Israeli Security Expert Found iPhone Two Security Flaws
Advertisements
Back in July, Aviv Raff, told Apple about two iPhone issues that he considered to be vulnerabilities. Updates 2.0.1, 2.0.2. and 2.1 came and went with no fix, so Mr. Raff went public with the details. All that Apple has said, according to Mr. Raff, a security researcher in Israel is that they’re still “working on it.”
The first problem is related to the limited real estate on the iPhone screen. For some time now, desktop e-mail programs are designed to display, with a hovering tooltip, the actual URL of a link, no matter what the text says. Apple Mail does that on the Mac.
On the iPhone, there is no hovering tip, and in fact, the iPhone truncates the URL due to limited space. As a result, a longer, malicious URL could look like a legitimate one. The author showed an example of a deceptive link to Facebook.
The second problem is one that has also been fixed in desktop systems, namely the link-back of embedded images. “This one is not just a trivial bug, it’s actually a pretty dumb design flaw, which was already fixed by all other mail clients ages ago. Whenever you view an HTML mail message which contains images, a request is made to a remote server in order to get the image. Most of the mail clients today requires you to approve the download of the images. This is done for a good reason,” Mr. Raff wrote.
“If the images were downloaded automatically, the spammer who controls the remote server will know that you have read the message, and will mark your mail account as active, in order to send you more spam. This ‘feature’ is also known as ‘Web Bug’.
“The iPhone’s Mail application downloads all images automatically, and there is NO WAY to disable this feature!” Mr. Raff noted with dismay.
Mr. Raff suggested that the Mail application on the iPhone not be used until these issues are fixed.
Apple has a history of fixing bugs on their own schedule, not the schedule of researchers who report them. That can lead to some frustration, but in the end, Apple makes the call on which vulnerabilities get the highest priorities. Sometimes, fixing a security flaw disrupts an entire feature set, and reworking the feature, without the flaw, takes time. In any case, knowledge is better than ignorance for users, and, as usual, iPhone users should be Internet savvy and at least as smart as their smartphone.
Advertisements