Security firm: Don't use iPhone Web dialer
684110
(InfoWorld) - Security researchers at SPI Labs are warning iPhone users not to use a special feature that lets them dial telephone numbers over the Web using the iPhone's Safari browser. The feature was created to give iPhone users a simple way to dial phone numbers listed on Web pages, but according to SPI, the feature could be misused. [ Blog:Â Researchers point to iPhone security riskÂ ] Attackers could exploit a bug in this feature to trick a victim into making phone calls to expensive "900" numbers or even keep track of phone calls made by the victim over the Web, said Billy Hoffman, lead researcher with SPI Labs. The iPhone could even be stopped from dialing out, or set to dial out endlessly, he said. "Because this vulnerability can be launched from Web sites, everybody who has an iPhone has the potential to get exploited," Hoffman said In order for the attack to work, the bad guys would have to either trick iPhone users into visiting a malicious Web site or make a legitimate Web site send untrustworthy information to the iPhone using what's known as a cross-site scripting attack. "Any time someone could control the content that's getting sent to the iPhone [the possibility of an attack] exists," Hoffman said. SPI is not releasing detailed information on how the Web dialing feature could be exploited, but the company contacted Apple on July 6 and is working with the iPhone maker to prevent these types of attacks, Hoffman said. Apple could not be reached immediately for comment. Because Apple is encouraging software developers to write Web applications for the iPhone that use Safari, the browser has come under particular scrutiny from iPhone hackers. Researchers had previously noted that Safari could be used to misdial numbers, but Hoffman's post suggests that this could be done more easily than previously thought. Not everybody thought the SPI findings were groundbreaking, including Dave Aitel, CTO with Immunity Inc. "If you can make calls from the Web browser, you can make fake calls from the Web browser," he said. So should iPhone users stop using the Web to place calls? "Yes," said Aitel. "If they know a lot of hackers and are a special target."
452415
Unlike AT&T, Verizon wonât monitor its network to block unauthorized copying. That would violate customer privacy, it says, and would be expensive too.
753754
(InfoWorld) - Users are reporting that a new update to Apple's iPhone is making previously unlocked iPhones unusable. The iPhone 1.1.1 update , released Thursday, breaks phones that have been hacked so that they work with providers other than AT&T, the only U.S. provider Apple has allowed to carry its mobile phones. In recent months, a number of software tools have been developed whichÂ allow iPhone users to break free of Apple's AT&T-only restriction, but Apple has said that it would fight any attempts to unlock the iPhone. Earlier this week the company released a warning that unlocked iPhones "will likely result in the modified iPhone becoming permanently inoperable when a future Apple-supplied iPhone software update is installed." Shortly after the Thursday update was released, users of unlocked iPhones began reporting problems. Security researcher Tom Ferris said the new software disabled a phone that had been unlocked using the open-source anySIM software in order to work on T-Mobile's wireless network. After the update, the iPhone was stuck with an error message and apparently unusable. "It kept saying 'unsupported SIM card,' even with the AT&T SIM card in it," he said. "You can turn the phone off or on, but we just can't figure out how to get past this 'SIM card not supported'," he said. SIM cards contain account information and are used to authenticate devices on certain types of mobile networks. Unlocked iPhones can use SIM cards from non-AT&T networks. Others were reporting similar problems on Thursday. The update also appears to disable the 'Jailbreak' hack which allows users to install unsupported software on the iPhone, Ferris said. After the 1.1.1 patch was installed, it wiped out all of the third-party applications he had installed on a second iPhone, he said. The new software is Apple's biggest iPhone update to date, andÂ it fixes a number of security flaws in the iPhone's browser, mail client, and Bluetooth networking server. The majority of the flaws do not appear to be critical, but the update fixes a larger number of bugs than the first iPhone update, released July 31. Hackers have said that the iPhone's browser and mail clients are the most likely sources of software flaws and this release bears that out. Apple fixed seven flaws in the Safari browser, two in the iPhone's mail client, and one Bluetooth bug with the release. The Bluetooth flaw could be the most serious -- Apple said that it could allow an attacker to run unauthorized code on the iPhone -- but because Bluetooth works over a range of just a few feet, the attacker would have to be standing near the victim for any exploit to work, said Andrew Storms, director of security operations with nCircle Network Security. Noted hacker HD Moore agreed that the Bluetooth flaw was serious. "The only bad issue here is the Bluetooth [flaw]," he said. "I will start working on this tonight." Though there may be some technical limitations to what an attacker could do by exploiting this bug, it "could be a nasty remote exploit," he added. Earlier this week,Â Moore added iPhone hacking capabilities to the Metasploit hacking toolÂ that he develops. The patch also fixes some cross-site scripting and JavaScript flaws in the browser that could also be serious, Storms said. These flaws could be exploited to make the browser run unauthorized JavaScript code, he said. Mobile phone users typically cannot update their own software, but Apple introduced this capability in the iPhone, which uses the update mechanism in the phone's iTunes music player. iTunes checks for these updates once per week, so it may take up to seven days for all iPhone users to see these updates. Apple advises users to install the update immediately.
