We have some instant reaction to the hacking of the Colorado Rockies’ online ticket system from Larry Seltzer at PC Magazine.

I have to admit, one of the first thoughts that crossed my mind when I first heard of this incident was, “Hmmmmm, isn’t Boston a security researcher-rich city?”

Seltzer also raises the possibility that the attack wasn’t an attack at all, but an attempt to hog tickets.

Mega-hype = increased attention from hackers.

Researchers have proven that one since late July, since when the iPhone has been pulled apart by what must be the largest number of researchers ever interested in a mobile device.

And why not? The iPhone, after all, is a mini-computer – and one from a company known for not having the best relationship with the research community.

Renowned hacker H.D. Moore published some iPhone exploit code over the weekend. Here it is, if you want to take a look.

And please keep in mind, most experts have recommended fighting iPhone insecurity with policy, allowing the device only a very short leash within corporate environments.

Who wouldn’t want a free iPhone – or an iPhone free of a binding agreement to one voice service provider?

I would. But it’s likely that no such deals exist, unfortunately. But here are some details on scam emails and online advertisements that claim they do - as well as other swindles.

The PC Doctor’s Blog details recently discovered iPhone scams, one claiming “unlocked” iPhones are available on eBay.

“An iPhone but be free of AT&T? Dream on!
A number of “unlocked” iPhones seem to be on sale on eBay. Given that there’s no confirmed unlock method for the iPhone, their listings are either erroneous or deceptive. Many of the sellers, when questioned on this, seem to be retracting their statements about the iPhone being unlocked, but there’s still plenty of scope for buyers to be scammed into buying a phone that’s not suitable to their needs.”
- “iPhone scams to be wary of…” The PC Doctor’s blog, July 2

But the award for the most comprehensive webpage on iPhone scams has to go to ScamBusters.org, which predicts the top seven most common iPhone scams – updated post-launch.

“1. iPhone on eBay scams:
As we write the first version of this article on Wednesday evening, two full days before the launch of the iPhone, there are already 1,796 products listed when you do an eBay search for ‘iPhone.’

Our recommendation: Never open attachments from people you don’t know or that you aren’t expecting. Keep your anti-virus software and anti-spyware software up to date. Use a firewall.”
- “iPhone scams: ScamBusters.org predicts the Top 7 iPhone Scams,” ScamBusters.org, updated July 3

It’s a little too early to start wondering if, a decade now, you’ll ask your friends, “Where were you when the iPhone went on sale?” But that doesn’t take away from the fact that Apple’s latest and greatest gadget launch was an unqualified success - at least in terms of living up to the hype.

Scammers have also had their turn with iPhone madness, sending out scam emails that download malware or try to acquire financial information from recipients.

The researchers are hard at work as well, taking the iPhone apart and looking for any security vulnerability they can find.

Here’s some post-launch security analysis of the iPhone launch:

“Within hours of Apple’s introduction of the latest version of its Safari browser two weeks ago, the hacking community began reporting bugs they had discovered in the beta code. Today, the iPhone is likely to get even closer scrutiny from many of the same security researchers. Here’s a list of the top items on the typical iPhone hacker’s to-do list.

3. Take a Close Look at iPhone’s Networking Technologies
Because Apple hasn’t previously developed its own mobile phone, there is bound to be lots of new and possibly buggy networking code in the device. “One of the things we’ll look at as well is the new code that will have to be developed for a phone platform,” said Neel Mehta, a researcher with IBM Corp.’s Internet Security Systems division. “With any piece of new code there’s always a risk that there could be vulnerabilities in it.”
- Anand Vardhan, Anand Varhan: Flex Developer, July 2, “A hacker’s to-do list – iPhone”

“Yup. After waiting a day to get the darn thing activated, we found a bug within a few minutes. We are cheating, of course; it’s just the same bug we found earlier on Safari. Also, our Bluetooth fuzzer locks up the device, so that’s an interesting sign. (As we’ve said in the past, we’ll disclose all our bugs to Apple when they publish acceptable vuln handling guidelines).

At the same time, Apple is going to have the same problem that Windows has. While they may have better theoretical security, they are going to be a bigger target. Hackers know a lot more about breaking into Mac OS X than they do competing platforms like Windows Mobile or Symbian. Thus, even though Apple will patch sooner, they’ll also have more bugs to patch because of increased hacker interest.”
- Robert Graham, Errata Security blog, July 1, “Our first iPhone bugs”

At the risk of turning The Roundup into “All Safari, all the time,” here’s another sampling from the IT security blogosphere about Apple’s release of Safari for Windows.

Just hours after the release, researchers claimed numerous vulnerabilities within the browser, adding a new twist to Apple’s already strained relationship with the security community.

