IOS glitch leaves some Cisco gear open to attack
562926
A software vulnerability in some Cisco Systems Inc. routers and switches could allow an attacker to cause the devices to hang, the vendor warned this week.
384185
Unlocking the iPhone is proving to be more difficult than some hackers had expected.
750699
Bundle of fixes includes patch for zero-day Wi-Fi hijack flaw and other bugs, some that could let an attacker commandeer Macs.
421569
By JORDAN ROBERTSON SAN JOSE, Calif. - Cisco Systems Inc. and Apple Inc. said Wednesday they have settled the trademark-infringement lawsuit that threatened to derail Apple's use of the &quot;iPhone&quot; name for its much-hyped new iPod-cellular phone gadget.
597294
MENLO PARK, California  - A well-known hacker  claims to have overcome restrictions on Apple Inc.'s   iPhone, allowing highly technical users to bypass AT&T Inc.'s  network to use the phone's Internet and music features.
451531
Code that takes advantage of a Safari flaw could leave an iPhone open to attack.
320036
(InfoWorld) - Three security researchers claimed Sunday that they have found the first exploitable vulnerability in Apple's iPhone, a flaw that allows them to steal any data from the device or even to turn it into a remote surveillance tool. The trio -- Charles Miller, formerly with the National Security Agency; Jake Honoroff; and Joshua Mason of Baltimore-based Independent Security Evaluators (ISE) -- have notified Apple of the vulnerability and given the company less than two weeks to fix the bug before Miller presents more information at the Black Hat conference on Aug. 2. According to a paper posted by the three, they rooted out a vulnerability in the iPhone's version of Safari using "fuzzing" tools and wrote a proof-of-concept exploit that can be delivered from a malicious Web site or using "man in the middle" tactics to trick users into connecting to a malicious wireless access point. Once the exploit runs, it's essentially game over, the researchers said: The iPhone is owned. "In our proof of concept, this code reads the log of SMS messages, the address book, the call history, and the voicemail data," the researchers wrote on the ISE site. "It then transmits all this information to the attacker." But wait -- there's more! That, however, could be just the beginning. The researchers claimed that a second exploit actually operated the iPhone remotely once the device was hijacked. "When we viewed a second HTML page in our iPhone, it ran the second exploit payload which forced [the iPhone] to make a system sound and vibrate for a second," they said in the paper. "Alternately, by using other API functions we discovered, the exploit could have dialed phone numbers, sent text messages, or recorded audio (as a bugging device) and transmitted it over the network for later collection by a malicious party." The vulnerability was reported to Apple last Tuesday, July 17. "We proposed a fix Apple could include in a future iPhone update," the researchers said, "but we don't know if they plan to do so. They responded and are looking into it." In an e-mail late Sunday night, Apple spokeswoman Lynn Fox would only say: "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We're looking into the report submitted by I.S.E. and always welcome feedback on how to improve our security." She declined to answer questions about the Aug. 2 deadline, whether Apple would issue a patch before then, or what the company thought of the way the trio disclosed the vulnerability. Miller will provide more information on the vulnerability and exploit at the upcoming Black Hat 2007 security conference, which opens next Saturday, July 28, in Las Vegas. But is this the ethical way? ISE's president, Avi Rubin, defended the decision to announce the existence of the vulnerability prior to a patch being made available by Apple. "Why are we doing that? Well, I believe that there is a social responsibility to report it when a device is vulnerable to attackers," said Rubin on his own blog Sunday. "People buy these things and use them in ways that put their identity and their online accounts at risk, and by exposing these vulnerabilities, we can make users better judges of how to use their high-tech devices." Rubin is familiar to many security observers from his research into problems with electronic voting systems. The paper by Miller, Honoroff, and Mason also spelled out a number of weaknesses in the iPhone's security architecture, although it didn't specifically pin the vulnerability on any of those flaws. One, however, most likely contributed to the reach of the exploit. "There are serious problems with the design and implementation of security on the iPhone," the paper said. "The most glaring is that all processes of interest run with administrative privileges. This implies that a compromise of any application gives an attacker full access to the device." Other deficiencies the trio cited in the iPhone's operating system included not using address randomization -- a technique applied by Windows Vista that's designed to make it tougher for hackers to write reliable attack code -- and allowing code in the heap to execute. Those last two shortcomings have been criticized in the desktop version of Mac OS X for some time. Three months ago, during the fallout after a hacking contest that jacked a MacBook Pro notebook, HD Moore -- the vulnerability researcher noted for the Metasploit hacking and attack testing software -- took on the claim that Mac OS X is safer than Windows. "The Mac OS X platform is years behind Linux, Windows, and OpenBSD in terms of operating-system security," said Moore then. "All of the above platforms support some form of address randomization (ASLR) and include features that make exploitation slightly more difficult." The ISE researchers have also posted a short video of their hack in action on YouTube.
