The odd thing is the app can’t scan the filesystem of the device due to the iOS sandbox – but it can scan remotely hosted files (e-mail attachments, files in your Dropbox account and on on).

It’ll be interesting to see what kind of response this app gets and if people will be interested in purchasing it.

A French security company known for its Mac OS X antivirus software today released the first malware-scanning app for the iPhone and iPad and iPod Touch. Intego’s VirusBarrier for iOS has been approved by Apple, and debuted on the App Store Tuesday for $2.99.

Because iOS prevents the program from accessing the file system or conducting automatic or scheduled scans — as do virtually all Mac and Windows antivirus software — VirusBarrier must be manually engaged, and then scans only file attachments and files on remote servers, said Peter James, a spokesman for Intego.

“Because of the sandbox, you can’t scan the file system,” said James. “Since you don’t see the iOS file system, the only things you can scan are attachments sent by email or files in, say, your Dropbox folder.”

Unlike software written for Android — such as Lookout, from the San Francisco-based company by the same name — VirusBarrier cannot scan apps for possible infection. When an email attachment is received by the iPhone, iPad or iPod Touch, the user can intercede by calling on VirusBarrier, which then scans the file for possible infection before the file is opened or forwarded to others.

“We’ve had enterprise customers say that although they know you can’t do a full system scan of an iPhone, they don’t like the fact that files go through these devices and end up on a Mac or Windows PC,” said James. “They want their users to be able to check that an attachment is safe.”

It also can’t scan apps for possible infection, which is kind of weak – but I guess it’s supportive of the walled garden approach implemented by Apple. Seen as though all official apps are vetted by Apple there shouldn’t be any infections anyway (unless the user executed a JailBreak their device).

Symantec did make some kind of push into the iOS market in October 2010, but I’m not sure what came of it – Symantec Expands Security Products To Cover Android & iOS.

With the whole model Apple is running on the iOS platform – there honestly isn’t that many vectors for attack.

He characterized VirusBarrier for iOS as a way for iPhone and iPad users to prevent their hardware from spreading malware. “You don’t want your iPhone becoming a ‘Typhoid Mary,’” James said.

VirusBarrier for iOS can scan email attachments in a variety of formats, including Microsoft’s Word, Excel and PowerPoint; PDF documents; JavaScript files; and Windows executables, those files tagged with the .exe extension. It can also scan files in a Dropbox folder, those stored on MobileMe’s iDisk, or files downloaded via the iOS version of Safari. The scanning engine and signatures — the digital “fingerprints” used to detect malware — in VirusBarrier for iOS are identical to those used by Intego’s Mac OS X product line.

VirusBarrier for iOS lets iPhone and iPad users run on-demand scans of email attachments before those files are opened or forwarded.

“It’s important that people understand what [VirusBarrier] can and cannot do,” said James, pointing to the malware scanner’s limitations. “Although there is no malware written for iOS today, if attackers do try to exploit the [recent] PDF vulnerability, this is something we can scan for.”

James was referring to the still-unpatched vulnerability in iOS that can be exploited through a malicious PDF document, one of two bugs used last week to “jailbreak” an iPhone , iPad or iPod Touch. VirusBarrier for iOS can be downloaded to an iPhone, iPad or iPod Touch from Apple’s App Store. It requires iOS 4.0 or later.

You can check out the app on Apple’s App Store here:

VirusBarrier By Intego

Basically the purpose of the app seems to more towards halting malware application on the iPhone – rather than preventing the device itself getting infected. You can read a lot more about it on the App Store description.

Source: Network World

Their latest move is to offer security for the hot smartphone platforms Android and iOS, which powers the new iPhone 4 and iPad. The most recent security flaw on Android was due to an exploit in Flash that could be used to compromise the system.

They can move into this area with the expertise from their purchase of VeriSign earlier this year. They already have mobile security support for Symbian, BlackBerry and Windows Mobile.

