When iOS 7 first hit the streets, one of the goals was to make it more secure than iOS 6. Now it turns out that one of those changes to make it more secure actually weakened it. Tarjei Mandt discovered the flaw and presented his findings last week at CanSecWest. Now if you read his blog post, it’s extremely technical. So I will make it as simple as I can for you. For a variety of security related reasons, iOS calculates randomly generated numbers and uses those. Now if the numbers can be guessed, their randomness is irrelevant, and the kernel which is key to the control of the the iOS phone or tablet can be hacked. The problem with the way iOS 7 does this is that it uses a linear recursion algorithm. This paper explains what this type of algorithm is. But if you’ve ever sung “99 bottles of beer on the wall” then you’ve experienced a linear recursion algorithm. It also highlights the weakness with this algorithm. It’s easy to guess if you figure out what should be coming next. Now Apple was at CanSecWest so it’s a safe bet that they’re aware of this. The question is, how long will it take them to fix it?
BBM on iOS has been a runaway hit from all accounts. But some users are experiencing crash issues since updating to iOS 7.0.3. It can crash when trying to send messages, photos or even just at startup. There’s been a fair amount of noise about this online. For example, check out the CrackBerry forums.
Now BlackBerry has identified the issue. Apparently BBM uses the “HelveticaNeue-Italic” font and it was removed in the 7.0.3 update. This is causing the app to crash. But this Tweet from BlackBerry suggests a fix might be imminent:
One of the things that Apple released yesterday was iOS 7.0.3. The question is, why bother installing it? There’s some very good reasons to do so. Here’s a list of the top reasons why you want to upgrade from most important to the less important:
It fixes a lock screen bug that I spoke of here where someone with physical access to the phone could dial non-emergency numbers along with a couple of other lock screen bugs. You can get the details on those bugs here.
The reduce motion option now reduces a lot more of the zooming effects that were apparently making people sick. So if you have reduce motion turned on, you’ll find that it works much better.
The issue with the motion co-processor that I spoke of here is fixed. So if you have an iPhone 5S, you should install this now.
It fixes issues with iMessage that some users were having.
It Fixes crash issues with iWork for iOS that I spoke of previously.
iCloud Keychain was added so that you can keep track of your account names, passwords, and credit card numbers across multiple devices. This really is only useful if you have updated to OS X Mavericks and/or all your iDevices run iOS 7.0.3. Having said that, it is a welcome addition.
To me, this makes it something that you should upgrade to as soon as you can. The process on the two iPhones that I did this on was painless, though you will have to go through a wizard to update your iCloud settings as well as enable iCloud Keychain. But it was done within 10 minutes or so.
If you’ve got something to add, please leave a comment and share it with those who read this blog.
All Things Digital is reporting that Crittercism has found that iOS apps are twice as likely to crash on the new iPhone 5s as they are when running on the iPhone 5 and 5c. The cause? The A7 64 bit processor:
Anytime there is new hardware or software release, we see issues,” Crittercism CEO Andrew Levy said in an interview. “Inevitably, over time, those issues get resolved.”
Levy said that perhaps the reason the iPhone 5s is seeing more crashes than the equally new iPhone 5c is that, while developers were able to check their apps for compatibility with iOS 7 during several months of beta testing, the new hardware wasn’t available ahead of time. The iPhone 5s packs a new 64-bit A7 chip and an M7 coprocessor, while the 5c is nearly identical, internally, to the iPhone 5.
So if you have an iPhone 5S, you can expect these problems to go away eventually if you have them.
Now from the irony department, Severalthreads on the Apple Support Communities forum have details of random reboots on the iPhone 5S while using Apple’s iWork apps, with the issue being signaled by the brief appearance of an all-blue screen which iPhone users are referring to as the “Blue Screen of Death” which is more commonly found on Windows PCs. Here’s a YouTube video of the issue:
The error can be temporarily fixed by turning off iCloud syncing for Apple’s Pages, Keynote and Numbers apps. But we’ll have to wait and see if there is a more suitable fix in any updates that come from Apple.
MacDailyNews is reporting that yet another lock screen bug has been found in iOS 7.0.2 to go along with the others that have discovered. This one can be replicated like this:
Swipe to the passcode screen.
Press Emergency and Cancel at the same time.
Then swipe up and hold from the bottom left right after the screen switches to activate the camera.
Pull the Emergency Call pane down (keep holding the camera button) until you can type the number you want.
Then press call repeatedly until the phone reboots into the call.
There’s also the usual video that’s been posted to YouTube that shows this:
Rumor has it that iOS 7.0.3 is coming out next week. Hopefully it addresses all of these and doesn’t introduce anything new.
iOS 7.0.2 was meant to solve a rather serious lock screen bug. The problem is that it’s introduced two new ones. Dany Lisiansky told iPhone In Canada about the bugs and posted videos of the bugs to YouTube. Here’s the first one:
This bug allows users to dial any number from the Emergency call screen, which is normally only allowed for 9-1-1 calls. Here’s how you do it:
Send a message to the iPhone / eject the Sim (or any other way to show a notification on the lock screen.)
Start swiping the notification, while swiping right swipe also the camera icon.
