iPad Left Vulnerable After Record iPhone Patch Job 145
CWmike writes "With Monday's iOS 4 upgrade, Apple patched a record 65 vulnerabilities in the iPhone, more than half of them critical. However, the first-generation iPhone and iPod Touch, as well as the much newer iPad, may have been left vulnerable to some or all of the 65 bugs. iOS 4 cannot be installed on 2007's iPhone and iPod Touch, and the upgrade is not slated to reach iPad owners until this fall. The bug count is a record for the iPhone, surpassing the previous high mark of 46 vulnerabilities patched last summer with iPhone OS 3.0. Formerly known as iPhone OS 4, iOS 4 included 35 bugs, or 54% of the total, that were tagged with the phrase 'arbitrary code execution.' It's unclear how many, if any, of the vulnerabilities affect Apple's iPad. The media tablet runs an interim version of the operating system, dubbed iPhone 3.2, that followed the February iPhone 3.1.3 security update. It's possible that some of the bugs patched Monday were fixed by Apple before it launched the iPad in early April. But according to the Common Vulnerabilities & Exposures database, it's likely that many of the flaws fixed on Monday still exist in 3.2."
Re:It's a phone (Score:5, Insightful)
Stop with the "record number of bugs fixed" please (Score:2, Insightful)
If another person claims a "record" on the number of bugs fixed in an apple release out I'm gonna jump off a fucking cliff.
Bugs are not good. Lots of bugs are worse. Fixing them? You don't get a medal, you should have done it right the first time. Yes it's good to patch them, but it's not something to break out the champagne on. When I fix a huge bug list my boss says "about time", not "good job! way to work!".
Re:It's a phone (Score:5, Insightful)
Who cares if it has vulnerabilities. It's a phone.
A phone which is able to broadcast your real-time location.
A phone which has all your mails, all your texts and logs of all your calls, and a few private photoes to boot.
A phone with verified contact information for all your friends, and sellable information on yours and their preferences.
A phone that can call any number, including premium-rated ones owned by shady organizations.
Yeah. Who cares is someone else gains control of that?
Funny (Score:4, Insightful)
Funny how M$ us to be on top and all you'd read about was the security vulnerabilities left unpatched and with apple on top, with their new line of hardware, are having the same issues. I wonder if we'll ever see something like the Melissa virus, or the iJerk.
Re:Walled garden? (Score:1, Insightful)
Arbitrary Code Execution (Score:5, Insightful)
I wouldn't call that a bug. :-)
Re:Is this speculation? (Score:1, Insightful)
What is the point of speculating? It would be news if an exploit was in the wild.
well, the reason for disclosure is that it might already be exploited by someone, even if it's not public knowledge.
Re:It's a phone (Score:3, Insightful)
A phone which is able to broadcast your real-time location.
A phone which has all your mails, all your texts and logs of all your calls, and a few private photoes to boot.
A phone with verified contact information for all your friends, and sellable information on yours and their preferences.
A phone that can call any number, including premium-rated ones owned by shady organizations.
Yeah. Who cares is someone else gains control of that?
On top of calling pay phone numbers (900 numbers and such) if it copies all your data to a server somewhere you may go over your data plan and have to pay $15 per 200MB transferred or $10 per 1GB transferred depending on your plan.
DataPlus - 200 MB of data for $15 per month
* Designed for people who primarily surf the Web, send email, and use social networking apps.
* On average, 65% of AT&T smartphone customers use less than 200 MB per month
* If you use more than 200 MB, you'll receive an additional 200 MB of data usage for $15, replenished as often as necessary during the billing cycle.
DataPro - 2 GB of data for $25 per month
* Designed for people who regularly download or stream music and video, or use other high bandwidth applications
* 98% of AT&T smartphone customers use less than 2 GB in a month on average
* If you exceed 2 GB, you'll get an additional 1 GB of data for only $10. Each time an additional 1 GB is used up during a cycle, you will automatically receive another 1 GB at the same low price.
Re:Funny (Score:3, Insightful)
Now that devices like the iPhone, iPad, even iPods have become all but ubiquitous, I bid Apple a very warm welcome to the malware-infested playing field M$ has been inhabiting all this time.
Re:Stop with the "record number of bugs fixed" ple (Score:2, Insightful)
This might be a perspective thing, but I read "Company X has patched a record number of security holes" as a negative thing, not as something the OP or company X is reporting to gloat about. I've taken the liberty of reading the links by the OP (shocking, I know), and didn't find any of them to really be coming across as something that anyone is looking for a pat on that back for (and for the record, I didn't see an official comment from Apple on their "record patch job").
Fundamentally, you're right though. It'd be nice if companies could make flawless products, but it seems to be the exception rather than the rule, and when any company addresses a record number of fixes to a product's flaws, I see no reason why it shouldn't make the news. Granted, some fanboys will try and spin it into a positive of some kind, but that's not really shocking and we all know how trustworthy fanboys are.
My $0.02.
Re:They're no bugs in Apple products! (Score:2, Insightful)
Hence, thanks for fixing the stuff, Apple; better late security than no security.
If you replaced Apple with Microsoft and posted that same statement, do you think you would have been rated Interesting or would you have been modded into negative oblivion with Flamebait or Troll? Why is it that Apple gets a free pass on everything it does half-assed regarding security, yet Microsoft's feet are held to the fire instantly?
But I *like* to execute arbitrary code. (Score:2, Insightful)
As a jailbreaker, it is always a little bittersweet to see my arbitrary code execution bugs fixed.
Re:No ipad updates of any kind (Score:4, Insightful)
You have to support recent releases of your operating system with security updates, as not everyone is going to upgrade to the latest and greatest OS for any number of reasons. Lots of people with the 3G are reporting performance issues with iOS 4 (and few benefits). Until this release, OS updates for the ipod touch weren't free as well.
This becomes extremely important in the enterprise, where changes are handled more carefully. These mobile platforms seem to be way too fast of a moving target, though. Even Mac OS X gets deprecated fairly quickly relative to enterprise schedules. It's clear that Apple just isn't targeting them, which I think is a shame.
Re:They're no bugs in Apple products! (Score:4, Insightful)
And yes, I can honestly say that replacing Apple with Microsoft would yield almost same response from me. "Sloppy, Microsoft, but better late than never! Thanks". Not the same, but close.
Glad I shelled out for premium hardware! (Score:5, Insightful)
65 bugs that I won't get patches for in my 1st Generation Ipod Touch. What is the point of paying a premium for hardware, when the control-freak sole arbiter of software patches renders it functionally obsolete long before its useful life has expired?