474601
Claiming national security concerns, and backed by Justice Department special counsel, the phone provider argues in federal court that a lawsuit against it for ponying up millions of phone records for a secret government data-mining program should be dismissed. Ryan Singel reports from the courthouse.
49080
The iPhone and Apple Inc.&#39;s   desktop computers may be vulnerable to hackers due to a flaw in  their Web browser, according to a security firm, which said it  found a way to hack into the iPhone.
237817
(InfoWorld) - Gartner, IDC, and 451 Group research analysts, this week warned IT administrators to keep iPhones away from their businesses. "We're telling IT executives to not support it because Apple has no intentions of supporting [iPhone use in] the enterprise," Gartner analyst Ken Dulaney said. "This is basically a cellular iPod with some other capabilities, and it's important that it be recognized as such." As if that will stop people from buying them anyway when they hit the market in the U.S. next week. The reality is that no matter how hard IT administrators try, the iPhone will be snapped up by their employees -- and not just the average Joes either. The device is a status symbol that will likely be snapped up by business leaders as the digital technorati. Try telling your CEO the iPhone doesn't play well with your IT systems. Dulaney and other researchers notwithstanding, this device can be good for the enterprise because of the business needs of smartphone users. It is an iPhone, after all, with an emphasis on phone. It offers e-mail -- currently the most popular means of business communications. There's an address/phone Book for quick access to contacts. It offers SMS, a quick way to contact other mobile phone users, and voicemail -- both useful to road warriors. There's a real Web browser -- by far the most underpowered and underappreciated part of a mobile phone. And it contains a slew of enterprise-worthy apps, including a calendar, access to maps, spreadsheets, and a document reader. All of these things are important -- and all can be done to a greater or lesser extent on most business-focused PDA phones. But in the business world, the mobile Web browser is the key to the future of business apps, and it is becoming a platform unto itself. One thing that Apple CEO Steve Jobs made abundantly clear at last week's Worldwide Developers Conference (WWDC) is that the iPhone would include a full browser. The Symbian and Linux platforms' best browser is Opera Mini -- which isn't that bad -- but it by no means constitutes a full browser. Windows Mobile's browser isn't bad either, but it also falls well short of Internet Explorer 7. Additionally, the iPhone browser has a lot of zooming and panning tricks that make it more usable on the relatively small screen. In that crucial area, advantage: iPhone. Why is the browser crucial? Because most new business applications are being built around it. AJAX and other browser technology innovations over the past few years have turned the browser into a veritable platform. Sure, a lot of legacy applications still require browserless, platform-specific client applications. But those days are numbered. It's not just the isolated applications that are moving to a browser. All of the stalwart office applications are also moving to the Web. With Google Office (which now works with Safari -- the iPhone browser), Soho Office, and even Web-centric versions of Microsoft Office applications, the browser is truly the new business platform. The iPhone is not without its business-use flaws. It doesn't natively sync up with Lotus Notes or Exchange - and Microsoft, at least, will most likely do everything in its power to try to keep it that way to protect its Windows Mobile business. It can, however, hook up to IMAP email, LDAP address books, and WebDav for calendaring; with a bit of tweaking, that will work well for Exchange-based companies. Microsoft SharePoint can also be browsed from the Web interface, but to what extent? Time -- and the work of apps developers -- will tell. A newly anointed relationship with Cisco on all things iPhone should also let the device into the VPN and might even let an iPhone play well with Cisco VoIP solutions. And of course, don't forget the arduous task of getting your conservative IT department to accept the idea of letting loose an Apple phone -- or even MacBook Pro -- into the office. Previews of the phone haven't yet touted an instant messaging client like Apple's iChat or AOL Instant Messenger. It is likely, however, that Apple will include something with instant-messaging functionality in the near future -- there are still four slots left in the iPhone's application window. It's also true that the first-generation iPhone isn't the raw specs winner by