The IT Nerd

This isn’t good.

ThreatPost is reporting that there’s a bug in iOS and OS X that allows AirDrop which is Apple’s ad-hoc file transfer system to write files anywhere on the filesystem of the receiving devices. And they don’t have to agree to accept the file transfer for bad stuff to happen. Here’s the details:

The vulnerability lies in a library in both iOS and OS X, and Mark Dowd, the security researcher who discovered it, said he’s been able to exploit the flaw over AirDrop, the feature in OS X and iOS that enables users to send files directly to other devices. If a user has AirDrop set to allow connections from anyone—not just her contacts—an attacker could exploit the vulnerability on a default locked iOS device.

In fact, an attacker can exploit the vulnerability even if the victim doesn’t agree to accept the file sent over AirDrop.

Dowd, founder and director of Azimuth Security, was able to use the vulnerability, along with some other tactics to bypass the code-signing protections on iOS. To do this, he used his own Apple enterprise certificate to create a profile for his test app that allowed the app to run on any device. Under normal circumstances, when the app is first installed on a new device, the device would throw up a dialog asking the user if she trusts the app. However, Dowd is able to suppress this prompt by installing an enterprise provisioning profile on the device and marking it as trusted.

Lovely, This attack is apparently mitigated – but not fixed in iOS 9 which is going to hit the streets shortly. But there’s apparently no fix in OS X at present.

My suggestion. Turn off AirDrop and only turn it on when you need it. That should provide some degree of protection. Plus it will give you back a few minutes of battery life too as the device isn’t constantly scanning for devices that it could AirDrop to. In the meantime, let’s hop that Apple comes out with a real fix sooner rather than later.

During Apple’s event last week, it was announced that watchOS 2 would be released alongside iOS 9 today. That’s apparently changed according to Tech Crunch who has a statement from Apple that says that the OS for the Apple Watch family is delayed due to a bug:

Apple has delayed the release of watchOS 2, which was expected to be available today to owners of the Apple Watch.

“We have discovered a bug in development of watchOS 2 that is taking a bit longer to fix than we expected,” an Apple spokesperson told TechCrunch. “We will not release watchOS 2 today but will shortly.”

I actually like this. After the gong show that was iOS 8 and OS X Yosemite which were both clearly kicked out to the world before they were ready for prime time, Apple clearly has learned from that and made the decision to hold the software back until it is actually ready. Kudos to them for doing what’s right.

I’ll posting a story on iOS 9 when that hits the streets, which should be around 1PM Eastern based on Apple’s recent track record.