Bonum Certa Men Certa

Security Problems in iOS and Windows

Utah State Prison Wasatch Facility with Apple



Summary: Ways in which proprietary operating systems (even with excessive restrictions) get exploited and therefore cannot be kept under control by their users

SOFTWARE that contains code which cannot be audited is less likely to be secure. Many security folks agree on this point. Well, rather than use Linux as Apple engineers were about to do (Steve Jobs reportedly vetoed), Apple chose to pick code it need not contribute back to when building iOS, one of the world's most restrictive platforms. Just because iOS is as locked down as a nail on a coffin does not make it secure, either. Appleʼs iOS dials calls without warning, researcher asserts" and an original post says:



I feel the risk posed by how URL Schemes are handled in iOS is significant because it allows external sources to launch applications without user interaction and perform registered transactions. Third party developers, including developers who create custom applications for enterprise use, need to realize their URL handlers can be invoked by a user landing upon a malicious website and not assume that the user authorized it. Apple also needs to step up and allow the registration of URL Schemes that can instruct Safari to throw an authorization request prior to yanking the user away into the application.


Apple has not managed to make the platform secure by expelling everything from it (except the list of "apps" that Apple approves). Kevin Lynch has just alleged that Apple is lying about its reasons for blocking Adobe Trash (Flash):

Last week, critics hammered Adobe over a report showing that Flash drained the new MacBook Air's battery life by several hours. It's not the first time Adobe has been in fisticuffs with Apple: the companies have been duking it out ever since Steve Jobs began ridiculing Flash and touting its alleged-killer, HTML5. Today, in an interview with Fast Company, Adobe CTO Kevin Lynch answered critics who might say HTML5 is somehow more efficient than Flash.


Irrespective of whether Apple is lying or not, Adobe Trash needs to go away. It's a sore spot and it does not belong on the Web. But the point to be made here is that Safari is not secure, with or without Trash. Apple just cannot really use "security" as an excuse for blocking potentially millions of applications (or "apps" as Apple likes to call them, as if "applications" is too big a word for its clients to memorise).

Over at Microsoft's side of things, "Stuxnet attack unleashes a torrent of SCADA hacks":

Intelligence agencies and private cybersecurity companies worldwide are scrambling to reinforce online defenses against a tsunami of malware directed at online industrial control systems in the wake of a successful attack on Iran’s uranium enrichment plants by the Stuxnet worm.

Demand for experienced Supervisory Control and Data Acquisition software experts in the IT security marketplace now has reached record levels, according to various sources.

The sophistication and apparent effectiveness of the Stuxnet worm served as a reminder that national intelligence agencies can deploy formidable attacks when they focus their energies on a single target and do so knowing that their assaults probably will be traced back to their source.


More links about Stuxnet can be found in the links below.

  1. Ralph Langner Says Windows Malware Possibly Designed to Derail Iran's Nuclear Programme
  2. Windows Viruses Can be Politically Motivated Sometimes
  3. Who Needs Windows Back Doors When It's So Insecure?
  4. Windows Insecurity Becomes a Political Issue
  5. Windows, Stuxnet, and Public Stoning
  6. Stuxnet Grows Beyond Siemens-Windows Infections
  7. Has BP Already Abandoned Windows?
  8. Reports: Apple to Charge for (Security) Updates
  9. Windows Viruses Can be Politically Motivated Sometimes
  10. New Flaw in Windows Facilitates More DDOS Attacks
  11. Siemens is Bad for Industry, Partly Due to Microsoft
  12. Microsoft Security Issues in The British Press, Vista and Vista 7 No Panacea
  13. Microsoft's Negligence in Patching (Worst Amongst All Companies) to Blame for Stuxnet
  14. Microsoft Software: a Darwin Test for Incompetence
  15. Bad September for Microsoft Security, Symantec Buyout Rumours
  16. Microsoft Claims Credit for Failing in Security
  17. Many Windows Servers Being Abandoned; Minnesota Goes the Opposite Direction by Giving Microsoft Its Data
  18. Windows Users Still Under Attack From Stuxnet, Halo, and Zeus
  19. Security Propaganda From Microsoft: Villains Become Heroes

Recent Techrights' Posts

Microsoft Bankruptcy
"Microsoft unit in Russia to file for bankruptcy, database shows"
Techrights Does Not Compete With LLM Slop, It Exposes the Bastards, Plagiarists and Scammers Who Do That
People like Scam Altman, still facing a lawsuit from his own sister for sexual abuse against her
 