While you keep holding the camera icon, slide to unlock and press the Emergency call button.
Type a number in the emergency call.
Press 2-3 times, fast on the call button.
The SpringBoard will crash. (and you even able see the application behind the lock screen for a split of a second)
When the SpringBoard will start again, you’ll notice that there is an active call.
The second one that he’s discovered gives someone access to photos, emails and other apps to anyone that grabbed the handset. Here’s the YouTube Video:
Here’s how you do it:
Make a phone call (with Siri / Voice Control).
Click the FaceTime button.
When the FaceTime App appears, click the Sleep button.
Unlock the iPhone.
Answer and End the FaceTime call at the other end.
Wait a few seconds.
Done. You are now in the phone app.
You can protect yourself by disabling Siri from the lock screen.
If Apple is smart, they will quickly push out a fix for these that’s been QA’ed more aggressively. I say that because they’re really starting to look like chumps at the moment.
Remember that lock screen bug in iOS 7.0 that I told you about. Apple has now fixed it in iOS 7.0.2 and you can get the details here. Not that I needed to, but I have verified that the lock screen bug doesn’t exist in this build. But if I were you, I would not change the settings that I spoke of when I first posted about the lock screen bug last week.
The Verge is reporting that some users of iOS 7 have started to complain about motion sickness that is traced to the zoom and parallax effects that the OS brings to the table:
Apple’s new design style in iOS 7 has had plenty of detractors, but some may have genuine cause for complaint: the zooming and parallax animations across the new operating system have been giving some users bad cases of motion sickness. “The zoom animations … are literally making me nauseous and giving me a headache,” Apple forum user Ensorceled writes. “It’s exactly how I used to get car sick if I tried to read in the car.” Other forum users are reporting feelings of illness, eye pain, and dizziness as well.
Now I haven’t noticed this in my use of my iPhone with iOS 7 and neither has my wife. But I can see this happening with an iPad or iPad Mini running iOS 7. I’ll also note that I did find the parallax effect annoying and I documented how to turn it off. But you can’t do anything about the zooming.
Apple hasn’t responded to this at this time. But it would be interesting to see what they say if they do.
You might recall that a German group of hackers have claimed to have hacked Apple’s fingerprint authentication system called Touch ID. This has made many question how secure the iPhone 5S is. Before I get to how you can protect yourself from this, let us discuss the hack so you understand what this hacker group did. In reality, all they’ve done is use a method to clone fingerprints that has been used in the past with other biometric devices, which is as follows:
The fingerprint of the enrolled user is photographed with 2400 dpi resolution.
The image is then cleaned up, inverted and laser printed with 1200 dpi onto transparent sheet with a thick toner setting.
Finally, pink latex milk or white wood glue is smeared into the pattern created by the toner onto the transparent sheet.
After it cures, the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone.
It sounds like something out of a James Bond movie, but this method has been around for as long as biometrics have been around. This would likely be reserved for someone who has the technical ability and the equipment to pull something like this off and that includes getting your fingerprint and getting physical access to the phone for a long enough period of time to do this. The reality is that your average iPhone thief isn’t going to have access to your fingerprints, nor are they going to have the equipment and technical know-how to pull this off. Thus the iPhone that they just stole is a rather expensive paperweight. So from my standpoint, I would not invest a whole lot of time worrying about this hack.
But let’s say you did want to worry about it. How would you protect yourself seeing as you can change a password but you can’t change fingerprints? Your tendency when using a finger for this purpose is to use your index finger. Consider using your pinkie finger instead. Since it’s not commonly used for biometric purposes, it means it is less likely to be cloned. That would be the best thing that I would suggest to minimize whatever risk exists. But beyond that, there’s not really all that much that you need to do.
Is Touch ID perfect? No. There is not a biometric system, or any sort of security system for that matter that is perfect. However, I strongly believe that it will deter thieves from stealing these phones because if they cannot flip it for cash quickly, there’s no point in them stealing it. It’s a deterrent and a very good one that iPhone 5S users should not be afraid to leverage.
Is iOS7 Less Secure Than iOS6?
Posted in Commentary with tags Apple, iOS 7, Security on March 17, 2014 by itnerdWhen iOS 7 first hit the streets, one of the goals was to make it more secure than iOS 6. Now it turns out that one of those changes to make it more secure actually weakened it. Tarjei Mandt discovered the flaw and presented his findings last week at CanSecWest. Now if you read his blog post, it’s extremely technical. So I will make it as simple as I can for you. For a variety of security related reasons, iOS calculates randomly generated numbers and uses those. Now if the numbers can be guessed, their randomness is irrelevant, and the kernel which is key to the control of the the iOS phone or tablet can be hacked. The problem with the way iOS 7 does this is that it uses a linear recursion algorithm. This paper explains what this type of algorithm is. But if you’ve ever sung “99 bottles of beer on the wall” then you’ve experienced a linear recursion algorithm. It also highlights the weakness with this algorithm. It’s easy to guess if you figure out what should be coming next. Now Apple was at CanSecWest so it’s a safe bet that they’re aware of this. The question is, how long will it take them to fix it?
Leave a comment »