11.12.10

^{Gemini version available ♊︎}

Security Problems in iOS and Windows

Posted in Apple, Microsoft, Security, Windows at 1:46 am by Dr. Roy Schestowitz

Summary: Ways in which proprietary operating systems (even with excessive restrictions) get exploited and therefore cannot be kept under control by their users

SOFTWARE that contains code which cannot be audited is less likely to be secure. Many security folks agree on this point. Well, rather than use Linux as Apple engineers were about to do (Steve Jobs reportedly vetoed), Apple chose to pick code it need not contribute back to when building iOS, one of the world’s most restrictive platforms. Just because iOS is as locked down as a nail on a coffin does not make it secure, either. Appleʼs iOS dials calls without warning, researcher asserts” and an original post says:

I feel the risk posed by how URL Schemes are handled in iOS is significant because it allows external sources to launch applications without user interaction and perform registered transactions. Third party developers, including developers who create custom applications for enterprise use, need to realize their URL handlers can be invoked by a user landing upon a malicious website and not assume that the user authorized it. Apple also needs to step up and allow the registration of URL Schemes that can instruct Safari to throw an authorization request prior to yanking the user away into the application.

Apple has not managed to make the platform secure by expelling everything from it (except the list of “apps” that Apple approves). Kevin Lynch has just alleged that Apple is lying about its reasons for blocking Adobe Trash (Flash):

Last week, critics hammered Adobe over a report showing that Flash drained the new MacBook Air’s battery life by several hours. It’s not the first time Adobe has been in fisticuffs with Apple: the companies have been duking it out ever since Steve Jobs began ridiculing Flash and touting its alleged-killer, HTML5. Today, in an interview with Fast Company, Adobe CTO Kevin Lynch answered critics who might say HTML5 is somehow more efficient than Flash.

Irrespective of whether Apple is lying or not, Adobe Trash needs to go away. It’s a sore spot and it does not belong on the Web. But the point to be made here is that Safari is not secure, with or without Trash. Apple just cannot really use “security” as an excuse for blocking potentially millions of applications (or “apps” as Apple likes to call them, as if “applications” is too big a word for its clients to memorise).

Over at Microsoft’s side of things, “Stuxnet attack unleashes a torrent of SCADA hacks”:

Intelligence agencies and private cybersecurity companies worldwide are scrambling to reinforce online defenses against a tsunami of malware directed at online industrial control systems in the wake of a successful attack on Iran’s uranium enrichment plants by the Stuxnet worm.

Demand for experienced Supervisory Control and Data Acquisition software experts in the IT security marketplace now has reached record levels, according to various sources.

The sophistication and apparent effectiveness of the Stuxnet worm served as a reminder that national intelligence agencies can deploy formidable attacks when they focus their energies on a single target and do so knowing that their assaults probably will be traced back to their source.

More links about Stuxnet can be found in the links below. █