Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
UCS Invicta: Integrated Flash
Deploy flash memory technology to
deliver peak workload performance.

Find out more>>
Operating Systems
Gartner's #1 for endpoint backup
Average Rating:
Rate this article:  
Apple Pushes iOS Update To Fix Epic Security Blunder
Apple Pushes iOS Update To Fix Epic Security Blunder

By Seth Fitzgerald
February 24, 2014 1:41PM

Bookmark and Share
Some members of the security community are chalking up the bug in Apple's iOS and Mac OS X to an unintentional mistake on Apple’s part, but others question why such a large company could have made a simple error. This sort of subtle bug deep in the iOS and Mac OS X code is a nightmare, but I believe it's just a mistake, said a security expert.
 


Hacks and bugs are almost unavoidable with any piece of software but a recent vulnerability found in Apple’s iOS has many experts surprised and worried. The tech giant spent the weekend trying to come out with fixes for a vulnerability that was first noticed by researchers in iOS and then later, Mac OS X as well.

The vulnerability is reportedly caused by a simple change in the iOS code that allows hackers to intercept and compromise sensitive banking information as well as other forms of communication like e-mail. One of the most concerning aspects of the so-called Gotofail bug is that it has been present in iOS for a significant period of time, leaving people with older iOS 6 devices at risk.

A Major Bug

Even though all of the details regarding the Gotofail bug have not been released to the public, researchers and experts who have found the issue for themselves are saying that it is a worst-case scenario.

“Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS,” according to a statement from Apple. This means that if a hacker is near a target device, he can use the vulnerability found in iOS and Mac OS X devices to steal information or alter communications to spread malware.

The bug, which affects the “goto” call command, simply allows a hacker to circumvent the SSL security system present in Apple’s software. Not only is this a simple hack, it is a flaw that is not unheard of when using “goto” commands. Normally the use of a simple piece of code like this would be fine, but somehow, a person was able to alter Apple’s code directly.

Any malicious piece of code that targets SSL security can leave a device completely open to a variety of different hacks. Since this is what happened with iOS and Mac OS X devices, users have been open to attacks for quite some time.

NSA Speculation

Some members of the security community are chalking up the bug to an unintentional mistake on Apple’s part but others question why such a large company could have made a simple error.

“This sort of subtle bug deep in the code is a nightmare,” security expert Adam Langley said in a blog post. “I believe that it's just a mistake, and I feel very bad for whomever might have slipped in an editor and created it.”

Researchers who have looked at the Gotofail bug have noted that it was first present in a version of iOS 6 around the same time as the Snowden NSA revelations began to come out. The initial Snowden reports suggested that the NSA had backdoors into products from technology companies, including Apple. This observation has fueled speculation that either Apple or the NSA was directly responsible for the lack of security.
 

Tell Us What You Think
Comment:

Name:



Get Powerful App Acceleration with Cisco. In a world where time is money, you need to accelerate the speed at which data moves through your data center. Cisco UCS Invicta delivers powerful, easy-to-manage application acceleration for data-intensive workloads. So you can make decisions faster and outpace the competition. Learn More.


 Operating Systems
1.   Oracle Releases a Slew of Upgrades
2.   Microsoft Spreads Cortana Abroad
3.   China Puts Microsoft Under the Lens
4.   Will Next OS X Bring New Apple Grief?
5.   Can One Size Windows OS Fit All?


advertisement
China Puts Microsoft Under the Lens
Official anti-monopoly probe launched.
Average Rating:
Microsoft CEO Sees 'Bold' Plan Ahead
With unified Windows for all platforms.
Average Rating:
Mac OS Yosemite Beta 4 Released
Public preview could be coming soon.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Ruling Against Microsoft Raises E-Mail Privacy Concern
Microsoft has been ordered to hand over e-mails to law enforcers in the United States as part of a criminal investigation, even though the e-mail is stored at a data center in Dublin,Ireland.
 
Twitter Buys Password Manager Startup Mitro
Following on the heels of another acquisition earlier this week, Twitter is adding to its fold a password-manager security startup called Mitro, which in turn is releasing its code as open source.
 
Government Requests for Customer Data Skyrocket
Requests for customer data from the government jumped 50 percent in the first half of 2014, according to Twitter, which received more than 2,000 requests for user info from gov't agencies.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.