Haymarket Media, Inc.
Mobile Version Subscribe Contact Us About Us Advertising Editorial SC UK SC Aus/NZ
SC Magazine
  • Home
  • News
    •  Features
    •  Opinions
    •  Newsletters
    •  Sectors
    •  Company Moves
  • Products
    •  First Looks
    •  Reviews
    •  Group Tests
    •  About Reviews
  • Blogs
    •  The News Team Blog
    •  The Data Breach Blog
  • Buyers Guide
  • Whitepapers
  • Jobs
  • Events
    •  SC World Congress
    •  Awards
    •  Podcasts
    •  Digital Download
    •  Editorial Webcasts
    •  Vendor Webcasts
    •  eConference
  • Subscribe
    •  Newsletters
    •  Subscribe to SC
  • Issue Archive
  • Topic Center:
  • Email Security
  • Compliance
  • Patch Management
  • Financial Services
  • Health Care
  • Retail
Subscribe to our RSS feeds RSS | Login | Register  
Home > The IT Security Blog Roundup
The IT Security Blog Roundup

Moore unleashes iPhone exploits

time Posted October 17, 2007 * Comments(0)

Mega-hype = increased attention from hackers.

Researchers have proven that one since late July, since when the iPhone has been pulled apart by what must be the largest number of researchers ever interested in a mobile device.

And why not? The iPhone, after all, is a mini-computer – and one from a company known for not having the best relationship with the research community.

Renowned hacker H.D. Moore published some iPhone exploit code over the weekend. Here it is, if you want to take a look.

And please keep in mind, most experts have recommended fighting iPhone insecurity with policy, allowing the device only a very short leash within corporate environments.

Related Posts
  • What does the iPhone mean for security pros?
    Few people seem to know exactly what to make of the iPhone yet – other than to comment on how the ...
  • Another angle: iPhone scams
    Who wouldn’t want a free iPhone – or an iPhone free of a binding agreement to one voice service ...
  • Post-launch iPhone security concerns
    It’s a little too early to start wondering if, a decade now, you’ll ask your friends, “Where w...
  • A bug-hunting Safari begins on Windows
  • Harry Potter, and last week’s other IT security news

Filed under: Apple, Browser flaws, Consumer threats, Groundbreakers and newsmakers, High Tech, Mobile and Endpoint Security, Product News

Another angle: iPhone scams

time Posted July 5, 2007 * Comments(0)

Who wouldn’t want a free iPhone – or an iPhone free of a binding agreement to one voice service provider?

I would. But it’s likely that no such deals exist, unfortunately. But here are some details on scam emails and online advertisements that claim they do - as well as other swindles.

The PC Doctor’s Blog details recently discovered iPhone scams, one claiming “unlocked” iPhones are available on eBay.

“An iPhone but be free of AT&T? Dream on!
A number of “unlocked” iPhones seem to be on sale on eBay. Given that there’s no confirmed unlock method for the iPhone, their listings are either erroneous or deceptive. Many of the sellers, when questioned on this, seem to be retracting their statements about the iPhone being unlocked, but there’s still plenty of scope for buyers to be scammed into buying a phone that’s not suitable to their needs.”

- “iPhone scams to be wary of…” The PC Doctor’s blog, July 2

But the award for the most comprehensive webpage on iPhone scams has to go to ScamBusters.org, which predicts the top seven most common iPhone scams – updated post-launch.

“1. iPhone on eBay scams:
As we write the first version of this article on Wednesday evening, two full days before the launch of the iPhone, there are already 1,796 products listed when you do an eBay search for ‘iPhone.’

2. iPhone standing in line scams:
On sites like Craig’s List, as well as eBay, you can find many offers from people willing to spend the day standing in line for you - for a fee. The assumption behind these offers is that most Apple and AT&T stores will run out of iPhones, so those at the beginning of the line (who waited overnight or all day long on Friday) will be the ones to get the coveted iPhones.

3. iPhone scalper scams:
We expect that a lot of people will spend the day in line, buy an iPhone, and then try to sell it at a higher price. As we mentioned, some people will do this online at sites like eBay; others will sell their iPhones right outside the Apple and AT&T stores.

4. Free iPhones:
A few of these offers will no doubt be legitimate - but be VERY careful.
We’ve written about scams that use hot items (like designer handbags and plasma TVs) as lures to get email addresses and detailed personal information:

5. iPhone spam:
We predict an avalanche of iPhone spam. Most will probably offer iPhones at ridiculously low prices.
Our recommendation: NEVER respond to spam. As we always say, “If it’s spam, it’s a scam.” Don’t be tempted.

6. Fake iPhone websites and phishing scams:
We anticipate seeing lots of fake iPhone websites and phishing scams.

Many of these will probably be well done, and will look like the Apple online store or the AT&T website. Others will claim that you have purchased an iPhone and there was some kind of problem with your order that you need to correct.

7. iPhone viruses, trojans and spyware:
With the popularity of the iPhone, there is no doubt that we’ll see viruses, Trojans and spyware that use images, other attachments, or other iPhone-related information as bait.

