Slashdot Mirror
Backdoor Malware Targets Apple iPad
An anonymous reader writes "Apple iPad users are being warned of an email-borne threat which could give hackers unauthorised access to the device. The threat arrives via an unsolicited email urging the recipient to download the latest version of iTunes as a prelude to updating their iPad software. Apart from opening up a backdoor, it also tries to read the keys and serial numbers of the software installed on the device, and logs the passwords to any webmail, IM or protected storage accounts."
This DOESN'T infect the iPad at all. It targets the idiots who bought an iPad but it is a WINDOWS virus.
See here for further details : http://www.theregister.co.uk/2010/04/26/ipad_backdoor/
Is it common for software to announce updates via email? Given that the device would presumably have a net connection, any legit updates ought to be pushed out through the iTunes store.
It's not just the headline, it's the summary and the article too!
This does not actually affect the IPad but rather is an attack to get Windows users to install an "update" for ITunes. The "update" is malware for Windows and is targeted at people who own an IPad and sync it with Windows.
Great quote from the UK article: "Since buyers are likely to have a lot of disposable income and not much sense...." TFA is wrong - malware is aimed at the Winbloz boxen, by offering a download of a "new iTunes" program. Macs and iPads are not impacted.
Yes well, this virus is infecting a Windows PC, so much for that.
An e-mail, purporting to be from Apple, informs people that their iPad needs to be updated. Steps given for updating your iPad:
1) Download an iTunes update for Windows (itunes.exe) and install;
2) Connect your iPad to the Windows computer;
3) Select iPad in the iTunes sidebar;
4) Click “Check for update” then “Update” to finish updating your iPad’s software.
Note that there’s no legitimate reason that you’d ever need to connect the iPad to a second computer to update it. It has its own internet connection.
Needless to say, your Windows computer will be infected with the virus if you execute the itunes.exe that you were instructed to download and install. It appears that your iPad will be none the worse for having an idiot for an owner.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Reminds me of that line from "Absence of Malice" that "everything they said was accurate but none of it was true".
I'm disappointed that there have been no Apple User/Backdoor jokes in this story yet. I'll check back in an hour. Don't kill my faith in /.
"I don't have to think. I only have to do it. The results are always perfect, but that's old news." - Meat Puppets
Note that there’s no legitimate reason that you’d ever need to connect the iPad to a second computer to update it. It has its own internet connection.
Now, I don't have an iPad, so I don't know how they're updated, but the iPhone and iPod touch, which also have their own internet connections, get software updates through iTunes, over USB.
This is how it's always been done.
Dan Aris
Fun. Free. Online. RPG. BattleMaster.
The target isn't the iPad, it's the windows box.
It targets the iPad, it's just a really bad shot and always ends up hitting the Windows box...
I am TheRaven on Soylent News
If you want to get really pedantic, the target isn't even the Windows box. It's the user's information and the profits that can be gleaned either directly or indirectly from aggregating such information from millions of such users.
I'm guessing that the rationale behind this is that people who snap up the iPad are trend-following sheep with more money than sense who are "easy marks" and thus more likely to fall for a "social engineering" attack such as this one.
Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
the con targets iPad users. the software targets windows.
Not just the summary. The article itself is misleading (it doesn't once mention that the virus effects Windows PCs and not iPads). This one: http://www.tgdaily.com/mobility-features/49519-nefarious-ipad-virus-masquerades-as-itunes-update is slightly better, as it doesn't fail to mention the fact that Windows PCs are being infected and not iPads. The iPad is only the phishing-hook to get a user to click the link (something like: you need to update your iTunes for your new iPad, click here to do so...)
Oh, sorry richy freeway, just saw that you said "and the article." It's too early in the morning.
Actually, all of the devices in the platform do allow app upgrades over their own connection. You *can* use iTunes and USB, but apps 10MB or you don't have carrier data you can upgrade them over wifi. The app store icon will even notify you when there are upgrades available.
Yes, for apps. Not for the OS itself, which is what was being talked about.
Dan Aris
Fun. Free. Online. RPG. BattleMaster.
It's not just the headline, it's the summary and the article too!
You must be new here.
Nicely expanded upon anyway. :)
Just like the iPhone right????
Whoops!
http://en.wikipedia.org/wiki/File:IPhone_sales_per_quarter.svg
There are two types of people in the world: Those who crave closure
Back door? Hell, there isn't even a front door into iPads!
Mac OS X on a MacBook Air is running from flash memory, just like iPhone OS on an iPad. What exactly did you mean by "running from firmware"?