Symantec is extending its support of smartphone platforms in a bid to make its security and management technology as ubiquitous in the mobile world as it is on the desktop. The security giant announced added support for Android and Apple iOS platforms to its mobile security and management portfolio during the opening of its Symantec Vision conference in Barcelona today. This is in addition to existing support for Windows Mobile, Symbian and BlackBerry smartphones

The technology covers functions such as device security, encryption and authentication. Password policy enforcement, remote wipe and device inventory functions are also included in enterprise versions of the software.

VeriSign Identity Protection (VIP) Access for Mobile, PGP Mobile and Symantec Endpoint Protection Mobile Edition are the three main products in Symantec’s push to sell both enterprises and service providers on its ability to minimise problems such as mobile network misuse, malware proliferation and spam. The enterprise versions of the product are available immediately, with the telecoms carrier versions coming online next quarter. Symantec paid $1.3bn to buy VeriSign in May and intends to make good of this investment with increased sales in mobile technology.

I’d say those users who have security problems on the iOS platform are most commonly those have executed some kind of jailbreak on the device. The most memorable of course being the rickrolling of users, which was shortly followed by a malicious version of the worm.

From what I know though with a correct implementation of BES aren’t BlackBerry users already covered on all these fronts? And as for iOS as long as it hasn’t been jailbroken and it’s using Mail for Exchange I don’t see any danger.

Same goes for Android, as long as it’s not rooted..it should be safe.

The payment by phone concept has been kicking around the IT industry for some years. It’s an appealing idea but many pieces need to fall in place to realise the vision. Handset manufacturers, mobile telcos, payment providers, banks and retailers all need to be on board – quite apart from the security piece, which Symantec is in as good a place as anyone in the security market to supply.

Salem acknowledged the difficulty of the IT industry as a whole to make the e-wallet concept a reality. Symantec’s strategy is to focus on building bilateral relationships, starting with a small number of retailers and payment providers. “There’s not going to be one ID for the internet,” Salem said. “The idea that there will be one authoritative service is far-fetched. It’s not going to happen.”

Symantec also wants to persuade consumers to buy Norton Mobile Security for Android, possibly in extension to existing desktop versions of Symantec’s consumer-focused security software, to tackle the yet-to-emerge threat of malware capable of infecting Android devices. While it’s true that a couple of SMS Trojans infecting Android smartphones have appeared in Russia, the problem is minuscule compared to the hundreds of thousands of strains of Windows-specific worms, Trojan, viruses, rootkits and botnet agents that have been the mainstay of the security threat landscape for many years.

What I really don’t need is another process swallowing up cycles on my 600mhz mobile processor. As the desktop market is pretty saturated I’d expect to see more security companies coming out with solutions for mobile platforms.

The smartphone market is exploding right now so I’m pretty sure bad things will start to happen soon enough.

Source: The Register

Now it wasn’t long ago when the first malicious iPhone worm appeared in the wild and well generally since the boom of the device people have looking at the security measures.

Huge sales are made to corporates touting the security, privacy and encryption features of the iPhone OS. The latest discovery is that using a PIN on your iPhone 3GS really doesn’t protect you from anything as long as the person has physical access to your phone.

But then the same thing goes for desktop/laptop computers too, if someone has physical access you’re done for.

Using a four-digit PIN to lock your iPhone doesn’t really protect your data, security and IT blogger Bernd Marienfeldt has discovered. In an article describing the iPhone’s business security framework, Marienfeldt has found a “data protection vulnerability” in Apple’s iPhone 3GS.

Marienfeldt, working with security expert Jim Herbeck, has been able to reproduce the vulnerability on at least three non jail-broken iPhone 3GS handsets with different iPhone OS versions installed (including the latest). All tested iPhones were protected with a four-digit PIN.

In Marienfeldt’s own words:

“The unprotected iPhone 3GS mounting is “limited” to the DCIM folder under Ubuntu < 10.04 LTS, Apple Macintosh, Windows 2000 SP2 and Windows 7. The way Ubuntu Lucid Lynx handles the iPhone 3GS [6,7,8] allows to get more content (please do make sure that the native Ubuntu system is fully up to date, e.g. "apt-get update, "apt-get upgrade" - any virtualization based solution will not work as described). I used the Alternate CD with x86 and AMD64 on different hardware."

