iPhone data interception tool released

Powered by SC Magazine
 

Marlinspike provides a good reason to update iOS 4.3.5.

A near decade old tool has been updated with man-in-the-middle attack capabilites that can intercept traffic from Apple iPhones.

The attack tool sslsniff exploits a vulnerability disclosed by researchers Gregor Kopf and Paul Kehrer yesterday which allow traffic from iOS iPhones to be intercepted.

Apple released fix iOS 4.3.5 yesterday to fix the flaw.

The BasicContraints vulnerability affecting iPhones was first identified in 2002 by independent researcher Moxie Marlinspike who developed sslsniff to exploit the flaw.

Back then, it was used to exploit certificate chain weaknesses (pdf) in Webkit browsers and Microsoft CryptoAPI, affecting the likes of Firefox, Internet Explorer, Pidgin, AIM and Microsoft Outlook.

"It validated all the signatures in a certificate chain, but failed to check whether the intermediate certificates had a valid CA BasicConstraints extension se," Marlinspike said.

"This meant that you could take any old CA-signed certificate and use it to sign any other certificate."

The Linux-based sslsniff tool was updated with iOS fingerprinting support and can be downloaded here. Run (sslsniff -a -c -f ios -h -s -w iphone.log).

Copyright © SC Magazine, Australia


iPhone data interception tool released
Tim Parkinson, CC2.0
 
 
 
Top Stories
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
 
Doubts cast on Queensland's ICT Dashboard
Opposition, former Govt CIO say it can't be trusted.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  25%
 
Application integration concerns
  3%
 
Security and compliance concerns
  29%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  23%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 823

Vote