iPhone Trojan Sign of Things to Come?

climber writes "Just days after the first scareware for OSX, researchers are pondering the problems of an iPhone exploit that could lead to larger issues. The Trojan pulls legitimate apps off the phone if you try to remove it, but it only infects iPhones that have 'been modified or opened through a security hole in the system.' Though this worm is more of an annoyance than anything else, it could be a proof of concept for a more serious attack. 'The fear is hackers may be experimenting and gathering research that will increase the dangers of a more malicious attack in the near future. It is clear at least one writer -- the author of this piece at Web Worker Daily -- thinks that the iPhone should be left on the dresser in the morning. She offers several reasons that the device isn't a good corporate tool.'"

Comments

What rock was she hiding under?

[dreamchaser]

She offers several reasons that the device isn't a good corporate tool.'"

It's not even a *bad* corporate tool. It's a consumer device and was never meant (in its current incarnation) to be used for corporate uses. You can't even get one if your AT&T number is registered via a business account. It's like saying "this plum isn't a very good orange."

Idiot.

Re:What rock was she hiding under?

[Anonymous Coward]

I'll bet you she's a good corporate tool.

Re:What rock was she hiding under?

[Reality Master 101]

It's not even a *bad* corporate tool. It's a consumer device and was never meant (in its current incarnation) to be used for corporate uses. You can't even get one if your AT&T number is registered via a business account. It's like saying "this plum isn't a very good orange."

I don't know about your world, but in my world I use what I buy wherever I want, without permission from corporate overlords who insist my device is only for specific purposes.

It's like saying "this plum isn't a very good orange."

I think a better analogy is buying a 500 HP sports car that could explode if you take it on the freeway, but comes with a little wink-wink tag that says, "this is for street use only."

Re:What rock was she hiding under?

[OECD]

It's a consumer device and was never meant (in its current incarnation) to be used for corporate uses.

Also, it does not toast my bread AT ALL evenly. I am sorely disappointed with my purchase!

Also, what does that link have to do with the rest of the summary?

Re:What rock was she hiding under?

[arminw]

.....It's a consumer device and was never meant.....

True, but even so, many executives have bought iPhones and ordered their reluctant IT dept. to support them. When the big boss speaks, most underlings do listen and try to please him/her. So, IT folks out there, you might as well figure on supporting the iPhone, even if Apple doesn't market it for corporate users. The big boss may come in sooner than you figure and DEMAND support for his/her shiny new iPhone.

Re:What rock was she hiding under?

[cbiltcliffe]

I know lots of people that aren't good corporate tools, too, but they still work in corporations.
Although I suppose I know a lot more people who in fact _are_ good corporate tools, so I guess it all balances out in the end.....

Re:What rock was she hiding under?

[Cro Magnon]

Same Old Stuff. IT should be used to supporting stuff that isn't ready for the Enterprise *cough*Windows*uncough*

Re:What rock was she hiding under?

[kellyb9]

This is an instance where I have to agree. Apple does a very good job of identifying specific problems and trying to create unique solutions for them. The iPhone was never designed for corporate use, maybe a future version will be, but at this point, it's a pretty stupid idea.

I am by no means Mac user, but I have to admire their creation of the Macbook Air. Here's another example where they said - here's the problem, people traveling - lets create something to make this process easier. This is really one of my major criticisms of MS, who always try to create the one machine that will solve all of our needs. Unfortunantly for Mr. Gates, there is a high overhead in this line of thought.

Re:What rock was she hiding under?

[Anonymous Coward]

You're right, but if you look at the reasons, most of them apply to a consumer device, too. (e.g. Lack of encryption is pretty wacked. The only reason Apple gets away with that in the market, is that their competitors are just as bad.)

One of the big lessons of the iPhone is that today's phones suck. The iPhone sucks too. But the iPhone -- a device made by a personal computer maker -- has also sent a message that wasn't being heard before: phones don't have to suck. If PCs can be make non-sucky, why not phones? Maybe in a few years, someone will address the we-don't-want-suckiness market.

Re:What rock was she hiding under?

[SatanicPuppy]

Like most of us are in a situation to make things like that compatible with existing systems?

Whenever someone comes to me with that sort of demand, I tell 'em I'll be glad to support it, whenever they buy the software/hardware appliance/developers license/whatever that I'll need to run to support it. And I am happy to do that, because that does fall under the realm of things that I can do, unlike waving the magic compatibility wand and recoding interfaces to support a platform that only just released a real api.

Re:What rock was she hiding under?

[webmaster404]

I didn't know that KDE had an app by the name of Kkkorporation guess Ill have to look at it...

Re:What rock was she hiding under?

[Bert64]

To support it? An iphone is a lot less hassle to support from a corporate perspective than other types of device such as blackberry...
It uses standard IMAP, with support for SSL.. Standard SMTP with support for TLS...
It can even VPN, using standard l2tp/ipsec.
You don't need any additional software, assuming you're running systems that support the appropriate standards. Yes, the iphone does have some shortcomings but being a hassle to support is not one of them. It's just a case of people being scared of what they don't know.

Re:What rock was she hiding under?

[arminw]

....... IT should be used to supporting stuff that isn't ready for .....

But isn't that the fun and interesting part of an IT job. Coming up with clever solutions that others have not already thought of and pre-chewed and partially digested is what makes the life of a real engineer challenging and fun. This includes supporting Windows, possibly in ways and with methods the folks in Redmond have not even dreamed up yet.

Re:What rock was she hiding under?

[mh1997]

I don't know about your world, but in my world I use what I buy wherever I want, without permission from corporate overlords who insist my device is only for specific purposes.

Of course I didn't RTFA, but I would guess is that they meant it shouldn't replace a crackberry as the standard corporate multifunction tool.

