The flaw could enable a hacker to gain remote control of the device using the iPhone’s text-messaging capabilities. It works by exploiting a weakness in the iPhone’s SMS protocols and could allow cybercriminals to track the phone’s location by tapping in to its GPS features, remotely activate the microphone for eavesdropping, or transform the handset into a botnet used for sending spam or committing online crime, or instigating a distributed denial of service attack that could bring down a website.
Charlie Miller, a security researcher, revealed details of the vulnerability at a conference in Singapore. He said that he had made Apple aware of the problem, and the company was working on a fix. He said this meant he could not go in to specific technical detail about how the weakness could be exploited, but plans to expand on his explanations once Apple has issued the patch to remedy the problem.
Miller demonstrated how he could disconnect the handset temporarily from the network, potentially leaving it vulnerable to attack from third parties.
“I can definitely make the thing crash,” he said. “I have still to determine whether it’s actually exploitable or not. This thing has the potential to be really serious, but I’m still looking at it and Apple is still looking at it.”
via [Telegraph]
Miller said that despite this latest security loophole, the iPhone was more secure than Apple’s OS X based computers, because it did not support Flash or Java, two common vulnerabilities exploited by hackers on computers, and it only runs software that has been verified and approved by Apple.
Trackbacks/Pingbacks