MacRumors has posted research from a team at Indiana University who have discovered a very serious security issue with iOS and OS X:
A team of six researchers from Indiana University, Georgia Tech and Peking University have published an in-depth report exposing a series of security vulnerabilities that enable sandboxed malicious apps, approved on the App Store, to gain unauthorized access to sensitive data stored in other apps, including iCloud passwords and authentication tokens, Google Chrome saved web passwords and more.
Oh joy. So much for Apple products being secure. If I were you, I’d take the time to not only read the article but to watch the YouTube videos in the article. It’s detailed and a bit technical, but it will open your eyes. So will this:
Lead researcher Luyi Xing told The Register that he reported the security flaws to Apple in October 2014 and complied with the iPhone maker’s request to withhold publishing the information for six months, but has not heard back from the company since and is now exposing the zero-day vulnerabilities to the public. The flaws affect thousands of OS X apps and hundreds of iOS apps and can now be weaponized by attackers.
What is with companies not addressing security flaws like these in a timely manner? I say that because just yesterday Samsung was accused of not acting quickly to address a serious security issue. I say that if companies don’t want to do this as a part of their normal business practices, perhaps legislation or lawsuits might be the way to go?
Apple Says Fixes On The Way For Recently Discovered Vulnerabilities
Posted in Commentary with tags Apple, Security on June 20, 2015 by itnerdYou’ll recall that earlier this week a team of researchers discovered some serious vulnerabilities in iOS and OS X that could allow all sorts of really bad things to happen to users. Plus Apple appears to have done nothing after having six months to fix these issues. Well, Apple has popped up and said that fixes are on the way. In a statement provided to iMore, Apple confirmed that they knew about these vulnerabilities and then they said this:
“Earlier this week we implemented a server-side app security update that secures app data and blocks apps with sandbox configuration issues from the Mac App Store. We have additional fixes in progress and are working with the researchers to investigate the claims in their paper,”
That’s great, but the real question is this: Why does it take six months and bad press to get the ball rolling to get fixes into the hands of users? Apple, would you care to answer that question as I am sure users of their products would be interested in that answer, and how you as a company can be trusted to keep users safe.
Leave a comment »