A corporation may not tell you what to use and where (although they can and do), but try taking it into a courtroom or other "sensitive" area and you will quickly find out that you cannot use what you buy anywhere you want.

Re:What rock was she hiding under?

[T-Bone-T]

Not I. My iPhone cost $400. The most basic phone in the store cost $150.

Re:What rock was she hiding under?

[Anonymous Coward]

I assume you've never seen or used a BES (Blackberry Enterprise Server) in a medium or large corporate environment.
Maybe the iPhone is easier if your corporation is less than 10 users and John is your trusted IT guy. Do that many companies really allow direct access to POP/IMAP/SMTP from the random internet to the corporate email system? You can fire up Thunderbird and connect to your companies email? Not a single place that I've worked has done that. Really.
One person can maintain thousands of crackberries from one console. "Maintain" means provision, destroy, deploy, maintain, monitor, manipulate, update, and configure all aspects of the device. You can even see who currently has a signal and when their device was last seen somewhere in the world and when it last sent and received email, feedback on if your changes made it to the device and the response, update passwords, encyption keys, service books, see if new policies were applied to the device, how many messages are queued for delivery, and email alerts to yourself or a syslog when a certain % of all of your users are not getting coverage or the queue backs up. You can erase and wipe out the units with tracking if the device got that signal or not.

Re:What rock was she hiding under?

[LifesABeach]

I have always thought that NOT being able to replace the battery was a bit of a Trojan.

Re:What rock was she hiding under?

[SatanicPuppy]

Shrug. It was more of an example, though I admit I was thinking of that goddamn Blackberry mail server when I did the post.

Re:What rock was she hiding under?

[tsa]

Like using Samba on a Linux box, you mean?

Re:What rock was she hiding under?

[Bert64]

Yes, you have to buy, install and maintain the blackberry software and hardware to run it on, in addition to your existing email server.
The iphone will work with virtually any existing mail server that supports imap, preferably with SSL.

As to putting smtp directly on the net, everyone does that, that's how you receive mail from the outside.
Putting imap directly on the net perhaps not, but as i said in the original post you can vpn... Even so, imap over ssl is no less secure than an https based webmail system which are fairly common.

But to clarify the original posting, assuming you've not already invested time money and effort in something else, supporting an iphone is easier.

It's also worth considering, how long can blackberry last? They are pretty much dependent on microsoft (they primarily target exchange, with some supports for notes/groupwise, the server still requires a windows system to run on), and yet microsoft are directly competing with them... If you're already buying microsoft, you can bet their sales guys will already be trying to sell you on windows mobile instead of a blackberry or iphone... Apple may be able to target non microsoft shops, or encourage places to migrate to apple servers for their mail, blackberry can't really do that since their offering depends on their competitor's products.

Re:What rock was she hiding under?

[stewbacca]

Man, that is so true. Every project manager at my work is "forced" to carry a Blackberry, but most of them have their own personal iPhones. I tried to get some desktop support for my iPhone (just iTunes and the USB cradle) and was laughed at, but the first PM that asked for it got it. Most PMs use their iPhones by choice and their Blackberry only because they have to.

Re:What rock was she hiding under?

[stewbacca]

Uh, I make less than, well lets just be conservative and say A LOT under 100k a year and I have an iPhone. I'm not rich, dude. And iPhones are only $399, not $800.

Re:What rock was she hiding under?

[stewbacca]

I'll give you a call in two or three years when my "Trojan" is activated then. I'm sure a 5 minute stop by any AT&T store will fix it (if I haven't already moved on to iPhone 3.0 by then).

Re:What rock was she hiding under?

[mini me]

iPhones are $800 in this country. But that is, in part, because Apple doesn't sell them here.

Re:What rock was she hiding under?

[Ash Vince]

For me the lack of a user changeable battery was a show stopper. With every phone I buy I also buy a spare charged battery. That way if one runs out wheil I am out and about I can just swap to a new battery and call whoever I was talking to back straight away. This beats the hell out of trying to find an apple store in a city you may not know and may not have time to piss about in.

I am a die hard Linux user who generally hates Microsoft products, but I could not wait for the Google Phone so I bought a Kaiser instead. Cost me a shitload more than an Iphone would have but is a much better device.

- As montioned above it has a user swappable battery.

- Supports decent encrypted WiFi so I can connect to my home and works networks with no reconfiguration needed.

- It can be used as a 3G modem USB for my laptop when I have no WiFI within range.

- I can run loads more off the shelf apps on it as PocketPC is a much more established platform.

- It has SDK's available now so I develop any new tools I need.

- It has a fold out qwerty keyboard with tactile feedback when a key is pressed.

- It supports MS exchange integration for email, tasks, calendar and notes.

- It doesn't crash anywhere near as much as I was expecting (It IS a microsoft platform after all).

- It supports data encryption on the device so if I lose it the info has cursory protection from prying eyes. (Note cursory, I know you could probably crack it in a day or two)

Like it or not these are key features for a large number of corporate customers with the exception of the keyboard, that was a key factor for me though.

The main plus point of the Iphone seemed to be that it looked pretty.

Re:What rock was she hiding under?

[dreamchaser]

I keep seeing these anecdotes about executives buying iPhones and demanding support at work. I have yet to see anything but anecdotes. I work and interface with executives within several major corporations and have not seen one single iPhone, nor any talk about them. They are all addicted to their crackberries or windows mobile smartphones and could care less about trendy things like iPhones.

Most director level and higher execs are rather hidebound. They don't rush out and grab the latest thing unless they see a reason to. There are exceptions, and I am sure some VP out there bought an iPhone, but there just is NOT any groundswell of demand for iPhone support in the enterprise environment.

