Two Unpatched Flaws Show Up in Apple iOS
The technique that the Jailbreakme.com Web site is using to bypass the iPhone’s security mechanisms and enable users to run unapproved apps on their phones involves exploiting two separate vulnerabilities.
Dennis Fisher
About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
Stuxnet Attack Shows Signs of Nation-State Involvement, Experts Say
SAN FRANCISCO–The Stuxnet attack has been making headlines for several weeks now, thanks to the fact that includes a pair of zero-day vulnerabilities and also has drivers signed by a stolen digital certificate. However, the real story of this novel malware attack may not be its tactics but its creator, which security experts say could be a nation-state.
Mobile Devices Drawing More Attackers’ Attention
As mobile devices such as iPhones, BlackBerrys, Android phones and others have become more sophisticated and easy to use, many users have made them their main computing and Web-browsing devices. And that evolution naturally has caught the attention of attackers who have begun tailoring more and more of their attacks at these mobile platforms.
A Web site set up to help iPhone users jailbreak their devices is using a flaw in the way that the iPhone handles PDF files to escape the phone’s sandbox security function and enable users to load applications that aren’t in Apple’s official App Store. The same flaw could easily be used to install malicious software in drive-by download attacks, experts say.
By Dennis FisherIn the year and a half since we first launched Threatpost, the site has grown very quickly, probably more quickly than any of us had even hoped it might. We’ve added a couple of regular podcasts, original videos, developed a stable of terrific regular contributors and recently launched our first on-demand video event. And now we’re making a major addition to our editorial staff.
Microsoft will issue an out-of-band patch on Monday for a critical vulnerability in all of the current versions of Windows. The company didn’t identify which flaw it will be patching, but the description of the vulnerability is a close match to the LNK flaw that attackers have been exploiting for several weeks now, most notably with the Stuxnet malware.
LAS VEGAS–A security researcher has found a slew of fundamental problems with the way that modern browsers are designed and built, leading to serious questions about the security of these applications and the way that they handle SSL sessions.
LAS VEGAS–Security technology and practice have advanced quite a bit in the past few years, but one thing that has become clear is that whatever gains have been made are just not keeping pace with the innovation of attackers. The advances being made by malware authors and crimeware gangs are keeping them well ahead of the curve and will continue to do so for the foreseeable future, researchers say.
LAS VEGAS–Apple has released a major update to its Safari browser that includes a number of security fixes, most importantly a patch for the AutoFill vulnerability disclosed recently.
A new change to the much-maligned Digital Millennium Copyright Act free users who jailbreak their iPhones and other mobile handsets from worries about prosecution under the provisions of the DMCA that prevented circumvention of protection technologies. A separate change announced Monday also gives security researchers some new protections.
