Researchers warn of critical iPhone vulnerability

 

Could allow hackers to remotely execute code.

Security experts are warning of a serious vulnerability in the iPhone that could allow hackers to remotely execute code on the device.

Security researcher Charlie Miller announced the findings at the SyScan conference in Singapore yesterday. He is now reportedly working with Apple to get the problem fixed as soon as possible.

Patrick Runald, chief security advisor at Finnish web security firm F-Secure, argued on the firm's blog that the vulnerability, which exploits a weakness in the way the device deals with text messages, is "as bad as it gets".

"The vulnerability seems to allow unsigned code to run, which circumvents a core part of iPhone's security model," he wrote. "It's usually only able to run signed code, i.e. apps that have been approved by Apple. No user interaction is required, which is unlike current mobile malware."

The vulnerability could enable hackers to remotely turn on the GPS function to monitor the handset's location, or turn the microphone on to listen in on conversations, Miller is reported as saying.

Apple will be hoping it finds a fix for the vulnerability before Miller discusses the flaw in greater detail at a planned Black Hat presentation.

It has been a bad week for the iPhone. Supplies have been running out in parts of the US, and the blogosphere has been awash with claims that the new 3GS model is prone to overheating.

Copyright ©v3.co.uk


Researchers warn of critical iPhone vulnerability
 
 
 
Top Stories
Making a case for collaboration
[Blog post] Tap into your company’s people power.
 
Five zero-cost ways to improve MySQL performance
How to easily boost MySQL throughput by up to 5x.
 
Tracking the year of CIO churn
[Blog post] Who shone through in 12 months of disruption?
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  68%
 
Advanced persistent threats
  4%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1051

Vote