned their attention to this new data hotbed and began to find ways to crack the codes and unlock the valuable assets within them. In addition to the obvious impact this threat could have on consumers, businesses worldwide have issued iPhones to employees to support mobile working. With the vulnerability potentially exposing reams of personal and corporate data, this is a threat Apple must tackle quickly. Until now, security concerns over smartphones have been about protecting the data being sent from the device and unauthorised connectivity into corporate networks, but now users have to be equally mindful of what, or who, might get in.”
Apple has said that it will plug this particular security hole as part of the as part of the iOS 4.2 software update in November.
Related posts:
