Apple iPhone
Researchers have uncovered more problems with the design and implementation of security on the iPhone

Remote control flaw found in iPhone

Attackers could take complete control of the platform

Written by Iain Thomson

A team of security researchers in the US claims to have found a flaw in Apple's iPhone that could allow a hacker to take complete control of the device via Wi-Fi.

Independent Security Evaluators, headed by a former professor at Johns Hopkins University, found the hole last week, developed a patch and alerted Apple to the problem. 

"There are serious problems with the design and implementation of security on the iPhone," said the company in a Security Evaluation paper (PDF) on the flaw. 

"The most glaring is that all processes of interest run with administrative privileges. This implies that a compromise of any application gives an attacker full access to the device."

The exploit uses a web page with malware built in that can access the phone via the Safari browser.

This can either be used to force the phone to send personal information stored in its files or to take control of the device and make it place outgoing calls to other numbers.

"Unfortunately, once an iPhone application is breached by an attacker, very little prevents the attacker from obtaining complete control of the system," the team said.

"Additionally, no address randomisation is used in by the operating system. This means that each time a process runs, the stack, heap and executable code is located at precisely the same spot in memory. This helps attackers write reliable exploit code."

Experts have already warned that the phone may be as insecure as a PC because of its powerful operating system, and problems have already been reported with the dialler software

Matt Bancroft, vice president at mobile device management company Mformation, said: "All mobile phones are becoming more powerful, and the iPhone is really a sophisticated mini computer. 

"As we get more powerful mobile devices, it is inevitable that we will get more security issues and threats to mobile devices.

"The key is to manage the device once it is in the hands of the user. Being able to update or patch the security and applications over the air in an ever-changing environment is the way forward."

Tags:

reader comments

related articles

Apple iPhone

Special Report: Apple iPhone

All the latest news on Apple's iPhone 18 Dec 2007

 

iPhone 'may never be secure'

Power could be its downfall 18 Jul 2007

Zombie botnet targets iPhone buyers

'One of the most sophisticated' scams in recent times 16 Jul 2007

'DVD Jon' cracks iPhone activation

Hacker shows how to bypass AT&T sign-up 09 Jul 2007

Hackers start picking iPhone locks

Retrieval of passwords could allow installation of custom apps 04 Jul 2007

Web banking security flaws 'widespread'

Three out of four financial institutions at risk, claims report 25 Jul 2008

iPhone update thwarts hacks

New firmware disables SIM-hacked phones 28 Sep 2007

iPhone vulnerable to DoS attack

Apple's mobile browser flawed, claims security firm 16 Apr 2008

today's top stories

Analysis: Will IE8 cause more problems than it solves?

Microsoft's new browser may lead to compatibility issues and affect online advertising 29 Aug 2008

CIO morale plummets as crunch hits

Fewer opportunities and less responsibility depress IT managers 27 Aug 2008

The pIT stop Q&A: Should packaged software users adopt SOA?

Our expert panel answer readers' questions 29 Aug 2008

Computing podcast 28 August 2008

CIO job satisfaction plummets, and why schools' IT spending is set to top £1bn 28 Aug 2008

The definitive guide to collaboration

Five key technologies and five best practice tips to improve your collaborative IT 28 Aug 2008

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Jobs

Job of the week

Job alerts

Sign up here

Find your next job here

Advertisement

White papers

Search white papers

Top categories

VPN, Extranet and Intranet Solutions

WAN/ LAN Solutions

Network Security

Interoperability-Connectivity

Grid/ Utility Computing

Latest poll

Would you recruit a student with an IT degree?

Would you recruit a student with an IT degree?

As IT student numbers plummet - would you recruit an IT graduate?

Previous poll results

Latest audio and video articles

A stressed CIOAudio

Computing podcast 28 August 2008

CIO job satisfaction plummets, and why schools' IT spending is set to top £1bn 28 Aug 2008

Bryan Glick video whiteboardVideo

The definitive guide to collaboration

Five key technologies and five best practice tips to improve your collaborative IT 28 Aug 2008

Latest in-depth articles

Myron HrycykAnalysis

General management skills are now as important as technical ability

A selection of leading chief information officers talk about what they see as the most important aspects of the role 28 Aug 2008

Internet Explorer logoAnalysis

Analysis: Will IE8 cause more problems than it solves?

Microsoft's new browser may lead to compatibility issues and affect online advertising 29 Aug 2008

Primary Navigation