Our recommendation: Never open attachments from people you don’t know or that you aren’t expecting. Keep your anti-virus software and anti-spyware software up to date. Use a firewall.”
- “iPhone scams: ScamBusters.org predicts the Top 7 iPhone Scams,” ScamBusters.org, updated July 3

Related Posts
  • Moore unleashes iPhone exploits
    Mega-hype = increased attention from hackers. Researchers have proven that one since late July, si...
  • What does the iPhone mean for security pros?
    Few people seem to know exactly what to make of the iPhone yet – other than to comment on how the ...
  • Post-launch iPhone security concerns
    It’s a little too early to start wondering if, a decade now, you’ll ask your friends, “Where w...
  • IRS, Better Business Bureau phishing scams have Chinese roots
  • A bug-hunting Safari begins on Windows

Filed under: Email Security, Emerging Threats, High Tech, Manufacturing, Phishing, Product News, Spam

Post-launch iPhone security concerns

time Posted July 2, 2007 * Comments(0)

It’s a little too early to start wondering if, a decade now, you’ll ask your friends, “Where were you when the iPhone went on sale?” But that doesn’t take away from the fact that Apple’s latest and greatest gadget launch was an unqualified success - at least in terms of living up to the hype.

Scammers have also had their turn with iPhone madness, sending out scam emails that download malware or try to acquire financial information from recipients.

The researchers are hard at work as well, taking the iPhone apart and looking for any security vulnerability they can find.

Here’s some post-launch security analysis of the iPhone launch:

“Within hours of Apple’s introduction of the latest version of its Safari browser two weeks ago, the hacking community began reporting bugs they had discovered in the beta code. Today, the iPhone is likely to get even closer scrutiny from many of the same security researchers. Here’s a list of the top items on the typical iPhone hacker’s to-do list.

3. Take a Close Look at iPhone’s Networking Technologies
Because Apple hasn’t previously developed its own mobile phone, there is bound to be lots of new and possibly buggy networking code in the device. “One of the things we’ll look at as well is the new code that will have to be developed for a phone platform,” said Neel Mehta, a researcher with IBM Corp.’s Internet Security Systems division. “With any piece of new code there’s always a risk that there could be vulnerabilities in it.”

- Anand Vardhan, Anand Varhan: Flex Developer, July 2, “A hacker’s to-do list – iPhone”

“Yup. After waiting a day to get the darn thing activated, we found a bug within a few minutes. We are cheating, of course; it’s just the same bug we found earlier on Safari. Also, our Bluetooth fuzzer locks up the device, so that’s an interesting sign. (As we’ve said in the past, we’ll disclose all our bugs to Apple when they publish acceptable vuln handling guidelines).

The thing that interests us most, though, is that we think the iPhone is inherently more secure than competing smartphones (such as those based on Windows Mobile or Symbian). While Apple is slightly behind Windows on the desktop/server (that Samba bug still appears to be unfixed), it’s still light years ahead of the mobile vendors. The mobile market is completely screwed up right now: while carriers know about the widespread vulnerabilities in their phones, the carriers are unwilling to patch them…

At the same time, Apple is going to have the same problem that Windows has. While they may have better theoretical security, they are going to be a bigger target. Hackers know a lot more about breaking into Mac OS X than they do competing platforms like Windows Mobile or Symbian. Thus, even though Apple will patch sooner, they’ll also have more bugs to patch because of increased hacker interest.”
- Robert Graham, Errata Security blog, July 1, “Our first iPhone bugs”

Related Posts
  • What does the iPhone mean for security pros?
    Few people seem to know exactly what to make of the iPhone yet – other than to comment on how the ...
  • Another angle: iPhone scams
    Who wouldn’t want a free iPhone – or an iPhone free of a binding agreement to one voice service ...
  • Moore unleashes iPhone exploits
    Mega-hype = increased attention from hackers. Researchers have proven that one since late July, si...
  • A bug-hunting Safari begins on Windows
  • SC Magazine launches The Breach Blog

Filed under: Apple, Browser flaws, Consumer threats, Email Security, Emerging Threats, Groundbreakers and newsmakers, High Tech, Mobile and Endpoint Security, Phishing, Product News, Vulnerabilities

time The IT Security Blog Roundup

Search This Blog:  


Categories
  • Apple
  • Breaches
  • Browser flaws
  • Compliance
  • Consumer threats
  • Education
  • Email Security
  • Emerging Threats
  • Finance
  • Google
  • Government
  • Groundbreakers and newsmakers
  • High Tech
  • Industry Reports
  • Lawbreakers
  • Legal and Professional Services
  • Manufacturing
  • Mergers and Acquisitions
  • Microsoft
  • Mobile and Endpoint Security
  • Non-Microsoft Patches
  • Patch Management
  • Patch Tuesday
  • Personnel Moves
  • Phishing
  • Privacy
  • Product News
  • Rootkits
  • SC Magazine
  • Spam
  • The Insider Threat
  • Trojans
  • Uncategorized
  • Vista
  • Vulnerabilities
  • Worms
Authors
    Archives
    • November 2007
    • October 2007
    • September 2007
    • August 2007
    • July 2007
    • June 2007
    • May 2007
    • April 2007
    • Blogroll

      • Anton Chuvakin Blog
      • Computer Defense
      • Hacker Webzine
      • MacUser
      • Marco Ramilli’s Blog
      • Michael R. Farnum
      • SecGuru
      • The IT Security Guy
      • WordPress.com
      • WordPress.org
    Home | News | Newsletters | Products | Blogs | Lists | Jobs | Events | Subscribe | Contact Us | About Us | Advertising | Editorial | Subscribe to our RSS feedsRSS

    This material may not be published, broadcast, rewritten or redistributed in any form without prior authorization.

    Your use of this website constitutes acceptance of Haymarket Media's Privacy Policy and Terms & Conditions