Re:What rock was she hiding under?

[SydBarrett]

"Yes, you have to buy, install and maintain the blackberry software and hardware to run it on, in addition to your existing email server.
The iphone will work with virtually any existing mail server that supports imap, preferably with SSL."

The point is that plain IMAP just doesn't cut it for corporate use. The place I work at uses Domino with BES, just about anything you can do in notes can be done on the blackberry. Can plain IMAP also handle syncing contacts and calendar entries?

If something like Blackberry connect was available to the IPhone, this would be easy since we could just create a BES account, point it to the BES and be done with it.

The only people who tried to get support for their IPhones from were not execs. They already have the newest blackberrys, anything that it can't handle is done by their secretary.

Re:What rock was she hiding under?

[cthulhu11]

What exactly is the difference between a "corporate" tool and a "consumer" one? Nothing. It's all marketing, like trying to navigate Dell's mess of laptop models.

Re:What rock was she hiding under?

[onceuponatime]

Except that once you have the tunnel up and all the traffic is then udp the iphone will drop the link within 30 seconds of not having an active tcp connection working. And you can't get it to come up again automatically because the iphone software doesn't think the link is down and it gets out of link. This happens because the iphone drops the data link to the mobile operator so the udp packets don't travel there anymore. All of this means that you cannot use a vpn to collect you mail with because the minimum request time you can configure is 15 minutes (For mail). Bad implementation, you can use it to connect to an intranet to view pages from a website, but it would be nice to set up generic secure communications and you can't right now. I know this because spent a couple of weeks implementing this and testing it.

Re:What rock was she hiding under?

[LifesABeach]

Just a thought; I was thinking along the lines of what would happen if you find yourself away from a quick charge device, and if you had, a backup battery, then a simple 1 minute downtime switching to a powered battery could easily do the job.

Re:What rock was she hiding under?

[stewbacca]

Well, in my case, and what I believe to be a pretty common one, I have a charging dock on my computer at home and at work (and also one in my car). My iPhone has been good for around 10-15 hours per charge, so I doubt I'd ever find myself at a point where I needed a charge. It would be such a remote chance of ever being stranded without battery power that it wouldn't be worth lugging the extra battery around.

Also, I can't be sure, but I *think* the iPhone can charge off an iPod cable. There are no shortage of those going around.

And finally, if I lost power, oh well. I've gone 37 years previously without a cell phone so I can probably go another few hours without.

So FUD... and a non sequitur

[revscat]

'The fear is hackers may be experimenting and gathering research that will increase the dangers of a more malicious attack in the near future. It is clear at least one writer -- the author of this piece at Web Worker Daily -- thinks that the iPhone should be left on the dresser in the morning. She offers several reasons that the device isn't a good corporate tool.'

So the summary starts off being nothing more than FUD, and since that won't hold water descends quickly -- albeit nonsensically -- into a completely different topic.

I guess Zonk hates the iPhone. Or is looking for page views. Or something. *shrug* Whatever, none of this makes a lick of sense.

Re:So FUD... and a non sequitur

[morgan_greywolf]

So the summary starts off being nothing more than FUD, and since that won't hold water descends quickly -- albeit nonsensically -- into a completely different topic. Well, the second topic does make some sense as it shows that the writer of the article is someone with an obvious iPhone-hating bias.

Still, the iPhone is a consumer product, not an enterprise tool, and even Apple itself markets it that way. That's why it doesn't have any of the features she mentions as being lacking in the iPhone. And there's nothing wrong with that. As a personal communications tool for consumer use, it's fine. As a corporate enterprise tool, it sucks.

Maybe Apple will come out with a new incarnation with centralized management and seamless connectivity with OS X Server or something. That might just happen, too. But until it does, she's right, biased or not.

Re:So FUD... and a non sequitur

[Firehed]

Sounds about right. This so-called 'worm' is nothing more than a useless file - THAT YOU HAVE TO CHOOSE TO INSTALL - with a bad uninstaller script. It's about as much a worm as typing 'sudo rm -rf /' into the terminal because some stranger on the internet said it's a good idea (for the uninformed, it's a great idea, and definitely try it and give it your root password when prompted)*.

The only known actual exploit on the iPhone is the TIFF exploit that JailBreakMe.com uses for powers of good (which, while jailbreaking the phone, also patches the exploit it used to do so). People that didn't use that hack likely updated to 1.1.2 firmware, which also patches that hole.

No, it's (most irrelevantly) not a corporate blackberry replacement. It's not really perfect at anything, though I'll say that the solitaire game really lends it self fantastically to the touch interface. But unlike most multifunction devices which really half-ass everything, it does most things quite well and the sacrifices made are understandable and more importantly are not deal-breakers.

*Hey, I'm a stranger on the internet. What did you expect, candy?

Re:So FUD... and a non sequitur

[T-Bone-T]

In case it isn't clear to someone why this is fud:
The fear is hackers may be experimenting and gathering research that will increase the dangers of a more malicious attack in the near future.

That is a pretty murky statement, much like something a psychic would say.

Re:So FUD... and a non sequitur

[cmacb]

Sounds about right. This so-called 'worm' is nothing more than a useless file - THAT YOU HAVE TO CHOOSE TO INSTALL - with a bad uninstaller script. It's about as much a worm as typing 'sudo rm -rf /' into the terminal because some stranger on the internet said it's a good idea (for the uninformed, it's a great idea, and definitely try it and give it your root password when prompted)*.

Damn you!!