any stretch. That honor goes to the Symbian/Windows Mobile 6 Phones coming from Toshiba (the G900), Nokia (the N95), Samsung (the F700) and HTC (the Shift). AT&T's EDGE wireless network is slow by today's standards, and while Wifi connectivity will help, there are questions about why Apple has forsaken the HSDPA/UTMS component and when an update might occur. Given that battery life is a factor -- Apple this week released updated specs that go beyond what it touted in January -- EDGE makes sense because it's more energy efficient. Also, the 8GB max on storage is seems low. At a time when you can buy an 8GB SD card for less than $80, Apple likely looked to keep costs down with an eye on upping that storage when it's economically smart. Most users would likely be happy with a micro/mini/SD card slot now standard on most smartphones. There is, of course, the price. The iPhone's hefty $499 and $599 price tags, depending on which model you buy, is a definite disadvantage in business. With relatively comparable gear (from a corporate standpoint), such as the Motorola Q, which is almost free with a service plan, buying an iPhone requires serious justification. We're talking about spending the equivalent of a budget laptop. Of course, something that you spend half your day using should justify the premium that this delicious piece of hardware demands. And then there are at least two intangibles: Usability. Apple's legendary reputation for making painful tasks easy will totally transform the mobile phone industry. And remember, companies love productivity from their workers. Until now, the big players have been Microsoft Windows Mobile, Palm, Symbian, and Linux. They all had successes. But it's the last 10 percent of usability that Apple always manages to squeeze out its products will be the differentiator. Apple did the same in the computer industry until Microsoft caught up. Apple has learned from this and patented every minute detail of the iPhone, making it harder for copycats to appear anytime soon. The few seconds here there that the iPhone saves users will quickly add up. It's the little things that make for big savings across an entire enterprise. Business bling, baby. Everyone knows that this is the phone to have. Just look at the buzz ahead of the June 29 launch. Apple has spent the last few years building up its brand across all channels and is reaping the rewards like no other company in the industry. As much as the enterprise IT guys will want to recite better specs for rival Windows Mobile devices, nobody wants to hear that. I can imagine any number of CEOs saying, "I don't care! Just make the iPhone work on our systems!" And if it works for the CEO, you can bet the sales folk will want in on the action, too. Think they'll want to show up to a meeting with an important client and whip out last year's "hot" phone? They might as well wear parachute pants as well.
222360
Stuffs finger in waterfall UniquePhones has pulled its iPhone unlocking service after receiving calls from lawyers claiming to represent AT&amp;T and threatening to sure the Belfast-based firm for copyright infringement and illegal software dissemination.â¦
723599
A hacker group has released a free, open-source unlock for Apple Inc.'s iPhone, although it's not for the faint of heart.
225415
Pennsylvania may block Philly's Wi-Fi plan. [News.com Extra]
191968
No opening the handset case, no soldering -- a hacker group has announced that they've come up with a workaround allowing iPhone owners to make calls via networks other than AT&T.
657219
Several Web sites recently began offering software promising ringtones and screen savers for certain cell phones. But those who downloaded the software found that it turned
148214
Several Web sites this month began offering software promising ring tones and screen savers for certain cellphones. But those who downloaded the software found that it turned
451531
Code that takes advantage of a Safari flaw could leave an iPhone open to attack.
74786
Apple Inc said on Monday that  programs available on the Internet that allow the iPhone to be  used with other service providers besides AT&T&#39;s Cingular  network can irreparably damage the device.
444228
Apple warned that iPhone owners who have used unauthorized programs to unlock the cellular service feature of their handsets may end up with a phone that does not work.
440302
Apple has released an update to iTunes that blocks users from creating free custom ringtones and then syncing them to an iPhone. Despite Apple&#8217;s best efforts to thwart users, a workaround has already been found and posted to the Internet.
469828
A grainy video made in Northern Ireland has been posted on the Web showing the iPhone being unlocked and being used to make calls with a carrier other than AT&T.