I guess with phones/embedded system we expected the user data to a little more secure and well we guessed wrongly. With a total of 33.75 million iPhones sold up to Q4 2009 that’s a staggering amount of vulnerable devices out there.

Another issue is Apple haven’t as yet worked out what the problem is, they’ve given some vague mentions of “race conditions” or “a pairing issues” but haven’t been able to reproduce it so far.

Other people have had varying success in exploiting the flaw, it seems to depend on the actual iPhone itself rather than anything else.

Basically, plugging an up-to-date, non jail-broken, PIN-protected iPhone (powered off) into a computer running Ubuntu Lucid Lynx will allow the people to see practically all of the user’s data–including music, photos, videos, podcasts, voice recordings, Google safe browsing databases, and game contents. The “hacker” has read/write access to the iPhone, and the hack leaves no trace.

According to Marienfeldt, “The allowed write access could also lead into triggering a buffer overflow.” A buffer overflow could allow full write access, and full write access could potentially lead to the attacker being able to make phone calls (as far as we know, the attacker can access all of your data but they can’t make any phone calls…how reassuring).

Marienfeldt points out that this is especially an issue for corporate/business users, who “rely on the expectation that their iPhone 3GS’s whole content is protected by encryption with a passcode based authentication in place to unlock it.”

Apple has been notified of the flaw, but has yet to correct it (or give a timeline for the correction).

I hope Apple can address this phone and give a proper breakdown and explanation of why this happens, there must be some technical explanation for it and why it occurs in their so called ‘secure’ implementation.

You can read the original blog post here:

iPhone business security framework

Source: Network World

It’s a little less than 2 weeks since the Jailbroken iPhone Users Got Rickrolled and as I thought a similar worm has been seen in the wild – but this time with malicious intent.

As the rickrolling incident showed, even the more savvy users that jailbreak their phones neglect to change the default SSH password meaning they can easily be rooted…and well this new worm is doing just that.

The user as usual is the weak link here, it’s not a true exploit – just an unchanged default password.

A Dutch internet service provider has identified a worm that installs a backdoor on jailbroken iPhones and makes them part of a botnet.

The worm, according to XS4ALL, targets jailbroken iPhones whose owners have carelessly failed to change the default password. In addition to connecting to a Lithuanian master command channel, it also changes the root password for the device, making it harder for owners trying to regain control. Infected iPhones are also tagged with a unique ID number.

“A number of customers with jailbroken phones have been found running unknown software on their phones which is trying to compromise other iPhone users at other telecommunications providers,” the XS4ALL advisory stated. “XS4ALL strongly advises caution against jailbreaking if you are not fully aware of the potential risks to your privacy and security.”

It’s quite smart, after installing itself it’ll change the root password (from my point of view to stop it getting reinfected and b0rked) and also to make it harder for the phone user to take back control.

I think it’s the first time I’ve seen a mobile device be infected and hooked up to a botnet, I thought it might happen with consoles before..but now with mobile 3G/3.5G Internet and powerful CPUs in mobile phones the next big thing might be botnets running on iPhones, Android and Symbian devices.

The worm has the ability to pillage SMS databases, and an analysis by Security.nl (English translation here) has identified a script that looks for mobile transaction authentication numbers used by some banks to perform two-factor authentication with SMS-based systems. (Sophos also has analysis here.)

The worm tries to propagate by scanning a variety of IP ranges, including those used by carriers T-Mobile, UPC in the Netherlands, and Optus in Australia. The worm is especially active when it has access to wi-fi networks. One tip-off that a device has been infected is that battery life is extremely short when connected to 802.11 networks because the worm generates so many connections. The worm is not widespread, F-Secure said Sunday.

The attacks come two weeks after a separate piece of self-replicating code caused iPhones mostly located in Australia to display images of Rick Astley, the schmaltzy 1980s pop singer. The most recent outbreak appears to be the first instance of malicious iPhone malware spreading in the wild.

So do your friends a favour and tell anyone with a jailbroken iPhone to change the default SSH password to something else! Just doing that will save them from the current crop of threats.

I wonder what else will come of this, will it become a widespread infection of jailbroken iPhone users? Will it reach every continent?

