7324740
story
Comments: 137 +- Mobile: Security Firms Can't Protect iPhone From Threats on Friday November 27, @08:46AM
Posted
by
kdawson
on Friday November 27, @08:46AM
from the work-with-me-here dept.
from the work-with-me-here dept.
background: url(//a.fsdn.com/sd/topics/topiccellphone.gif); width:75px; height:74px;
cellphones
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicapple.gif); width:52px; height:64px;
apple
nk497 writes "F-Secure researchers are calling attention to the fact that it's impossible to run third-party anti-virus on iPhones, because the SDK doesn't allow for it. It's a problem, as they claim malware will start to target the phone. 'None of the existing anti-virus vendors can make one, without help from Apple,' chief research officer Mikko Hypponen said. 'Apple hasn't been too interested in developing antivirus solutions for the iPhone, because there are no viruses, which of course, isn't exactly true.' At the moment, the only worms faced by the iPhone have targeted unlocked, jailbroken devices — so Apple's not too bothered protecting users of such phones." While Apple claims that the iPhone's closed nature offers protection to its users, and security vendors maneuver for a piece of a market now closed to them, clearly both sides are pushing their own self-interest.
Related Stories
Because I don't need to worry about finances I can ignore Microsoft
and take over the (computing) world from the grassroots.
-- Linus Torvalds
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
It's closed so it's perfect (Score:4, Insightful)
And it's from Apple.
So it's doubly perfect. It's not like Mac OS has any security problems either.
So nothing to see here.
Re: (Score:2, Interesting)
Mac OS X has security problems because it allows running executables and non-signed programs too. iPhone on the other hand doesn't, so trojans and such wont work. The only possible way is to exploit a vulnerability, but that doesn't happen every day and should be pretty quickly patched by Apple (doesn't the phone network push updates automatically?). And if there's a new exploit, antivirus software are just as bad in protecting against it.
Re:It's closed so it's perfect (Score:5, Insightful)
This entire thing is just laughable. "we can't write A/V software for your product because no one can write software for the iphone that is, or that stops, viruses". So, they're asking Apple to create the problem, which they will then be able to sell a fix for.
Just HOW stupid do they think we all are?
The only people right now that have any use for antivirus or antimalware software for their iphone are those that have jailbroken them, in which case they could also install and run AV software But there's not a big enough market for that at this point. If they really wanted to write it, they could, right now. There's just not enough profit in it yet.
Parent
Re: (Score:3, Insightful)
AV Vendors please go back to the windows desktop PC where you came from.
And a portion of the irony here is that this is partly the reason that windows has such a virus and malware problem. "We want the mac platform to be just as exploitable as the windows platform, so we can profit from it too."
Uh... NO . go away.
Re:It's closed so it's perfect (Score:5, Interesting)
Anti-virus/anti-malware always seems to be a shitty bandaid to a badly designed system. Even running Windows 7, with UAC on, non-administrative account 99.999% time, always a non-IE browser, and very strict on what I run as .exe and where I download them, ad-aware just found some wind32 trojan.
Also, people forget this is supposed to be a portable device, even a phone sometimes. Remember what most A/V does to your desktop? I don't run A/V on my notebook, and I actually do want a decent battery life on my phone, as hard as that is to believe.
However, I know there will be problems with the iPhone. I do wish its safari had the option of "noscript" and stronger adblock plus than its own system among other things. And that when you do use it for the first time, it would have a video on safe usage. You can't upgrade or improve the user, the weakest link, but at least you can try to lead that horse to water that is education.
Parent
Re: (Score:2, Insightful)
The mac OS is not as closed as the iPhone, which is why it is more vulnerable.
Re: (Score:2)
PS - as for your other comment, I remember on other stories how people were insisting that Iphones ran OS X... Obviously it does when it's something to brag about, and it doesn't when it's a problem, I guess.
Re:It's closed so it's perfect (Score:4, Insightful)
It's false for anyone to claim that there are any active worms or viruses on iPhone. The reported worms don't target the OS but rather the fact that users are (1) explicitly installing OpenSSH and (2) not changing their default passwords. Any machine at all that is on the internet with a known root password is vulnerable. It's similar to buying a router and leaving the password at "password." Is this a flaw in the router or the user?
Parent
Re:It's closed so it's perfect (Score:5, Insightful)
Look at it the other way: it's perfect, until it's not closed.
What I mean is that Apple is doing the right thing. They should continue to deny anti-virus vendors from selling their warez, at least until there's a proven threat. And so far, there are none. From Apple's viewpoint, it's a great marketing tool to be so confident in their security that they won't compromise it by letting AV software on the platform. And for everyone who knows just how crappy AV software usually is (and how bad it drags down performance) it really is good news.
