Forgot your password?
typodupeerror
Security Iphone

iPad Left Vulnerable After Record iPhone Patch Job 145

Posted by kdawson
from the only-three-million-who-would-bother dept.
CWmike writes "With Monday's iOS 4 upgrade, Apple patched a record 65 vulnerabilities in the iPhone, more than half of them critical. However, the first-generation iPhone and iPod Touch, as well as the much newer iPad, may have been left vulnerable to some or all of the 65 bugs. iOS 4 cannot be installed on 2007's iPhone and iPod Touch, and the upgrade is not slated to reach iPad owners until this fall. The bug count is a record for the iPhone, surpassing the previous high mark of 46 vulnerabilities patched last summer with iPhone OS 3.0. Formerly known as iPhone OS 4, iOS 4 included 35 bugs, or 54% of the total, that were tagged with the phrase 'arbitrary code execution.' It's unclear how many, if any, of the vulnerabilities affect Apple's iPad. The media tablet runs an interim version of the operating system, dubbed iPhone 3.2, that followed the February iPhone 3.1.3 security update. It's possible that some of the bugs patched Monday were fixed by Apple before it launched the iPad in early April. But according to the Common Vulnerabilities & Exposures database, it's likely that many of the flaws fixed on Monday still exist in 3.2."
This discussion has been archived. No new comments can be posted.

iPad Left Vulnerable After Record iPhone Patch Job

Comments Filter:
  • Re:It's a phone (Score:5, Insightful)

    by heruvian (1816212) on Tuesday June 22, 2010 @04:04PM (#32657504)
    Yes, a phone that you can use to access your bank account on the internet.
  • by e2d2 (115622) on Tuesday June 22, 2010 @04:04PM (#32657508)

    If another person claims a "record" on the number of bugs fixed in an apple release out I'm gonna jump off a fucking cliff.

    Bugs are not good. Lots of bugs are worse. Fixing them? You don't get a medal, you should have done it right the first time. Yes it's good to patch them, but it's not something to break out the champagne on. When I fix a huge bug list my boss says "about time", not "good job! way to work!".

  • Re:It's a phone (Score:5, Insightful)

    by Lundse (1036754) on Tuesday June 22, 2010 @04:08PM (#32657566)

    Who cares if it has vulnerabilities. It's a phone.

    A phone which is able to broadcast your real-time location.
    A phone which has all your mails, all your texts and logs of all your calls, and a few private photoes to boot.
    A phone with verified contact information for all your friends, and sellable information on yours and their preferences.
    A phone that can call any number, including premium-rated ones owned by shady organizations.

    Yeah. Who cares is someone else gains control of that?

  • Funny (Score:4, Insightful)

    by DrugCheese (266151) on Tuesday June 22, 2010 @04:09PM (#32657570)

    Funny how M$ us to be on top and all you'd read about was the security vulnerabilities left unpatched and with apple on top, with their new line of hardware, are having the same issues. I wonder if we'll ever see something like the Melissa virus, or the iJerk.

  • Re:Walled garden? (Score:1, Insightful)

    by Anonymous Coward on Tuesday June 22, 2010 @04:09PM (#32657578)
    Only if you don't connect your iDevice to a network.
  • by aaaaaaargh! (1150173) on Tuesday June 22, 2010 @04:09PM (#32657594)

    I wouldn't call that a bug. :-)

  • by Anonymous Coward on Tuesday June 22, 2010 @04:15PM (#32657660)

    What is the point of speculating? It would be news if an exploit was in the wild.

    well, the reason for disclosure is that it might already be exploited by someone, even if it's not public knowledge.

  • Re:It's a phone (Score:3, Insightful)

    by dhanson865 (1134161) on Tuesday June 22, 2010 @04:19PM (#32657716)

    A phone which is able to broadcast your real-time location.
    A phone which has all your mails, all your texts and logs of all your calls, and a few private photoes to boot.
    A phone with verified contact information for all your friends, and sellable information on yours and their preferences.
    A phone that can call any number, including premium-rated ones owned by shady organizations.

    Yeah. Who cares is someone else gains control of that?

    On top of calling pay phone numbers (900 numbers and such) if it copies all your data to a server somewhere you may go over your data plan and have to pay $15 per 200MB transferred or $10 per 1GB transferred depending on your plan.

