Welcome!

Wednesday, August 27, 2008

Critical Iphone security risk, and how to prevent it.



In the iPhone 2.0.2 firmware, there was a major security flaw that allowed access to private data even with security passcode turned on.

In just two steps anyone can have access to a lot of private data on the phone.

After you slide to unluck the phone, you will be on the enter passcode screen

1. click on 'emergency call'
2. double tap on the home button

Click here and then double tap the home button to access favorites without entering a passcode!

and you'll have full access to your cellphones private information in Mail, SMS, Contacts and safari browser.



from gizmodo:
"Done. You are now in your favorites. This seems like a feature, because you may want to have emergency number in your favorites for quick dial. The security problem here is double. The first: anyone picking up your phone can make a call to anyone in your favorites. On top of that, this also opens access to your full Address Book, the dial keypad, and your voice mail.

If that wasn't bad enough, the second one is even worse: if you tap on the blue arrows next to the names, it will give you full access to the private information in a favorite entry. And it goes downhill from there:

• If you click in a mail address, it will give you full access to the Mail application. All your mail will be exposed.
• If there's a URL in your contact (or in a mail message) you can click on it and have full access to Safari.
• If you click on send text message in a contact, it will give you full access to all your SMS."



Here is an article on Gizmodo as well as a video demo.

They have also provided a solution by changing the function of your home button so that when you double tap it, it will perform a different task.


1. In the iPhone home, go to Settings.
2. Click on General.

3. Click on Home Button.

4. Click on either "Home" or "iPod".


This is what you should see
Change the function of the home button to prevent this risk!


It has been reported that apple will fix this security flaw in their next firmware update, but there has been no announecment to when that will be. For now just use this simple solution, i hope it helps!

1 comments:

AbhashK said...

I recently made an appointment at the SO CALLED "GENIUS BAR" in the Apple Store because the Apple Mail Client on my MacBook Pro refused to send mail from wireless networks at hotels when I travel, even if there was not a firewall present. The so called" Genius" apple employee proceeded to delete my mail settings and my mail server settings, at which point, it became apparent that he did not know what he was doing. I told him to stop deleting everything until he could explain what he was doing. He then told me that Apple allows only 15 minutes for each repair and that time had expired and that I should "Have a nice day" Not only was this person poorly trained, he did not like the suggestion that he didn't know how to fix the problem, which he couldn't do.

The is it that Apple gets away with calling low paid retail employees "geniuses?" I have had it with the arrogance and incompetence that comes with Apple's (lack of) customer support. These post-pubesent computer science drop outs who could not get an actual job in a computer company are trained to be arrogant and to invalidate your warranty. You can expect them to tell you to reinstall everything which makes the defective computer or buggy software YOUR PROBLEM or to simply by a new computer as yours is out of warranty.

While sitting at the so called "Genius Bar", I saw two people come in with broken iphones. They were told that the problem was not covered by warranty and that Apple would happily sell them a refurbished, older generation iphone at the same price as a new one costs.

It turns out that Apple has known about the inability of Apple Mail to send mail from hotels and other locations as their are bugs in the ourbound mail server management of Apple mail. Another Apple employee believes it is a source code probelm but said that Apple support employees are not allowed to work on source code problems (Its probably beyond most of them). Turns out that thousands of people can not send mail and have posted the problem across the user support forums but apple as FAILED TO FIX these MAJOR BUGS as their engineers are too busy designing new ipads and iphone antennas. (You don't expect your new phone to make phone calls now, do you?)

All of the technology and finance journals love to report on Apple's new products but they never check back to see if these products actually work. Apple repeatedly FAILS TO FIX THEIR OWN BUGS. Apple will not even take responsibility for their own bugs. Steve Jobs is one helluva shepherd. When are apple's customers going to stop acting like sheep?

PC - week Headline Animator