“Safari 3.0 is still in beta and beta software is expected to have bugs. Even after the final release, browsers with vulnerabilities have become more rule than exception. Microsoft’s Internet Explorer, Mozilla’s Firefox, and the existing version of Safari for OS X, regularly get patched to fix security vulnerabilities.

What it boils down to is this: The usual advice for safe computing remains the same. Don’t assume any software is inherently safe, regardless of how safe it purports to be. Software is written by humans, and humans do make mistakes, which can lead to vulnerabilities. Make sure you’re running up to date security software and install the latest security fixes from your software vendors.”
- Allysa Myers, McAfee Avert Labs Blog, “Safari for Windows is not a trojan horse”

“Probably the most interesting part of this is Dave Maynor’s reasons for going full disclosure. He doesn’t talk about it much on his blog, other than this little quip, ‘keeping with our disclosure policy, we do not report bugs to Apple.’ Apple has had a long history of bad dealings with security researchers, and they are now seeing a backlash amongst the security community. No surprises though, you get what you ask for. It pays not to make enemies in this business.”
- ha.ckers, “Sad day for Safari on Windows”

“So as everyone knows, Apple has released Safari 3 beta for OS X and Windows, and security researchers are already dropping flaws on it. I believe Apple has just caused the price of Safari zero days to increase about 1,000 percent by releasing it on Windows.”
- Security-Protocols, “Safari 3 beta released on Windows”

It didn’t start as a security story in the strictest sense, but Apple’s release this week of the Safari web browser for Windows sent researchers scurrying.

Within a few hours, claims of as many as six flaws in the beta were revealed.

Apple has promoted Safari’s browsing speed on its website, but its widely thought that the release has more to do with users of the soon-to-be-released iPhone having the opportunity to use the same browser on PCs and mobile devices.

“Now, why do I think Jobs introduced Safari for Windows. Let’s look at the satiation here. Let’s say Windows people are afraid to switch to a Mac because they don’t know how to operate the interface. Okay. Safari and iTunes are the Mac apps on Windows. Both are different in their own special way, each having a nice interface. The new Finder is just like iTunes. Compare ‘em, go ahead. Safari is exactly the same on both platforms. IMHO – I think Apple is making a play here for switchers. Don’t be afraid to switch to OS X, have you used iTunes before? Then you know OS X. Done. Everything in OS X will look like an app you are already familiar with, okay?”
- Joel Esler, OS X and Other Stuff

And on those newly discovered flaws…

“Safari for Windows is all about the iPhone. Apple is not going to let people develop third-party apps for the phone. However, the phone will run Safari. So if you develop Safari-specific web applications, you can get them on the iPhone, assuming they lend themselves to a mobile platform. You may have to configure, install, download, etc. from your regular computer and sync with your iPhone. Safari will be the iTunes to the iPhone’s iPod. This has nothing to do with Apple trying to take market share from IE or starting a new browser war…Now whether it is secure is another question. Another question is what has Apple done that so many security researchers will not share disclosure information with them. I think they need to reassess their relationship with the security industry.”
- Alan Shimel, Still Secure, After All These Years

“The guys over at Errata Security found a memory corruption error in the new Windows beta of Safari before (to quote a friend) ‘the ink was even cold on the press release.” And all using publicly available tools. Ouch.”
- Martin McKeay, Network Security Blog

It’s unlikely that we’ll ever see vendors making media-coordinated product announcements for their latest anti-virus protection for scientific calculators.

However, that’s exactly the platform affected by new proof-of-concept malware that anti-virus researchers blogged about in the past week.

Now, before I ruin the summer vacation of every calculus teacher in America, let me clarify that the virus has no way of spreading through the air from one calculator to another – it’s harmless, and just proof-of-concept code at that.

Called Virus.TI.Tigraa.a by Kaspersky and TIOS/Tigraa by McAfee, the malware is less than 500 bytes and affects the Texas Instruments TI-89 graphing calculator with Motorola processor. It clears the screen and posts a message reading “t89.GAARA.”

It’s noteworthy not because of its destructiveness, but because it can attack another device with just enough memory to host a virus and no security to protect it.

“Of course, Tigraa.a is classic proof-of-concept code. It’ll only work on individual calculators, and can’t spread. But nevertheless, it’s created another entry in the roll call of potentially infectable devices.”
-Denis Nazarov, Kaspersky Lab’s Viruslist.com Analyst’s Diary.