Seriously. As long as Apple keeps patching the holes the jail breakers use (which they seem to do within days) there simply are no credible threats. Oddly enough, this means the jail breakers are actually their best allies, in that they absolutely have the strongest motivations to hack the iPhone; and since their jailbreaks must necessarily be public to be useful, Apple can keep in lockstep with them.
That also means Apple must continue to keep it tightly closed, and never permit leaky crapware like Flash to run on it. Which indirectly benefits the rest of us, as that means sites that want to play nice with iPhones may provide usable Flash-free alternatives. We can hope, anyway.
Parent
Re: (Score:3, Interesting)
RTFA.
If you don't void the user agreement by jailbreaking your iPhone, you don't have this problem. Apple set up the environment. As it's designed, users are protected. If you choose to negate that design, you may have problems.
Where is Apple's liability if you don't use it as designed (or as dictated in the UA)?
Re: (Score:3, Insightful)
If Apple opens up the iPhone to allow third-party anti-virus programs to run, guess what will happen? All of a sudden there will be viruses for the iPhone. Gee, I wonder why Apple doesn't want to do that?
No sympathy from me for people using hacked iPhones and getting trojans since they knew the risks when they hacked it.
F-Secure smells money (Score:5, Interesting)
From the summary, F-Secure: "'Apple hasn't been too interested in developing antivirus solutions for the iPhone, because there are no viruses, which of course, isn't exactly true.' .
No, indeed, only jailbroken phones were infected. Thus the obvious solution for F-Secure would be to bring out an app in Cydia or other app stores for jailbroken devices.
Of course, rather than do something, their execs prefer to spend their time whining.
Re: (Score:3, Insightful)
Yep, if they are worried, just push it out to Cydia. Of course most (before someone comes whining, I did not say all!) of the users with jailbroken phones use pirated software, so there's no money in that.
Re: (Score:2)
I buy software from Cydia you insensitive clod !
But I wouldn't buy an AV, I already have one. It's called passwd.
Re: (Score:2)
Apart from the fact that it's a very unstable environment to develop in, both in a end-user as technical way.
*If* a company like AV would choose to sell a app purely targeted at jailbroken phones and distribute that app via other sources than the Apple Appstore.
Would apple have any legal ground to stop that distribution?
Proxying the updates (Score:2)
Except requiring a username, password, and registered device id# combination to download updates
Then one hacked version of the antivirus app would upload the updates to a pirate server, and the publicly available hacked version of the antivirus app would download the updates from that server.
I'm glad they can't make anti-virus for iphone. (Score:3, Informative)
If it's like desktop anti-virus, it will have its own vulnerabilities, take up more resources than I'd like, cause buggy behaviour or incompatibilities with other apps, and feed me false positives too often.
I don't need that on my phone. Since the only real malware we've seen for the iphone involves jailbreaking and then not properly managing your phone, I can do without.
Re:F-Secure smells money (Score:5, Funny)
Parent
Re:F-Secure smells money (Score:4, Funny)
But it does protect you, because after the resources Norton Antivirus takes, there's none left to actually run anything!
Parent
Re: (Score:3, Funny)
I can imagine what Norton Antivirus will look like on the iPhone. [...] battery life would be cut in half [...]
Cutting my current iPhone its batterylife in half would mean that I need a USB connection in the toilet. Just to be able to browse Slashdot while taking a dump.
Re:F-Secure smells money (Score:5, Insightful)
What I think is most telling about that quote is how an AV company has blurred the distinction between a "virus" and what basically amounts to a default password security hole. Sorry, but how does that make me want to trust you to run software on my device if you don't care to demonstrate you know the difference between these two types of attack?
The only reason why the jailbroken phones were vulnerable was because the default SSH password was not changed. No amount of AV is going to protect against a user's stupidity. This statement by F-Secure is about the money-making opportunity they're dying to exploit, and they're clearly riding the wave of negative publicity surrounding the closed platform nature of the iPhone.
Parent
Re: (Score:3, Insightful)
No amount of AV is going to protect against a user's stupidity.
And no amount of AV is going to protect against vendor/distributor stupidity either. Here we have a program, running on a non-firewalled device, which on install, instead of being non-functional, opens up to the whole world with a default password. This is not the 1990's people! In this day and age, I expect a program to be secure by default... whatever it takes, even if it means it is non-functional at install.
I actually have a jailbroken
Re:F-Secure smells money (Score:4, Insightful)
I love how everyone pretends that recent trojan targeted "jailbroken" iPhones.