Re:So FUD... and a non sequitur

[Firehed]

Yes, exactly. And it's only the uninstaller that's damaging - the program itself is just useless. In order to be damaged by this, you have to, in order:
1) Jailbreak your iPhone
2) Add standard third-party sources
3) Download and install specific, known good third-party applications (the BSD subsystem and a few misc utils by Erica Sadun, I believe)
4) Manually add a third-party application XML feed (typing in the feed address by hand, as it's not listed under third party sources)
5) Find and download this application
6) Uninstall this application, which then (thanks to a bad uninstaller line in the XML) removes the apps from step 3

You can repair the damage fairly easily as well, by simply editing the XML for the installed apps, removing the ones that were damaged from that list (since their uninstaller fails as the files are already missing), and reinstall them. No damage is even done unless you uninstall the problem app, and the damage only messes up a select few third-party tools.

It's not quite as simple as someone with an EDGE/WiFi card in their laptop noticing your presence and zapping something to your phone over the airwaves, or even as simple as visiting a malicious website (though the latter is certainly plausible if you're running an un-jailbroken phone with 1.1.1 firmware or earlier).

Stuffed shirts

[russotto]

Yeesh. These guys give real meaning to the name "stuffed shirts". One disadvantage of the iPhone: with the competition, "users have little choice but to follow the corporate-mandated security routine." Blech. The prissy description of people trying to unlock the iPhone only confirms this. If they want a device which make 2008 feel more like 1984, I HOPE Apple's the wrong company to go to.

Re:Stuffed shirts

[Ferzerp]

You do realize that in many (most?) cases, we are mandated by law to protect our information on mobile devices with passwords/encryption?

I'm a huge advocate of personal freedom, but on an enterprise-class mobile device, support for centraly managed policy is a MUST to comply with HIPAA, SOX, etc.

1984 does not apply to a corporate environment, sorry.

Re:Stuffed shirts

[mckinnsb]

You do realize that in many (most?) cases, we are mandated by law to protect our information on mobile devices with passwords/encryption? Yes. You do realize the FCC already checked to make sure that Apple was following the law, right?
Ok. I was just checking. Look- if your employees buy an iPhone and bring it to work, you don't have to support them joining the buisness network. If they complain, tell them that the company didn't furnish them with an iPhone and it was their personal telecommunications purchase decision. You sound like Apple should be sued for releasing a phone that was intended for personal use just because people decided to bring it to work- and use it in work. Guess what? The responsibility , under HIPAA regulations, as far as your employees are concerned, falls with *the employer* and the *employees*, not the *systems they choose to run*. If you choose a faulty system, its your fault. I didn't see any Apple commercials with doctors talking about how well they could use their new tool to communicate to their nurses.

Re:Stuffed shirts

[Ferzerp]

I'm confused? What does FCC ok'ing the iphone as a radio device have to do with enterprise mobile devices?

When I said "we are mandated by law," I was speaking as a corporate IT worker, and not as an individual.

I was replying to a poster who was comparing IT security with the book 1984. There was no intent that anyone take it as anything but a statement saying that we really can't legally use iphones in that environment as they do not meet the minimum requirements that we must take to protect our data.

Re:Stuffed shirts

[spun]

Are you trolling or are you really that bad at reading comprehension? The GP was talking about SOXX & HIPAA, not FCC approval. And he was in no way implying Apple should be sued. He was stating that the iPhone is not set up to suit corporate environments because it can not be name/password protected and thus can not satisfy SOXX & HIPAA.

Re:Stuffed shirts

[Knara]

Also, I don't think you can brick the thing via centralized management, which is often a necessity for corporate devices.

Re:Stuffed shirts

[russotto]

I'm a huge advocate of personal freedom, but on an enterprise-class mobile device, support for centraly managed policy is a MUST to comply with HIPAA, SOX, etc.

You mean the dictates of Minihealth and Minifinance? Like I said, I hope Apple's the wrong company.

Re:Stuffed shirts

[mckinnsb]

*cough* I responded at work at a online/retail store and neglected to read the post that he was commenting on. Sometimes Slashdot's comment system doesn't allow for the greatest instant visibility.

trojans

[Anonymous Coward]

I was always taught that trojans were good things that you used so you wouldn't get viruses. Now you're telling me something different?

Re:trojans

[zulater]

You must be pretty new. This is slashdot. Which incidentally is much better at protecting against sex than any condom.

Curious

[Nom du Keyboard]

Curious how this only affects unlocked iPhones. Just who is that to the benefit of?

Re:Curious

[xannash]

If it only infects unlocked iPhones, then wouldn't it kind of make a person wonder as to WHO actually wrote the program to begin with. Funny that it won't infect phones that are following all of Apple's rules.

Re:Curious

[samkass]

Curious how this only affects unlocked iPhones. Just who is that to the benefit of?

The people writing the exploits. No one else benefits.

The "unlocking" is done through a buffer overflow vulnerability, which by definition is a security hole. If you've avoided the latest software updates because it "breaks" unlocking, what you're doing is avoiding the patch that "fixes" security.

So yes, if you intentionally leave security vulnerabilities open in your computers, then intentionally install this software (it apparently doesn't self-propogate), you'll get infected. That's not very surprising to me.

Re:Curious

[iminplaya]

...what with the stalwart reputation for standing up for their customers' civil rights in the face of NSA and FBI threats.

You can always buy a Nokia...

Re:Curious

[2nd Post!]

It isn't funny, at all. By not releasing an SDK for 6 months, Apple had a host of volunteer security testers search for every exploit, overflow, and vulnerability on the device (which they promptly fixed).

And of course, in the course of those six months, there are some people who have NOT patched their system against these vulnerabilities.

Re:Curious

[jacksonj04]

Oh for the love of God, not another /. "The corporations/government are out to get our freedom/data/money!" conspiracy. Perhaps it's just exactly the same as the vast majority of exploits for everything else with a processor, and it's somebody either proving a point or out to make a name for themselves.

