Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Business Intelligence Sales & Marketing More Topics...
Eliminate costly downtime!
Find out how with Free White Paper
& enter to win a Samsung Galaxy Note

www.apc.com
Network Security
Fiercely productive scanners
Average Rating:
Rate this article:  
Apple Pushes iOS Update To Fix Epic Security Blunder
Apple Pushes iOS Update To Fix Epic Security Blunder

By Seth Fitzgerald
February 24, 2014 1:41PM

Bookmark and Share
Some members of the security community are chalking up the bug in Apple's iOS and Mac OS X to an unintentional mistake on Apple’s part, but others question why such a large company could have made a simple error. This sort of subtle bug deep in the iOS and Mac OS X code is a nightmare, but I believe it's just a mistake, said a security expert.
 


Hacks and bugs are almost unavoidable with any piece of software but a recent vulnerability found in Apple’s iOS has many experts surprised and worried. The tech giant spent the weekend trying to come out with fixes for a vulnerability that was first noticed by researchers in iOS and then later, Mac OS X as well.

The vulnerability is reportedly caused by a simple change in the iOS code that allows hackers to intercept and compromise sensitive banking information as well as other forms of communication like e-mail. One of the most concerning aspects of the so-called Gotofail bug is that it has been present in iOS for a significant period of time, leaving people with older iOS 6 devices at risk.

A Major Bug

Even though all of the details regarding the Gotofail bug have not been released to the public, researchers and experts who have found the issue for themselves are saying that it is a worst-case scenario.

“Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS,” according to a statement from Apple. This means that if a hacker is near a target device, he can use the vulnerability found in iOS and Mac OS X devices to steal information or alter communications to spread malware.

The bug, which affects the “goto” call command, simply allows a hacker to circumvent the SSL security system present in Apple’s software. Not only is this a simple hack, it is a flaw that is not unheard of when using “goto” commands. Normally the use of a simple piece of code like this would be fine, but somehow, a person was able to alter Apple’s code directly.

Any malicious piece of code that targets SSL security can leave a device completely open to a variety of different hacks. Since this is what happened with iOS and Mac OS X devices, users have been open to attacks for quite some time.

NSA Speculation

Some members of the security community are chalking up the bug to an unintentional mistake on Apple’s part but others question why such a large company could have made a simple error.

“This sort of subtle bug deep in the code is a nightmare,” security expert Adam Langley said in a blog post. “I believe that it's just a mistake, and I feel very bad for whomever might have slipped in an editor and created it.”

Researchers who have looked at the Gotofail bug have noted that it was first present in a version of iOS 6 around the same time as the Snowden NSA revelations began to come out. The initial Snowden reports suggested that the NSA had backdoors into products from technology companies, including Apple. This observation has fueled speculation that either Apple or the NSA was directly responsible for the lack of security.
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Network Security
1.   How To Beat the Heartbleed Bug
2.   OpenSSL Calls for More Support
3.   NSC Backs Disclosing Vulnerabilities
4.   Heartbleed Flaw Affects Hardware
5.   1 in 5 Say They've Had Data Stolen


advertisement
Don't Reset Passwords for Heartbleed?
Added caution needed to ensure security.
Average Rating:
How To Beat the Heartbleed Bug
Big data analytics could be the key.
Average Rating:
Heartbleed Flaw Affects Hardware
Cisco, Juniper equipment vulnerable.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
How To Beat the Heartbleed Bug
Heartbleed headlines continue as IT admins scramble for answers no one has. Early reports of stolen personal data, including 900 social insurance numbers in Canada, are starting to trickle in.
 
After Heartbleed, OpenSSL Calls for More Support
The president of the OpenSSL Foundation says more support is needed from companies and governments that use its software so that it can better spot and fix flawed pieces of code such as Heartbleed.
 
NSC Backs Disclosing Software Vulnerabilities
Disclosing vulnerabilities in commercial and open source software is in the national interest and shouldn't be withheld unless there is a clear need, says the National Security Council.
 

Enterprise Hardware Spotlight
Vaio Fit 11A Battery Danger Forces Recall by Sony
Using a Sony Vaio Fit 11A laptop? It's time to send it back to Sony. In fact, Sony is encouraging people to stop using the laptop after several reports of its Panasonic battery overheating.
 
Continued Drop in Global PC Shipments Slows
Worldwide shipments of PCs fell during the first three months of the year, but the global slump in PC demand may be easing, with a considerable slowdown from last year's drops.
 
Google Glass Finds a Home in Medical Education, Practice
Google Glass may find its first markets in verticals in which hands-free access to data is a boon. Medicine is among the most prominent of those, as seen in a number of Glass experiments under way.
 

Mobile Technology Spotlight
Amazon 3D Smartphone Pics Leaked
E-commerce giant Amazon is reportedly set to launch a smartphone after years of development. Photos of the phone, which may feature a unique 3D interface, were leaked by tech pub BGR.
 
Zebra Tech Buys Motorola Enterprise for $3.45B
Weeks after Lenovo bought Motorola Mobility’s assets from Google for $2.91 million, Zebra Technologies is throwing down $3.45 billion for Motorola’s Enterprise business in an all-cash deal.
 
CTIA Caves, Volunteers Kill Switch Plan
After bucking against the concept of a smartphone kill switch, the CTIA just announced the “Smartphone Anti-Theft Voluntary Commitment” to thwart smartphone thefts in the U.S.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Business Intelligence | Sales & Marketing | Contact Centers | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.