It didn't. It targeted stupid users who happened to have a jailbroken iPhone. Specifically, it targeted users who install OpenSSH without changing the default password (ignoring warnings to the effect). There's no vulnerability here, and a stock jailbroken iPhone is not vulnerable. The same exact kind of malware can affect every poorly configured UNIX system out there - for example, that router-based botnet that infected routers with default SSH passwords running Linux. There are tons of Linux rootkits out there too, and servers with poor passwords are rooted all the time. Does that mean we urgently need craptacular AV software on all Linux boxes?
On the other hand, it is true that a non-jailbroken iPhone has an extra layer of protection in the form of compulsive executable signing. Apple ostensibly has superior security (in non-jailbroken devices), but that's just because they lock down the device tight. It's "good" old Trusted Computing, the kind that does not trust the user. By jailbreaking the device, you're freeing yourself from nanny Apple's oversight. If it turns out you were better off with it, well, that's your own fault.
Parent
Neither do game consoles! (Score:3, Insightful)
Seriously, this is news for nerds? Some morons jailbreak their phones, leaving SSH with a default password, they get hacked, and suddenly A/V firms think they have an "in"? You could install every A/V program on the planet on a windows PC, but if you install SSH with a default password, it will still get hacked.
Re: (Score:2)
If you have an :insert_proprietary_os/hardware_here:
Every modern CPU is patented and uses a copyrighted microcode, and every mass market PC uses a BIOS other than coreboot.
you need to accept the fact that the vendor lock-in, closed-source nature of the product is going to severely limit your options when it comes to solving a problem
Then should one do without devices entirely if no non-proprietary device is available? True, there are Android-based phones (e.g. Motorola Droid) and portable media players (e.g. Archos 5), but what about DVRs that work with CableCARD or switched video? Or what about set-top video game players (very few PC games are optimized for TVs because very few PC gamers use TVs because very few PC g
I can protect your pretty iPhones... (Score:2, Funny)
I see an opening for Android... (Score:3, Interesting)
...and here it is:
Some fella develops and distributes some serious virus that "shuts down" a big number of iPhones...
This generates [bad] publicity for the device...
The media pick the story up...(in the meantime, it's "damage control" for Apple)...
Android is touted as the best alternative...
Motorola and Co. jump on the bandwagon...
What next? profits, numbers and market share for the Droid.
Question is: Am I wrong?
Re:I see an opening for Android... (Score:4, Interesting)
Except that this scenario is next-to-impossible on stock iPhones, because of the aforementioned code-signing restrictions, sandboxed applications and other mechanisms which prevent this from being a general problem.
Jailbreaking your phone makes all these safety nets go away: the kernel is patched so that it will run anything and applications are permitted to roam free across all of the device. At that point, you are on your own as far as security goes. If you, as a user, willfully ignore the instructions saying "Use 'passwd' to change the default password!!", then the resulting compromise of your iPhone is *entirely* your fault, and Apple doesn't even have to do "damage control". A rooted Android phone would suffer the same problems.
Parent
Re: (Score:2, Insightful)
A) No real way to get it to work on non-jailbroken iPhones.
B) The fact that every iPhone worm worked because of having SSH running with a default password that is basically equivalent to going to Defcon with a laptop with a stickynote saying "Username is user password is alpine" of course things are going to turn out badly. Everyone knows what the default SSH login is on iPhones (alpine) and when there are thousands of them running with the same password why are people surpris
FUD (Score:2, Insightful)
For those new to the internet, that would be Fear, Uncertainty, and Doubt. This sort of garbage would be a pretty classic example of it.
Re:FUD (Score:4, Funny)
Be fair now - they couldn't find anything else for today's daily Iphone Slashvertisement, so they had to run with this.
Parent
The new logic of security (Score:4, Interesting)
I tend to be wary when using my crystal ball, but this time I want to make a prediction: This is an intended development, and we'll see more of it in the future. Jailed devices that are deemed intrinsically secure. People who dare to unlock their device not only open themselves up for infections, they also can't get any help to make their devices secure again because everyone who could or would offer them this help is locked out.
Now add laws that started to creep into our legislative where you're legally responsible for it if your device is insecure and doing something illegal.
In the long run, you will only be secure and not responsible for anything your device does if you don't mind not owning it.
Re: (Score:2)
We are likely to start seeing more and more of this kind of whinin
Apps run in a sandbox (Score:3, Interesting)
So no low level kernel hooks... (Score:2)
... that be used by any tom , dick or harry and screw up or silently alter the functioning of the kernel?
Oh , shame. I guess they'd better stick to using Windows if that's the sort of enviroment these antivirus writers are happy working in.
No mechanism for transmission (Score:5, Interesting)
This is even more stupid than their attempt to sell antivirus for Palm OS.
There is no mechanism for transmission between one iPhone and another UNLESS the iPhone is jailbroken.
So Symantec only needs to write antivirus for jailbroken iPhones. And Apple would have no way to prevent them. So what's their problem?
