JavaScript is off. Please enable to view full site.

Apple iOS bug makes devices vulnerable to attack: experts

Apple iOS bug makes devices vulnerable to attack: experts

Tuesday, November 11, 2014, 08:06 GMT+7

Cybersecurity firm FireEye Inc published details about the vulnerability on its blog on Monday, saying the bug enables hackers to access devices by persuading users to install malicious applications with tainted text messages, emails and Web links.

The malicious application can then be used to replace genuine, trusted apps that were installed through Apple's App Store, including email and banking programs, with malicious software through a technique that FireEye has dubbed "Masque Attack."

These attacks can be used to steal banking and email login credentials or other sensitive data, according to FireEye, which is well-regarded in cybersecurity circles for its research.

"It is a very powerful vulnerability and it is easy to exploit," FireEye Senior Staff Research Scientist Tao Wei said in an interview.

Apple's iOS has robust security features that make it extremely difficult for attackers to install malware on devices using traditional techniques for infecting Windows machines andAndroid mobile devices with malicious emails and Web links.

The "Masque Attack" makes that possible by exploiting a system that Apple developed to allow large organizations to deploy custom-built software without going through Apple's App Store, according to David Richardson, iOS product manager at mobile security firm Lookout.

Those applications are not vetted by Apple for malicious software, unlike apps in its App Store, though users do receive pop-up notifications asking if they want to prevent the apps from installing on devices, he said.

"You can just say 'Don't install.' As long as you do that, you will be protected from this vulnerability," Richardson said.

FireEye disclosed the vulnerability to Apple in July and representatives of the company said they were working to fix the bug, according to Wei.

Apple could not immediately be reached for comment.

News of the vulnerability began to leak out in October on specialized Web forums where security experts and hackers alike discuss information on Apple bugs, Wei said.

He said FireEye decided to go public with its findings after Palo Alto Networks Inc last week uncovered WireLurker, the first campaign to exploit the vulnerability.

"Currently WireLurker is the only one, but we will see more," Wei said.



Read more




Vietnam’s Mekong Delta celebrates spring with ‘hat boi’ performances

The art form is so popular that it attracts people from all ages in the Mekong Delta

Vietnamese youngster travels back in time with clay miniatures

Each work is a scene caught by Dung and kept in his memories through his journeys across Vietnam

Experience summer sand-boarding in Mui Ne

Sand-boarding, a popular activity amongst local children in the coastal tourism town of Mui Ne in south-central Vietnam, is attracting hundreds of tourists to the Red Sand Dunes

Latest news