Apple iPhone
Researchers have uncovered more problems with the design and implementation of security on the iPhone

Remote control flaw found in iPhone

Attackers could take complete control of the platform

Written by Iain Thomson

A team of security researchers in the US claims to have found a flaw in Apple's iPhone that could allow a hacker to take complete control of the device via Wi-Fi.

Independent Security Evaluators, headed by a former professor at Johns Hopkins University, found the hole last week, developed a patch and alerted Apple to the problem. 

"There are serious problems with the design and implementation of security on the iPhone," said the company in a Security Evaluation paper (PDF) on the flaw. 

"The most glaring is that all processes of interest run with administrative privileges. This implies that a compromise of any application gives an attacker full access to the device."

The exploit uses a web page with malware built in that can access the phone via the Safari browser.

This can either be used to force the phone to send personal information stored in its files or to take control of the device and make it place outgoing calls to other numbers.

"Unfortunately, once an iPhone application is breached by an attacker, very little prevents the attacker from obtaining complete control of the system," the team said.

"Additionally, no address randomisation is used in by the operating system. This means that each time a process runs, the stack, heap and executable code is located at precisely the same spot in memory. This helps attackers write reliable exploit code."

Experts have already warned that the phone may be as insecure as a PC because of its powerful operating system, and problems have already been reported with the dialler software

Matt Bancroft, vice president at mobile device management company Mformation, said: "All mobile phones are becoming more powerful, and the iPhone is really a sophisticated mini computer. 

"As we get more powerful mobile devices, it is inevitable that we will get more security issues and threats to mobile devices.

"The key is to manage the device once it is in the hands of the user. Being able to update or patch the security and applications over the air in an ever-changing environment is the way forward."

Tags:

Further reading

Special Report: Apple iPhone

All the latest news on Apple's iPhone   More...

iPhone 'may never be secure'

Power could be its downfall   More...

Zombie botnet targets iPhone buyers

'One of the most sophisticated' scams in recent times   More...

'DVD Jon' cracks iPhone activation

Hacker shows how to bypass AT&T sign-up   More...

Related articles

iPhones crash university Wi-Fi network

One handset enough to cause a 10-minute stall   More...

iPhone update thwarts hacks

New firmware disables SIM-hacked phones   More...

iPhone vulnerable to DoS attack

Apple's mobile browser flawed, claims security firm   More...

Mega Apple patch fixes iPhone, Safari, OS X bugs

Update repairs 54 vulnerabilities   More...

Do you agree?

Advertisement

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Watch

16 May 2008

2.97 MBXP on OLPC, broken dreams and Yahoo fights back More...

15 May 2008

3.28 MBDark fibre, mobile TV and solar power More...

14 May 2008

2.66 MBOnline inequality, mobile thumbprints and corporate raids More...

Poll

HOME WORKING

HOME WORKING

Do you let any or all of your employees work from home?

Previous poll results

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Spotlight

OLPC

OLPC to ship with Windows XP

Microsoft teams up with One Laptop per Child project   More...

The Sims

The Sims goes flat-pack with Ikea

Virtual world gets Swedish wood   More...

Advertisement

Microsoft-Yahoo

Yahoo board fights back at Icahn

Investor accused of 'significant misunderstanding' in Microsoft saga   More...

MySpace

Woman charged over MySpace suicide

Lori Drew indicted on federal charges   More...

Advertisement