Google Bribes EFF. EFF Promotes LLM Slop as 'Fair Use'. To GAFAM It's a Low-Cost Lobby Hedge.
So the bribes pay off ("slush fund") and the word spreads
Slopwatch: Fake Text and Images, Financial Bubbles, and Scams in "Intelligent" Clothing
Sometimes what they mean by "AI" is just cheap labour somewhere else, as we discussed in IRC a few hours ago
Why Microsoft is Collapsing (Similar to What's Happening at IBM), As Insiders See It
IBM seems like one heck of a mess
Reliable Computing Means Free (Libre) Computing
Sites that want to promote security ought to deal with the biggest issues
Links 31/05/2025: US Court Orders Sides With RFE/RL, War Updates From Ukraine
Links for the day
Gemini Links 31/05/2025: ARM Server and power_supply Subsystem
Links for the day
Links 31/05/2025: Slop Stigmatised as Disinformation, Catalyst/Driver of "Death of Communication"
Links for the day
Common Sense 101: Do Not Write Blog Posts Saying You Want to Murder Colleagues (or Yourself)
Only crazy people would think stabbings are a joke
Links 31/05/2025: Microsoft-Connected Builder.ai is a Fraud and US is Purging Students Based on Race/Nationality
Links for the day
Gemini Links 30/05/2025: Limmat, Doomscrollers, and Arguments Parsing
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, May 30, 2025
IRC logs for Friday, May 30, 2025
The "AI" (Slop) Bubble Already Popped, But It's Not an Overnight Collapse
where Microsoft put its money
No More Steven Astorino at IBM, Chatter About Weekly/Nonstop Layoffs at IBM
What happened? Good luck guessing.
Looking at Corruption in Europe, Going Beyond the EPO
Expect a new series to kick off very soon
Slopwatch: Security SPAM and LLM Slop for SEO and FUD Purposes, Perpetually Tarnishing the Perception of Linux and (Open)SSH Security
A lot of this Fear, Uncertainty, Doubt (FUD) comes from Microsoft and its LLMs
Links 30/05/2025: Google's LLM Slop Pushers Are Killing Journalism and Shira Perlmutter Fails to Stop Bribed Regime From Legalising Plagiarism (in "AI" Clothing)
Links for the day
Links 30/05/2025: Offline Arts and "Threshold of Patience"
Links for the day
Signing Off Serious Lies With a Statement of Truth is No Joking Matter
It's not hard to see what's happening here
Links 30/05/2025: LLM Slop Already Ingests and Vomits Its Own Garbage, Facebook Exec Admits Copyrights a Concern Too
Links for the day
Mass Layoffs at Microsoft Result in More Whistleblowers From Microsoft
Microsoft's predatory pricing is further
Slopwatch: Planet Ubuntu Became LLM Slop and Some People Fail to See the Immorality of Plagiarism
it lessens the incentive for people to publish real articles
EPO Poll: 68% Dissatisfied With Quality of Slop (Wrongly Framed as "AI") for Patent Classification
Slop does not work, it's just falsely advertised with extra hype (funded by slop pushers that sponsor the major media)
Big Crowds Gather to Learn About Software Freedom From the Man Who Started GNU/Linux in 1983
"It was a great success"
Microsoft Layoffs Again in Bay Area
Microsoft relies on people's false belief that being "in LinkedIn" will get you a job; well, seems like even working inside LinkedIn really sucks and you lose the job
Gemini Links 30/05/2025: Fighting Against the Bad News, and Slop is Dehumanisation Disguised as "Intelligence"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, May 29, 2025
IRC logs for Thursday, May 29, 2025
Links 29/05/2025: Chinese Cracking Against EU Institutions (Prague), More Assaults on Media and Its Funding Sources
Links for the day
EPO Workers Caution That the Officials Are Still Illegally Trying to Replace Staff With Slop (to Lower Quality and Validity of European Patents)
Nobody in Europe voted for any of this
Links 29/05/2025: US Health Deficit and Malware Disguised as Slop Generator
Links for the day
Links 29/05/2025: Turtle Roadkill, Modern 'Tech' as a Sting
Links for the day
Thanks for All the Fish, Linux Format
people who once wrote for it (or for other magazines) comment on the importance of this news
People's Understanding of the History of GNU/Linux is Changing
RMS is not a radical, he's just clever enough to see and foresee what's going on
Microsofters Were Scheming to Take Over This Entire Web Site (in Their Own Words!)
Money gets spent censoring/deplatforming people who speak about real issues; no money gets spent actually tackling those underlying issues
Bicycles for the Minds and the Story Harrison Bergeron
"The goal of having people in charge of the tools they use and that the tools should amplify ability" has long been abandoned
Links 29/05/2025: YouTube Problem and Giant Privacy Hole in Microsoft OneDrive
Links for the day
[Video] Cory Doctorow Explains DMCA: DRM in the Browser (or Webapp) Will "Make It a Felony to Protect Your Privacy While You Use It."
Pycon US Keynote Speaker Cory Doctorow
United States Courts With Sworn Testimonies Are on Our Side, We'll Present the Same Here
Chronicling what happened is a moral imperative
Serial Sloppers Ruin and Lessen the Incentive to Cover "Linux"
The Serial Sloppers (SSs) ought to be named and shamed, but almost nobody does this
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, May 28, 2025
IRC logs for Wednesday, May 28, 2025