Re: (Score:3, Insightful)
LoB
News at 11 (Score:4, Insightful)
Security Through Obscurity Never Works (Score:3, Insightful)
"While Apple claims that the iPhone's closed nature offers protection to its users"
Re: (Score:3, Informative)
It's NOT obscurity in this case! "Closed" here describes sandboxing/etc. mechanisms, which might just as well be OSS (AppArmour, SELinux)
Phones must not need anti-virus (Score:5, Insightful)
Going further, I have absolutely no patience with people who hack iPhones. A phone is an appliance connected to a public asset - EM bandwidth. People using public assets have a duty of care, and it's the failure of duty of care (tragedy of the Commons) that has done a lot of damage to society.
What I do on my own local network is my affair, but I think increasingly we should have a reasonable expectation that anything connected to a public network is properly secured and maintained, just like (in the UK at least) we test cars annually to check they are safe on the road. I'm afraid that the Wild West days of the Internet are increasingly over - and the excesses of some people is bringing down an overreaction.
Over the next 20 years we have to find a way to put the genie back in the bottle without killing the genie or spoiling the bottle. The politicians will try to screw this up. But the rest of us need to realise that we need to grow up too - we need to understand that if we want a reliable public internet and mobile phone system, we need to stop treating people who act irresponsibly as if their behaviour was acceptable or clever. Otherwise anti-virus and anti-malware software will continue to eat up too many of our CPU cycles, shorten the lives of our hard drives, and cause increasing frustration to those of us who actually need to earn a living, and have to use the Internet and the phone system to do it.
The iPhone is running windows? (Score:4, Insightful)
I thought it was running some form of Unix/Linux sort of OS.
I realize these modern day snake oil salesmen have convinced corporate America that their product is effective against all viruses on all platforms. However if you look at the definition file that they install on all the systems you'll see that the signatures list which platform they're for. I was curious so I greped the file. Turns out that while there's hundreds of thousands of windows definitions in the file there's only tens for linux and fewer for sun.
When pressed on this they'll tell you that they look for all those viruses so they arn't passed by the ftp/http/mail server on the unix box. While there's some merit to this position I don't see how it's at all relevant to the iPhone.
"Whaaaaaa!" (Score:3, Insightful)
That's all I hear.
Unlock != Jailbreak (Score:4, Informative)
BTW, if the original "anti-virus expert" really put unlock and jailbreak as the same thing, he needs to learn more about iPhones.
Jailbreak is breaking out of the chroot jail. It gives you root access so you can do wonderful things like install an SSH-daemon (which, unfortunately uses a standard password which the worms out there are exploiting now), as well as install apps that you want instead of only those that's passed Apple's draconian approval service.
Unlocking is SIM-unlocking, its purpose is so that an unauthorized SIM card (in the US that means non-AT&T) works on the iPhone. If you're using an AT&T card, you don't need to unlock, but you can still jailbreak. You need to run a software not authorized by Apple to do the unlock, so to unlock you *need* to jailbreak.
As for F-Secure, eh, fuck 'em. Their threat of Symbian viruses is also snake oil, it requires the most idiotic of idiots to see "Hmm someone wants to send me something over BlueTooth. OK I'll accept. Transfer finished. Let's open it. Oh it wants to install an app, should I install or should I deny?" and F-Secure sells you unproven protection if you say "install". Goddamnit, if you are so goddamned dumb, you deserve to get swindled by this company.
Non-jailbroken phones are 99.999 percent safe. (Score:3)
In the early days, there were some remote exploits that you could use to jailbreak a device but those remote exploits have now been fixed soon after the jailbreaking community discovered the holes and published their software.
The official firmware from Apple is essentially hardened now against any remote attacks or malware attempting to run so there is no market for anti-virus on the iPhone.
Re: (Score:2)
Cue someone suggesting that because of that limitation running the antivirus would thus stop the virus from running.
Re: (Score:2)
And how would iphone support antivirus anyway? It can only run one program at a time.
Apparently it can only present one UI, but can presumably run several things. Hence the required help from Apple that the security firms asked for.
And if there are farting apps, there's no reason why there shouldn't be an icondom (or whatever).
Re: (Score:3, Funny)
Sure sounds familiar...
Re: (Score:3, Informative)
Only third party apps are barred from running in the background.
Apple apps can and do run in the background which is why any AV company would have to work with Apple.
Re:Jail Breaking Makes sense NOT! (Score:3, Interesting)
iLocalis is a clone of "Find My iPhone", a feature of the 3.x firmware.
Winterboard is customizable but it is also slow and unstable.
OpenSSH Server has no business on a phone. There are several SSH clients in the app store for connecting to other machines for administrative purposes. If you feel the need to have a phone that requires administration,