There is of course an easy solution to the virus problem. Apply the damn patch, and if you want an open device you can play around with don't buy an iPhone in the first place!

Re:Curious

[DaggertipX]

That depends, do you consider usability a feature? Or are you yet another slashdot user that thinks that a user interface is no more than "pretty graphics"?

Sorry... I'm a UI designer, and posts like this almost make me froth at the mouth.

Re:Curious

[FrkyD]

Someone wake me up when windows mobile devices actually deliver the functionality they promise.

Re:Curious

[eggnoglatte]

That's right Apple will deliberately sacrifice their reputation of building devices that are safe from malware just to stick it to the handfull of geeks who have unlocked their cellphones. /rolls eyes/

Re:Curious

[samkass]

You're right, a virus that discourages users from hacking their iPhones and encourages them to download the latest firmware would be of absolutely no benefit to AT&T at all. I could never believe that they would have a role in such and anti-consumer move, what with the stalwart reputation for standing up for their customers' civil rights in the face of NSA and FBI threats.

I'm glad we agree that AT&T doesn't benefit. Viruses on AT&T iPhones does NOT benefit AT&T, its investment in the iPhone, or its brand. In fact, the MacOS's reputation for being completely virus-free would probably be an order of magnitude more valuable.

This trojan (I don't think it's a virus), by the way, doesn't seem to discourage users from hacking their iPhones, at least not that I can see. I don't know anyone whose minds were changed because of this. And a "hackable" iPhone really *is* just an iPhone where there is a known exploit/vulnerability in security. If you're worried about security, you've upgraded to the latest update for which there's no known jailbreak (because the security vulnerabilities have been patched).

Wrong

[MBCook]

1. It is not a worm. That would require it to spread
2. Software installed on systems without privilege levels (like the old days of DOS or OS 7) is allowed to do anything... duh
3. This isn't a flaw with the iPhone. Apple's way of installing applications may prevent this kind of stuff

Anything that starts with "replace the firmware of your device with this hacked firmware" can obviously cause you problems.

Re:Wrong

[LiquidCoooled]

Anything that starts with "replace the firmware of your device with this hacked firmware" can obviously cause you problems.

Isn't that what Linux advocates have been asking Windows users to do for years.

I best duck now, but the analogy is the same.

Re:Wrong

[Applekid]

Anything that starts with "replace the firmware of your device with this hacked firmware" can obviously cause you problems. I guess the idea is that the Apple Lockdown Experience that denies rightful owners of the iPhone the ability to run whatever code they wish specifically encourages hacks to open them up, and that these hacks are not inherantly secure so a malicious person can exploit it to their ends.

You can either lock the door and have your bad guys force themselves in or you could open it to the public and put a bouncer there to keep trouble out and give the kids what they want.

I reckon the SDK next month will pretty much take care of it, providing a sandbox for applications so that they don't intermingle with sensitive data without user permission.

Re:Wrong

[slyn]

Isn't that what Linux advocates have been asking Windows users to do for years.

I best duck now, but the analogy is the same.

Not at all.

Linux isn't a firmware. So the "analogy" you have dies before it even stands up. If you fixed your statement to "replace the OS of your device with this hacked OS", that would still be wrong (assuming the popular usage of the word hacked). Linux isn't "hacked" windows. It's something completely different. The two might be of the same software phylum (os), but they have are of completely separate classes and divisions.

I'm sure a Windows Mobile phone is more secure

[EmbeddedJanitor]

NOT!

If you think the Windows desktop/server security is bad you should see the Windows CE security! Again, MS have delivered an OS that was designed for a disconnected system (PDA) then tried to put a crappy fence around it to make it secure in a connected world. Too little, too late.

As for trojans, well no matter what OS you run, a dumb enough user with sufficient priviledges can always run a trojan. Nothing new here!

Doesn't this only support Apple's position?

[UnknowingFool]

but it only infects iPhones that have 'been modified or opened through a security hole in the system.'

Since the very beginning, Apple has told people not to hack the iPhone because it could endanger the functionality and security of the device. Those who did could suffer when Apple updated the firmware. Now it appears hackers have found a way to compromise the iPhone because it had been already been compromised. By the way, the first hack into the iPhone require physical access to the phone so it's not like you surfing in your coffee shop will get you a Trojan. Someone first has to steal your phone and then hack it for this Trojan to work remotely.

Re:Doesn't this only support Apple's position?

[anotherone]

That hole was patched almost instantly by Apple.

Re:Doesn't this only support Apple's position?

[elrous0]

That's what the faithless get for not believing in the Word of Steve. Question and ye shall perish, oh faithless heathens!! Repent, and Steve will forgive!

Re:Doesn't this only support Apple's position?

[Dan Nordquist]

Someone first has to steal your phone and then hack it for this Trojan to work remotely.

Or get you to install the firmware yourself from an untrusted source, which would be pretty much everyone who's installed a hacked firmware. (Unless they hacked it themselves...?)

Re:Doesn't this only support Apple's position?

[BitZtream]

For versions before 1.1.2, all you had to do was visit the appTapp website and it would exploit you, hack your phone, and install the icon to allow you to install other apps. This was done via a image library exploit ... so ... all the person has to do is send you an email or get you to visit a malicious website and they can do the same crap without your phone using 'hacked firmware'.

Of course, this is true for say ... oh ... every person on the internet at one point or another. Webbrowsers and email clients have holes, the iPhone is no different.

Dresser

[Fnord666]

From the summary

It is clear at least one writer -- the author of this piece at Web Worker Daily -- thinks that the iPhone should be left on the dresser in the morning. She offers several reasons that the device isn't a good corporate tool.'"