Over here in asia iPhones are fairly popular, but not hugely so like in the US. I’d say if there’s anywhere ripe for some iPhone mayhem it would be America.

Source: The Register

The ‘big’ news this week was the first self-replicating worm hit the iPhone, it only seemed to be spreading in Australia though and only worked under a specific set of circumstances.

It only effects iPhone users that have jailbroken their phone and have the SSH software installed with a default password of alpine.

Thankfully it’s not particularly malicious unless you are allergic to Rick Astley.

iPhone owners in Australia awoke this weekend to find their devices targeted by self-replicating attacks that display an image of 1980s heart throb Rick Astley that’s not easily removed. The attacks, which researchers say are the world’s first iPhone worm in the wild, target jailbroken iPhones that have SSH software installed and keep Apple’s default root password of “alpine.” In addition to showing a well-coiffed picture of Astley, the new wallpaper displays the message “ikee is never going to give you up,” a play on Astley’s saccharine addled 1987 hit “Never Gonna Give You Up.”

Tricking victims in to inadvertently playing the song has become a popular prank known as Rickrolling. A review of some of the source code, shows that the malware, once installed, searches the mobile phone network for other vulnerable iPhones and when it finds one, copies itself to them using the the default password and SSH, a Unix application also known as secure shell. People posting to this thread on Australian discussion forum Whirlpool first reported being hit on Friday.

A new twist on the rickrolling phenomena at least, and of course the good thing for the rest of the World is that the infection seems to be fairly localized.

To me it’s more of a PoC (Proof of Concept) than anything else, but it is a neat piece of programming and shows what some malicious minds could put together if they wanted to target iPhones.

From the authors perspective he just wants to let people know that if they are gonna mess with their iPhone they better secure their shit.

The attack is a wakeup call for anyone who takes the time to jailbreak an iPhone. While the hack greatly expands the capabilities of the Apple smartphone, it can also make it more vulnerable. Programs such as OpenSSH, which can only be installed after iPhones have undergone the procedure, can be extremely useful, but if owners haven’t bothered to change their root password, the programs also represent a gaping hole waiting to be exploited.

Indeed, a hacker going by the moniker ikee and claiming to be responsible for the worm said here that he wrote the program to bring awareness to the widely followed practice of failing to change the iPhone’s password.

“I was quite amazed by the number of people who didn’t RTFM and change their default passwords,” the unidentified worm writer said. “I admit I probably pissed of [sic] a few people, but it was all in good fun (well ok for me anyway).”

Ikee said the worm disables the SSH daemon so it can’t be targeted further.

And in the true hacker spirit, the worm disables SSH so it can’t get infected again or hacked by anyone else.

It doesn’t takes skills to own the box, it takes skills to stay on the box :)

Source: The Register

Once again Apple iPhone has been unlocked by a determined youngster, the same who was amongst the first to unlock it last year winning himself a rather nice car and a few 8gb iPhones.

It just shows nothing is infallible, all he needed to find was a writable memory address and he was pretty much done (he used a much higher range of registers than previously).

A teen hacker known for his deftness with iPhones has figured out how to unlock models running the latest firmware versions by cracking a protection that has frustrated hackers for weeks.

The breakthrough by George Hotz, aka Geohot, means people who have bought a recent iPhone will once again be able to use it on the phone network of their choice. Apple makes as much as $400 for every handset that’s activated on an approved network, so its developers have worked hard to prevent the so-called unlocking of iPhones.

A very smart young man indeed, just showing 1 person can indeed defeat the security of a huge multi-national billion dollar company.

And he’s done it twice.

The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device’s memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable.

“I guess Apple thought big numbers were harder to guess,” he wrote.

He then found a way to install his custom-built code by exploiting a flaw that allowed him to erase a range of memory addresses where security software is stored.

An amazing 27% of iPhones are running on unauthorized networks which means they are cracked. Of course Apple will soon come out with a new firmware update that negates this problem….but then the game will just start all over again.

And no one doubt Geohot or someone like him will break it again.

If you want to know how to do it check out step-by-step instructions here from iClarified here.

Source: The Register