The iPhone wakes up to something of a flogging this morning, after the mainstream press – which up until now had been speaking in hushed, reverent tones about the device – decided enough was enough and chose to roll out the “technology could destroy us all!” warnings. Today it’s a so-far unexploited security hole, by which should you connect to a specially set-up WiFi network and then click on a link on a malicious webpage a buffer-overflow in Mobile Safari could be triggered. Potentially serious, then, if you’re in the habit of connecting to any old available wireless network and surfing blindly, but in comparison to, say, the masses of malware that gets emailed around or can be triggered by downloading cracked or pirated software it’s not exactly a massive threat.
Read today’s New York Times and you’d be locking your iPhone in a lead-lined box, however. A series of “security experts” are wheeled out to show how easy it is for your precious Apple-phone to be subjugated to a life of crime and exploitation, with the usual threats of “running up huge bills” and “turning it into a portable bugging device” being tossed into the fray should the fear of stolen files and text messages not be enough for you.
The best piece of advice is comes at the end of the article, from Aviel D. Rubin of Independent Security Evaluators (the researchers who found the exploit):
“I will think twice before getting on a random public WiFi network now”
Honestly, that’s all you need to do. And considering “borrowing” other people’s wireless from “random” networks could feasibly see you arrested for theft (they tend to see it as “stealing”), you should really be giving serious thought to what network you connect to anyway.
Expect to see Apple patch the exploit in the near future.
[via TUAW]







Here’s the whole story:
http://www.securityevaluators.com/iphone/