The author of the linked piece at Web Worker Daily said no such thing. In fact, the author didn't express a personal opinion one way or the other about the matter. The author was quoting a piecewritten by Benjamin Gray, who works for Forrester.

From the linked article

At least, that's the conclusion coming out of Forrester, whose analyst Benjamin Gray, lists 10 reasons why the iPhone is not yet ready to be an enterprise-class mobile device.

I will have to take the Web Worker Daily's word for it though, since I don't feel like ponying up $279 for a 6 page pdf.

Re:Dresser

[E-Rock]

It isn't a business device, but then I don't really think that's what it was designed to do in the first place. The iPhone doesn't play well with corporate data. POP e-mail isn't even available as a pull service from some companies and there is nothing to sync calendar data. All these business articles are trying to pit Apple vs RIM, where I see them as very nice manufacturers that are in different markets. Currently...

"dangers of a more malicious attack"

[Schraegstrichpunkt]

The fear is hackers may be experimenting and gathering research that will increase the dangers of a more malicious attack in the near future. So the summary starts off being nothing more than FUD, and since that won't hold water descends quickly -- albeit nonsensically -- into a completely different topic.

No kidding. News flash: If the iPhone is vulnerable, then the "dangers of a more malicious attack" are already there. The solution is to fix the iPhone, not to bitch and fearmonger about "hackers ... experimenting and gathering research".

Re:"dangers of a more malicious attack"

[Tsiangkun]

This only affects unlocked iPhones, so I assume by "fix", that you mean use as intended ?

Re:"dangers of a more malicious attack"

[Your.Master]

I don't think "unlocked" is the right word for a hacked iPhone. They were hacked through a security hole. So by "fix" he may well mean "close the security holes". You know. Fix the security bug.

Of course, people who hack it to hell and then don't ever upgrade again (in fear of bricking or whatever), their phones can't be fixed by their own actions.

Re:"dangers of a more malicious attack"

[die444die]

That security hole has been closed for a while, which is why you can find people trying to downgrade their iPhones back to 1.1.1 which will reintroduce the security hole, allowing them to jailbreak their phones again. The phones were infected when users who had already intentionally jailbroken their phones downloaded a new application from an unsafe software repository.

Attack of the Weasels

[Bullfish]

Sadly, this is another sign that as Apple products grow in popularity that they will attract the attention of the weasels. Whether or not the statements the weasels make hold any water, or whether or not the scares turn out to be true, the weasels are arriving.

Re:Attack of the Weasels

[mini me]

Luckily, history has shown us that as a product grows in popularity, something more obscure will appear that is better than the popular option. We (as in the /. community, people who typically aren't afraid to try new things) can all just move to it until it becomes too popular. Ad infinitum.

Re:This kind of racism is intolerable

[mrami]

Ah do decla-uh, Miss Daisy Mae, Ah believe Ah have found the solution to our impendin' labor shortage here on Daddy's plantation. Allow me to elaborate:

1. Find them unlocked ah-phones
2. ???
3. Profit, ah say, profit, there Daisy!

Re:This kind of racism is intolerable

[BadHaggis]

Crackers?! are you trying to imply all hacks/exploits are made by southern white americans aka rednecks? For shame!

Shame on you for implying that I.. I mean, southern white americans aka rednecks are smart enough to even figure out what an iPhone is!

Who do you trust?

[westlake]

Curious how this only affects unlocked iPhones. Just who is that to the benefit of?

That is a clever spin to put on a story whose moral is that you should download software only from sources you trust. The unknown hacker who unblocked your phone isn't always your friend-in-need.

Somewhat off-topic, but has it occurred to anyone here that services like Steam and XBox Live! are the models for trusted repositories of Windows software? That the "Linux advantage" of Click-And-Run could be very short-lived?

YAWN

[SeaFox]

It is clear at least one writer -- the author of this piece at Web Worker Daily -- thinks that the iPhone should be left on the dresser in the morning. She offers several reasons that the device isn't a good corporate tool.'"

Ah, so the exploit means you should not use your iPhone at all.

Oh, BTW, here's her little rant about how she thinks the iPhone is bad for business users. Not that it has any relation to the topic of iPhone exploits, just that she has you attention with a scaremongering article about iPhone security breaches so I'm gonna use this soapbox to my advantage dang-nabbit!

So when a Windows virus is released, does she believe everyone should leave their PC off until it's fixed? Yeah, I didn't think so.

Just another anit-Apple/iPhone troll. Nothing to see here, move along.

Ipod Touch

[Lacota]

Curious, I wonder if this exploit would also affect a jailbroken/"hacked" iPod Touch? Since they're running similar software, I would guess so.

She is right

[geekoid]

the blackberry is for the corporate tool.

yes, but

[EmbeddedJanitor]

only if you roll it out on a banana like they showed you in sex ed class.

That's a problem I always had as a teenager. It was easy to keep a condom in your wallet, but the banana got squishy after a couple of days and made an embarrassing mess.

Re:SLASHDOT SUX0RZ

[Anonymous Coward]

WARNING the above link is A GOASTSE LINK!!! Stop the maddness and visit GOASTSE BLOCKER 2.3.67

Re:I'm sure a Windows Mobile phone is more secure

[UtucXul]

Considering how often my Motorola Q (Windows Mobile 5) reboots, freezes, or loses the ability to make network (voice or data) connections, there isn't much time left for it to be vulnerable. If that isn't secure (for a Microsoft product anyway), I don't know what is. And, if the battery life gets any worse, I'll probably only have minutes a day where the phone can even be turned on, which will shorten the window of opportunity for malware to get at it even more,

Re:YAWN

[kellyb9]

iPhone isn't just BAD for business users. It simple isn't DESIGNED for business users. It's a smart decision really... there are certaintly different security concerns to take into account when it comes to businesses as opposed to private individuals.

