Security Hole Puts All iPhone 4 Users at Risk of Data Theft

[RickAgresta]

The iPhone 4 has finally been jailbroken, thanks to the hard work of the Apple Dev Team. An unlock is expected to soon follow.

Unfortunately, the route used to jailbreak the phone appears to be just as readily exploited for less noble purposes. The method used by JailbreakMe involves navigating to a website with a PDF document. Due to poor programming, the PDF is allowed to execute code that would normally be disallowed. For the jailbreakers, this means executing code that will free your phone from Apple's walled garden.

However, for malicious hackers, this exploit could allow for the theft of your address book, text message database, pictures, and more on any iPhone 4. Reportedly, the method has not yet been broadly published, but will soon be publicly disclosed. At that point, black hat hackers will be able to have a field day.

read the complete article at: Security Hole Puts All iPhone 4 Users at Risk of Data Theft

[Varjak]

I can't wait to read the comments from Apple fanboys about THIS!

[Mi An]

It gives some credence to the idea that the reason Mac and linux (desktop) have less malware is because their install base is so low. Not only is there a huge iPhone install base, and the iPhone's internet footprint is disproportionately larger than it's install base, but there's also a big nonmalicious payoff for finding vulnerabilities in addition to the malicious ones, so hackers are digging around all the time.

In recent times, there's also been account hacking used to hijack accounts and steal through app purchases. Some might say the accounts were hacked due to crappy passwords or personal failings of users, but I wonder. One thing I like about google services is I can check geo locations for logins to my account whenever and get notifications for odd activity.

Regardless, one of the downsides of platform success is that it makes the platform a bigger target.

[JRakes]

That's actually one of my concerns with the security of some cloud services - As their popularity and use grows, they become larger targets for those with ill-entents. I figure there's a lot less risk of some e-thief targeting my lone Lappie here in my house than a server farm in a 3rd world country with millions of users stuffing their personal info into them.

[Mi An]

That's actually one of my concerns with the security of some cloud services - As their popularity and use grows, they become larger targets for those with ill-entents. I figure there's a lot less risk of some e-thief targeting my lone Lappie here in my house than a server farm in a 3rd world country with millions of users stuffing their personal info into them.

There's a lot to be said for security by obscurity.

[JRakes]

Or hiding in plain sight!

[RickAgresta]

then again, we shouldn't forget the 800-pound gorilla of security issues ---
Unpatched shortcut vuln exploited by mainstream malware ? The Register

shortcuts are *not* your friend, it seems...

[Old Blue]

Here's the security fix

[RickAgresta]

Here's the security fix

for which ?

[Old Blue]

for which ?

How many security fixes do you need? Just copy and paste the image

Hell - I'm still waiting for Apple to release a patch to fix the draining battery issue for the iPod Touch before I 'upgrade' to iOS4 - I just don't feel like doing a restore nor turning push notifcation off to get the same battery life I had in the previous version if I upgrade.

My head in the sand was in reference to Apple fans that seem to be ok w/ this and act like it's not an issue...losing functionality on an upgrade is not ok and I don't feel it's ok to turn off functionality and be happy w/ it. Maybe I'm crazy...

But hey the answer is 42 and I should be happy w/ it