444544
InfoWorld - A team of security experts in Baltimore said it has found a flaw in&#160;Apple&#39;s iPhone handset&#160;that can be used by attackers to access private data stored on it.
313178
Closing in on their Holy Grail The game is on for hackers trying to spot security vulnerabilities in Apple's iPhone and already they're scoring points.â¦
256526
Cisco Systems Inc. warned of another security vulnerability to its products last week, one that could allow an attacker to disable remote administration access to a Cisco device running IOS.
191968
No opening the handset case, no soldering -- a hacker group has announced that they've come up with a workaround allowing iPhone owners to make calls via networks other than AT&T.
768812
Password-stealing Trojan horse may--or may not--be targeting popular VoIP feature.
148438
Look, ma, no PC/Mac iPhone hackers have released a tool that allows owners of firmware 1.1.1 iPhones and iPod Touches to open up their devices to third-party apps - all without the need for a host Mac or PC.â¦
175523
(InfoWorld) - Duke University said Friday that widely publicizedÂ problems with its campus wireless networkÂ it had originally blamed on Apple iPhones had instead been traced to Cisco Systems hardware. A fix has been applied, the school added. For their part, Apple supporters blasted Duke for falsely accusing the new iPhone for playing a part in the flap. First reported last Wednesday by Computerworld's sister publication Network World, the problem involved failures of up to 30 wireless access points at a time across Duke's Durham, N.C. campus. The cause, school IT administrators thought then, was the built-in Wi-Fi adapters on iPhones, which were pinging the hotspots with thousands of address requests each second. The relatively small number of iPhones registered to Duke's wireless LAN -- just 150, according to the Network World story -- were nevertheless hogging bandwidth with endless address requests and taking down access points for 10 to 15 minutes at a stretch. Friday, Duke's chief information officer, Tracy Futhey, posted a note on the university's Web site thatÂ fingeredÂ an unspecified Cisco issue for the trouble. "Cisco worked closely with Duke and Apple to identify the source of this problem, which was caused by a Cisco-based network issue," said Futhey. "Cisco has provided a fix that has been applied to Duke's network and there have been no recurrences of the problem since." Futhey also took exception with news reports that she said made it sound like Duke's wireless infrastructure was falling apart, and that the iPhone wouldn't work with its network. "The reality is that a particular set of conditions made the Duke wireless network experience some minor and temporary disruptions in service," she argued. "Those conditions involve our deployment of a very large Cisco-based wireless network that supports multiple network protocols. "Earlier reports that this was a problem with the iPhone in particular have proved to be inaccurate," Futhey added. Those reports, however, were largely based on a statement by another Duke administrator, Kevin Miller, assistant director of communications infrastructure with the school's Office of Information Technology, who pinned the blame on the iPhone. "I don't believe it's a Cisco problem in any way, shape or form," Miller told Network World on July 18. Neither Duke nor Cisco spelled out the applied fix or the root cause. Cisco did not immediately reply to a request for additional information. Not surprisingly, Apple and iPhone supporters were angry at Duke for rushing to judgment. "They should not have 'announced' that it was the iPhone until after the problem was resolved," said a user identified as "jwilkinson1977" on Apple's iPhone support forum. "It's just bad publicity and wasn't warranted." Traditional college rivalries even played a part in the Duke bashing. "I think Dook [sic] owes Apple an apology!!!!!!!" wrote another user, pegged as Evangelist on the same thread. "Of course, I am a graduate of UNC-Chapel Hill, if that makes a difference.....AND IT DOES! I knew all along that the percentile was like 99.99999999999988998 that Dook had either done or not done something." Computerworld is an InfoWorld affiliate.
390638
A team of computer security consultants say they have found a flaw in Apple's popular new iPhone that allows them to take control of the device.
720006
Blog: After some false starts, unlocking an iPhone now seems to be a reality.
125499
Apple issues patch for iTunes to prevent attacks. Also: Identity thief gets jail time.