Note that there's no legitimate reason that you'd ever need to connect the iPad to a second computer to update it. It has its own internet connection.
Er, just like my iPhone? Which requires being connected to a second computer to update it?
Please help metamoderate.
I enjoy skulking here because the community is damn witty and I am often entertained and informed by what I read, but the editing of stories for any basis in fact has gone from inept to transparent troll-baiting and flame-generating. We all know some of the editors are idiots, but, come on Taco, I know you can do better.
This is a virus that targets Windows and somehow it provides proof that people who buy the iPad are "trend following sheep"?
In what way does this have anything to do with the iPad? the fact that it can be used to receive email?
Fucking morons.
What if someone wrote a virus that automatically jailbroke any apple device connected to iTunes and installed an alternate way of putting apps on the device?
The title of the article should read, "iPad owners take it in the backdoor!" haha
You have to download the trojan named itunes.exe and run it.
This is a "virus" now? What do you call stuff that spreads itself without user intervention... trojans?
How about autorun infections from USB keys... phishing?
Cwm, fjord-bank glyphs vext quiz
Comment removed based on user account deletion
I propose the name of the patch to cover this hole be named tamPod.
Either kdawson didn't feel like logging in to post this article as himself, or CmdrTaco isn't looking into stories. Too bad.
wth? AC nerd rage much? you felt the need to drag another thread into this one?
You left your terminal logged in and kdawson has been posting stories under your ID again.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Until Jobsy releases version 4, no virus is gonna run (in the background anyway).
Of course the iPod/iPad/iPhone is more secure ... you can't do fuck-all with it without permission from Apple headquarters ... and even then any virus must be written in Objective-C to conform to Steve's code "laws".
More to the point, the virus never TOUCHES the iPad, or even it;s files on the Windows machine. The iTunes trojan only affects AIM, Messenger, and other application software on the PC, and attempts to steal PC passwords, it;s only using the iPad in name as a method of social engineering, and its technically not even infecting iTunes!
There is no contest in life for which the unprepared have the advantage.
Until Jobsy releases version 4, no virus is gonna run (in the background anyway).
Of course the iPod/iPad/iPhone is more secure ... you can't do fuck-all with it without permission from Apple headquarters ... and even then any virus must be written in Objective-C to conform to Steve's code "laws".
And so the myth continues. Because the iPhone/iPad is locked down then it must be secure. Thing is, it wasn't secure and it was because of that lock that people couldn't secure it. It was also the only smartphone that didn't get patched for it even though Apple had been warned for weeks before to patch it and it took 48 hours after it went public to patch. People complained, most didn't know why they had to restore their iPhones though because they didn't even need to touch anything. In the end, iPhone users were hacked and it was because of it being locked down. (If you had jail broken it, you could have prevented it from happening)
Attention... all grammer nazi"s! Is they're anything; wrong with: my post,
Your right :) I saw the story early somewhere else and did not even bother to read the summary after the headline that implied there is a backdoor into ipads.
It does have a back door, its build in the OS from Steve Jobs since its running a spin off of the iPhone's OS. 1 2
Attention... all grammer nazi"s! Is they're anything; wrong with: my post,
The vulnerable user demographic are *Windows users* of the iPad, not iPad users in general.
No, it's not. You're remedial reading classes start at 7pm tonight. Don't be late.
If I didn't have absolutely NOTHING to do, I wouldn't be here.
Note the removal of the word "more" by the parent poster. Of course the GP is right. The iPhone/iPod/iPad is most certainly more secure due to it's locked down nature. But that doesn't mean completely secure.
As to the example exploit, one SMS defect can cause a denial of service for 2 seconds per SMS. Given that SMSs have to be paid for, that's going to cost the attacker a lot of money. The other crashes the coms stack, such that the GSM connection is lost and can only be regained by rebooting the phone. Neither one can cause any permanent change to an iPhone of any sort. Nor can they be used to steal information. And a patch was issued within days of the vulnerability being discovered.
Thats the WORST case you can find. You can find far worse exploits for open systems. Which rather supports the GPs case.
Note that this is another Windows virus that affects only Windows PCs. .exe files used by virus writers to perpetrate
It does NOT affect iPads or any Mac products.
BitDefender is likely using the iPad's popularity to widen
their Windows anti-virus audience. Most everyone knows
that Macs do not use
Windows viri. Nice attempt at publicity!
What's past is NOT ALWAYS prologue for the future!