Re:I'm sure a Windows Mobile phone is more secure

[Teifion]

I wish I had mod points, that's the funniest thing I've read all day.

let me clarify for the author

[SethJohnson]

She offers several reasons that the device isn't a good corporate tool.

No, YOU are the good corporate tool.

Seth

Re:I'm sure a Windows Mobile phone is more secure

[Stevecrox]

I've run a Windows Mobile 2003 SE and now own a Windows Mobile 5 PPC in the three years I've owned either one I've never actually heard of a Windows Mobile virus/trojan/malware. In fact the only virus/trojan/malware for the mobile platform I have heard of was for the Symbian OS system that was a "proof of concept" virus which propogated itself via bluetooth (requiring the user to accept the incoming file, open it and then install it.)

If the windows mobile platform is so insecure how come the media haven't been talking about it and if they have would you mind posting a few links where I can find out more?

like a worm on a hook

[Teflon_Jeff]

Anything that is this popular, by nature, will attract viruses. This is definitely the tip of the iceberg, and it makes me wonder how much experience people at Apple actually have at preventing viruses, once the world at large cares enough to target them.

Re:like a worm on a hook

[theurge14]

Do tell us more about this "security through obscurity" concept.

Re:I'm sure a Windows Mobile phone is more secure

[DaveWick79]

Considering that when I went to the Sprint store and they said the Q had problems with freezing and network connections, I'm not surprised - but I don't believe that has anything to do with Windows Mobile. My HTC phone works fine with Windows Mobile. I'll give you the battery life point - though again that has less to do with Windows Mobile and more to do with the amount of radios and antennas drawing power from these super smartphones every second you have it powered on.

iPhone for corprate folk?

[Gat0r30y]

If anyone can convince their IT department that their iPhone is for work, more power to you. But somehow I think they aren't going to be fooled by its email capability. They know your using it to watch movies and TV shows in your cube (at least thats what Ive been using mine for).

Re:iPhone for corprate folk?

[BitZtream]

Its a shame its got better email support than the blackberry or windows mobile :(

Oblig. Looney Tunes ref.

[BlackSabbath]

Foghorn Leghorn: "Pipe-Full-O-Fun kit number 7?"
Dog: "Pipe-Full-O-Fun kit number 7"
Foghorn Leghorn: "We have been flim-flammed!"
Dog: "Yeah! Hoodwinked!"

Good Corporate Tool

[neuroklinik]

The fear is hackers may be experimenting and gathering research that will increase the dangers of a more malicious attack in the near future. It is clear [that] at least one writer -- the author of this piece at Web Worker Daily ... is a good corporate tool.'

Silly

[homey of my owney]

As silly as me saying the pc should be left on the dresser in the morning...

Wait...

Re:SLASHDOT SUX0RZ

[PitaBred]

Is it a Firefox plugin or something? I can't seem to find any links on that page, just a picture of a gaping anus... help plz?

Sad or what ?

[artg]

.. the device can only check for new email every 15 minutes. If you're used to monitoring your new messages as often as you swallow, you may feel like you're constantly in a state of suspended animation. ... That means when meetings get rescheduled, you could miss notification.

Poor, sad woman. Chuck your Crackberry in the bin and go on a long holiday.

Re:Sad or what ?

[rabbit994]

Actually, when most people in a company are equipped with CrackBerries, people will send out stuff that has to be acted on within 15 minutes or it's useless. I admit that too many people are freaking addicted to devices but iPhone 15 minute pull email technology is too slow for business.

Re:Sad or what ?

[gnasher719]

Actually, when most people in a company are equipped with CrackBerries, people will send out stuff that has to be acted on within 15 minutes or it's useless. I admit that too many people are freaking addicted to devices but iPhone 15 minute pull email technology is too slow for business. I think these businesses severely underestimate the importance of being able to do a few hours of uninterrupted work.

Re:Yawn

[toadlife]

Awesome.

Re:I'm sure a Windows Mobile phone is more secure

[T-Bone-T]

It is funny because it is true. My iPaq is gathering dust now that I have an iPhone.

Phew! That was close.

[naturalog]

This makes me glad that I can't afford one. Or at least it makes me less envious of the people that can. No, wait. I'm still pretty damn jealous.

Only one of the stories bothers me...

[argent]

The metasploit attack, because that's a remote execute attack.

The rest of the stories are all things like "oh my god, the iPhone is vulnerable to social engineering too!". Or "iPhone apps run as root, just like Pocket PC and Palm apps!".

If the guy who submitted this article to Slashdot had the first bloody clue about security he'd have put the metasploit attack on the title and left everything else out.

shouldn't that be iphone hack hacked

[CottonThePirate]

So my iPhone that is all nice and unmodified has nothing to worry about, oh so the iPhone updated to the latest release hasn't been hacked, but an old one with unauthorized software and old firmware. This is just some wannabe getting media attention on the hot toy of the year. You may as well say that your pirated version of windows that fails WGA has holes because you can't get security updates for it. (I know, I know, It's just a slashrant, don't bother me with the facts of my statement)

The old "security by obscurity" argument

[jamrock]

This is definitely the tip of the iceberg, and it makes me wonder how much experience people at Apple actually have at preventing viruses, once the world at large cares enough to target them.