“This incident would not be worth mentioning, but it prompts me to emphasize on important point. More and more mobile devices (pocket organizers, smartphones, internet tablets, calculators, etc.) receive enough computing power and not enough security features to create breeding ground for malicious code. We urge developers for all mobile devices to make necessary investment into securing the environment into securing the environment they create. Prevention is always better than a cure!”
- Igor Muttik, McAfee Avert Labs Blog

We reporters finally caught on this week to Google’s latest (or so it was before the just announced FeedBurner buy) acquisition.

The biggest name in Mountain View, Ca. picked up one of its neighbors, web-browsing security vendor GreenBorder, on May 11. But because the purchase was announced only in a few paragraphs on GreenBorder’s website, it failed to get the attention of, say, Google’s DoubleClick acquisition announcement of a few weeks back.

Once it hit the wires, it stirred quite a bit of curiosity from bloggers, who wondered just how security-minded Google was planning to become.

Here are a few samples:

“I have mixed feelings. Google will undoubtedly revolutionize the way malware can spread, stop it in its tracks, warn businesses before it gets to their networks release patches in real-time, etc. There is also an argument that Google allows phishing and needs to be fixed before it starts playing policeman. This is largely a moot point in an organization this size, but it would be good for show. OK, so from a pure security standpoint, it should be a good thing.

Google will undoubtedly sink money into other areas of security, and huge amounts of it. This is something which could ruin it for me. I enjoy working in startups. I enjoy working in Europe. I enjoy having a unique view of the security market, and access to businesses on both sides of the pond. Google could severely dilute this for me. So from a personal standpoint, this might be a bad thing.”
- Rob Newby, IT security, the view from here.

“I remember playing with GreenBorder back when it first came out. My concern was would you be able to do everything you normally do while browsing and would it slow down your browsing. In any event, I would imagine as the article I read said that Google will offer this for free now. this could be just the first step by Google into security. It will be interesting to see how they use this and where they go from here. Maybe now we know why they started a security blog What will even be more interesting is how the established security vendors react to Google coming onto their turf. Security is increasingly becoming a game for the big boys, but it is smaller companies like GreenBorder that fuel innovation.”
-Alan Shimel, StillSecure, After All These Years.

“So could this mean more security acquisitions in the future? I hope so, I’d like to see eEye Digital Security get bought for a decent price so my shares will actually be worth something.”
- Security-Protocols

“Some see Google’s acquisition of GreenBorder as their first entry into the security market, and while that may technically be true, this is really a pre-emptive move by Google to secure Web 2.0 apps before security becomes a barrier for them. What better way than to sandbox the browser, much like many SSL-VPN connections do, to help secure the environment the web operates in from malware. Smart move on Google’s part, and even better for not relying on Microsoft to do this for/to them. (Take note, Microsoft).

“Will Google move further into security by offering AV, firewall or other traditional security products? It’s possible (and they’ve surprised us before) but I think not. GreenBorder is a tactical move in their Web 2.0 strategy for providing online web apps, not about Google becoming a true security play.”
- Mitchell Ashley, The Converging Network

As reports that Google will acquire FeedBurner for $100 million abound, the search engine’s ears were likely burning for another reason this week: a handful of security bloggers were accusing the company of working with Dell to install spyware-like software on PCs.

David Ulevitch, OpenDNS’ founder and CEO, caused much of the stir on Tuesday when he posted that “Google and Dell have teamed up to install some software on Dell computers that borders on being spyware. I say spyware because it’s hard to figure out what it is and is even harder to remove.”

In short, when users type incorrect information into their URLs, they’re redirected to a page filled with sponsored advertising links by the tool installed on Dell PCs. Fair game or not?

Here’s some reaction from around the web:

Jon’s Network:
“If the craplets weren’t enough to keep you from buying computers from Dell, Sony, HP et al., this spyware-like behavior by Dell and Google might convince you. The average user doesn’t even notice this though, so who cares. Vendors will keep doing this because it works.”

Marcin Wielgoszewski at ts/sci security:
“They’re simply redirecting invalid DNS requests to their own page. When you use OpenDNS, they redirect mistyped queries to their own page as well. OpenDNS is having a fit because it’s competing with their revenue stream, powered by Yahoo.”

Add another IT security blog to the list (after all of the SC Magazine Blogs, of course). Google launched its own online security blog this week.

It’s bound to be met with some cynicism – ask Microsoft about some of the feedback it’s received for efforts to make headway on security issues.

But the Google Online Security Blog is off to a good start, detailing the recent study by the Mountain View search giant that was often misrepresented in the business press to say that a full 10 percent of the World Wide Web is malicious. Today’s post by Panayiotis Mavrommatis and Niels Provos of Google’s Anti-Malware Team puts the figure closer to 0.1 percent.

Considering some security issues Google has faced lately, we’ll be sure to keep an eye on it.