    DataPlus - 200 MB of data for $15 per month

            * Designed for people who primarily surf the Web, send email, and use social networking apps.
            * On average, 65% of AT&T smartphone customers use less than 200 MB per month
            * If you use more than 200 MB, you'll receive an additional 200 MB of data usage for $15, replenished as often as necessary during the billing cycle.

    DataPro - 2 GB of data for $25 per month

            * Designed for people who regularly download or stream music and video, or use other high bandwidth applications
            * 98% of AT&T smartphone customers use less than 2 GB in a month on average
            * If you exceed 2 GB, you'll get an additional 1 GB of data for only $10. Each time an additional 1 GB is used up during a cycle, you will automatically receive another 1 GB at the same low price.

  • Re:Funny (Score:3, Insightful)

    by magsol (1406749) on Tuesday June 22, 2010 @04:25PM (#32657780) Journal
    With Apple finally gaining in the markets, it's becoming profitable to create exploits. While the fanbois would have you believe that Apple products simply weren't exploitable, the simple facts are that 1) there simply weren't enough Apple products in the wild to justify an exploit, and 2) Apple seems to prefer the "silent failure" route (which, admittedly, is less obvious than a BSOD) so users don't know they've been compromised.

    Now that devices like the iPhone, iPad, even iPods have become all but ubiquitous, I bid Apple a very warm welcome to the malware-infested playing field M$ has been inhabiting all this time.
  • by sphantom (795286) on Tuesday June 22, 2010 @04:30PM (#32657834)

    This might be a perspective thing, but I read "Company X has patched a record number of security holes" as a negative thing, not as something the OP or company X is reporting to gloat about. I've taken the liberty of reading the links by the OP (shocking, I know), and didn't find any of them to really be coming across as something that anyone is looking for a pat on that back for (and for the record, I didn't see an official comment from Apple on their "record patch job").

    Fundamentally, you're right though. It'd be nice if companies could make flawless products, but it seems to be the exception rather than the rule, and when any company addresses a record number of fixes to a product's flaws, I see no reason why it shouldn't make the news. Granted, some fanboys will try and spin it into a positive of some kind, but that's not really shocking and we all know how trustworthy fanboys are.

    My $0.02.

  • by Mister Whirly (964219) on Tuesday June 22, 2010 @04:35PM (#32657884) Homepage

    Hence, thanks for fixing the stuff, Apple; better late security than no security.

    If you replaced Apple with Microsoft and posted that same statement, do you think you would have been rated Interesting or would you have been modded into negative oblivion with Flamebait or Troll? Why is it that Apple gets a free pass on everything it does half-assed regarding security, yet Microsoft's feet are held to the fire instantly?

  • by customizedmischief (692916) on Tuesday June 22, 2010 @04:39PM (#32657928)

    As a jailbreaker, it is always a little bittersweet to see my arbitrary code execution bugs fixed.

  • by proxima (165692) on Tuesday June 22, 2010 @04:46PM (#32658034)

    I'd hope that instead of spending that time patching iOS 3 they just try to release iOS 4 for iPad much sooner (that'd probably be the largest gain, after that if they really want they can work on porting the changes so the people with an original iPhone have security fixes, but I don't actually know the if the numbers would make it worthwhile).

    You have to support recent releases of your operating system with security updates, as not everyone is going to upgrade to the latest and greatest OS for any number of reasons. Lots of people with the 3G are reporting performance issues with iOS 4 (and few benefits). Until this release, OS updates for the ipod touch weren't free as well.

    This becomes extremely important in the enterprise, where changes are handled more carefully. These mobile platforms seem to be way too fast of a moving target, though. Even Mac OS X gets deprecated fairly quickly relative to enterprise schedules. It's clear that Apple just isn't targeting them, which I think is a shame.

  • by ivucica (1001089) on Tuesday June 22, 2010 @05:47PM (#32658852) Homepage
    Obviously it doesn't, seeing how I ended up with a 0 score. Not only that, your flamebait ended up with +4 insightful.

    And yes, I can honestly say that replacing Apple with Microsoft would yield almost same response from me. "Sloppy, Microsoft, but better late than never! Thanks". Not the same, but close.
  • by PeanutButterBreath (1224570) on Tuesday June 22, 2010 @07:27PM (#32659820)

    65 bugs that I won't get patches for in my 1st Generation Ipod Touch. What is the point of paying a premium for hardware, when the control-freak sole arbiter of software patches renders it functionally obsolete long before its useful life has expired?

"Say yur prayers, yuh flea-pickin' varmint!" -- Yosemite Sam

Working...