Oh yes, the tired old "security by obscurity" meme. Hasn't that been put to sleep as yet? OS X has been popular enough to have gained public mindshare and attract the attention of malware writers for some time now, and has attained a market share of about 8%. Why isn't it accounting for 8% of all infections? If it were easy to crack it would have been a long time ago, if only for the "l33t haxxor" recognition the writer of the first exploit would receive. Plus the fact that silencing the idiotic Apple fanboys would probably be a strong enough secondary motivation for even the most reasonable person to want to rub the zealots' faces in an OS X security hole (I'm looking at you Maynor and Ellch). Frankly, anyone who can shut up the Mac-Idiots should be nominated for the Nobel Peace Prize, or something. (Disclaimer: I'm a Mac user who detests Apple fanboys.)

Re:SLASHDOT SUX0RZ

[Anonymous Coward]

You're supposed to enter.

Remote Software updates must be authenticated

[Grampaw Willie]

Anything that is this popular, by nature, will attract viruses.

Yep. and so anyone who is designing electronics with the capability of receiving programming updates has got to consider how those updates are going to be authenticated. the method for this has already been developed and proven: all that is needed is an authorized PGP signature on all programming.

this stuff is not a game. pcs, the internet, cellphones -- these are business equipment for corporations, employees, and individuals

and all these people, I shall call them customers, -- have a right to clean equipment that functions in accordance with the manufacturer's specifications and has not been illegally modified with un-authorized programming

that un-authorized programs can be "injected" into these divices is a disgrace to the manufacturers, -- which are technical organizations which should know better.

I hate the thought of government intervention into any aspect of life but unfortunately that has been necessary in a number of areas. and it is looking more and more like that is the only way we are going to be necessary of the net.

Firmware/software backup?

[Killer Eye]

What is the embedded-device equivalent of a full system backup?

I don't have an iPhone, but if I ever acquire a device that complicated, I'd accept malware risks if all I had was some kind of a "device rollback": a way to periodically copy the device's software and firmware state. So once in a blue moon if your device is hosed, you plug in something to upload a previous unhosed state and you're back in business.

Wait a sec though...

[wsuschmitt]

Wasn't the whole iPhone scare done by an 11 year old? http://blog.psmxy.org/2008/01/05/warning-malicious-repo/ If it was, then I don't quite understand the "fear is hackers may be experimenting and gathering research that will increase the dangers of a more malicious attack in the near future" thought process if this whole thing was started by an 11 year old. Are there now roving gangs of pre-pubescent crackers out there that are going after my iPhone and to take over the world?!?!

Re:Love the tags on this story

[e4g4]

In other news, analysts say that the XBox 360 isn't ready for primetime in the corporate market. "Out of the box, all it does is play games," said one IT professional, "it won't even let you check email without installing a rootkit called 'Linux'." A security expert from Microsoft was quick to point out that, "when used as intended - the XBox 360 is very secure. When running a software firewall called 'Halo 3' and operated by a security technician who has earned the much touted 'Legendary' certification, you can rest assured your data is safe from parasitic aliens from outer space." Another security professional was less avid: "I think for now, the 360 should stay in the living room."

If I had mod points...

[zieroh]

If I had mod points, could I mod the entire article down?

Re:If I had mod points...

[zieroh]

I found a close (albeit symbolic) solution: I tagged the article as "stupid" via the Firehose.

Re:If I had mod points...

[sootman]

You know, it would be interesting if Slashdot let you do something like that--either use your mod points in the traditional manner, or use all five (maybe just 3) to mod down an actual article.

Ah, the virus-proof apple.

[caliburngreywolf]

Goes to show, the way to be virus-proof is to capture less than 20% of users (who bothers to ignore the 80% and go for the 20?) If there was a similar, but far more popular device, I'll bet the apple crowd would be happily touting the virus-proof iphone as their competitor sufferred attacks. Bad as Microsoft code is, it's the popularity that makes people attack it, similar to a trapper laying rabbit traps in a field, instead of bear traps. Far more rabbits, even if the bear's a juicier target.

Re:Ah, the virus-proof apple.

[mini me]

Linux has somewhere around 40% market share for servers. Apache has 60% market share for web servers. So, I guess that explains why all the server and web server viruses are for Linux and Apache. Oh wait...

The big mistake IMHO is ...

[Allnighterking]

The damn thing runs as root. With a Unix heart and privilege separation part and parcel, they ignored it and pulled a Lindows. Running everything as root. The fact that it only got, so called jail broken phones is a ruse. Once something real goes live... all bets are off.

Oh. And.

[Swift2001]

When Apple said, "Hey, you find a security hole to install third-party software, we're going to have to close the hole," everybody yelled and screamed. Now someone's using the back door that the hackers found. Well, as Gomer used to say, "Surprise, surprise." I wonder if the new software update closes that hole.

Re:Love the tags on this story

[Pojut]

Great post/sig combo :-)

Re:Corporate People are Tools

[danzona]

This post fails the Turing Test. Swift2001 is a machine (as if the name was obvious enough).

No human could take a post about a Trojan on an iPhone and turn it into a screed against Microsoft.

I've often wondered how many of the posters on /. are really bots that use some kind of keyword matching.

Re:So FUD... FUD and FUD

[sowth]

Considering that this is /. it's hard to believe the submitter is stupid enough to not know the difference.

??? Do you read at +5 or something? Since I've started using the new discussion system, I have had to read at -1 (apparently filtering doesn't work?), I am going to tell you, you are giving the slashdot user base too much credit.

I am seriously thinking of going back to the old discussion system just so I don't have to sift through all the troll / clueless / shill comments. Then again it would be nice to have my own little app to read slashdot...has anyone created a good open source app or python library for slashdot?

I disagree

[toadlife]

Privilege separation (in the classic UNIX sense) is designed to protect users from other users on the same system. It is certainly not meant to protect users from themselves.

As an IPhone typically only ever has one user, what purpose would it serve to deny that user from using any part of the phone?