Researcher: iPhone bug could let hackers steal photos, contacts and send texts Skip to main content

Researcher: iPhone bug could let hackers steal photos, contacts and send texts

(CNN) -- A bug in Apple's mobile operating system allows hackers to take control of iPhone and iPad apps, using them to steal people's photos, contacts and even send text messages without the device's user knowing about it, according to a notable computer security researcher.

Charlie Miller, a researcher at Accuvant and one of the world's best-known Apple hackers, said Tuesday that the bug proves the Apple App Store isn't as safe as advertised.

"Until now, you could just blindly trust and download as many apps as you wanted and not worry about it," Miller said in an interview with CNN. "But until they fix this, you really should think twice about any apps you're downloading, because they could be malicious."

Miller said he alerted Apple to the bug three weeks ago and the company told him a fix was in the works. Apple did not respond to CNN's request for comment on the apparent security flaw, which Miller explains in detail on YouTube.

He plans to show people how the bug works at an upcoming computer security conference in Taiwan, called SyScan. To date, he has not released details that would allow hackers to take advantage of the apparent security flaw, and he said he has no evidence that hackers have used the hole to manipulate iPhones and iPads.

Miller says he has exposed the bug to prevent a hacker with bad intentions from taking advantage of iPhone and iPad owners.

As thanks for that work, he said, Apple banned him from the iOS developer program for a year.

"I think it's pretty rude," he said. "If you think about what I'm doing -- I'm pointing out a flaw that would affect everybody and that the bad guys could use to install malware (malicious software). And they're not paying me, I'm just doing it to be nice."

He did upload an app, called Instastock, which was armed with this capability, he said. That app only was capable of hurting his own devices, he said, and was uploaded to the App Store to test the bug. "It's not evil or bad or anything," he said. "It never even downloads code and runs it unless I run it." It since has been removed from the App Store.

If hackers found the security flaw, he said, any iOS app could be compromised in a way that malicious code could be installed through the app and onto the device.

"It could grab your address book and ship it off to the bad guy," he said. "It could grab all your photos and ship them off to a bad guy."

That's a big deal for Apple's App Store, he said, since until now, that online marketplace for iPhone and iPad programs had been free of malicious software. Apple checks each app before it's approved for sale at the App Store, which allows the company to keep bugs out.

This hack could take advantage of a flaw in that checking system to compromise any app, Miller said. He said that essentially reduces the App Store's security to that of the Google Android Market, since Google doesn't screen apps in the way Apple does.

But overall, the App Store is still safer than the Android Market, Miller said.

"It's totally just a blip," he said of the security hole. "I'm very happy with the way (Apple has) designed the system to prevent malware. It's really the ideal situation."

He added: "It's a very safe environment except for this. It just shows that you've never completely safe."

Comments

Popular posts from this blog

Chronology of the Press in Burma

1836 – 1846 * During this period the first English-language newspaper was launched under British-ruled Tenasserim, southern  Burma . The first ethnic Karen-language and Burmese-language newspapers also appear in this period.     March 3, 1836 —The first English-language newspaper,  The Maulmain Chronicle , appears in the city of Moulmein in British-ruled Tenasserim. The paper, first published by a British official named E.A. Blundell, continued up until the 1950s. September 1842 —Tavoy’s  Hsa-tu-gaw  (the  Morning Star ), a monthly publication in the Karen-language of  Sgaw ,  is established by the Baptist mission. It is the first ethnic language newspaper. Circulation reached about three hundred until its publication ceased in 1849. January 1843 —The Baptist mission publishes a monthly newspaper, the Christian  Dhamma  Thadinsa  (the  Religious Herald ), in Moulmein. Supposedly the first Burmese-language newspaper, it continued up until the first year of the second Angl

Thai penis whitening trend raises eyebrows

Image copyright LELUXHOSPITAL Image caption Authorities warn the procedure could be quite painful A supposed trend of penis whitening has captivated Thailand in recent days and left it asking if the country's beauty industry is taking things too far. Skin whitening is nothing new in many Asian countries, where darker skin is often associated with outdoor labour, therefore, being poorer. But even so, when a clip of a clinic's latest intriguing procedure was posted online, it quickly went viral. Thailand's health ministry has since issued a warning over the procedure. The BBC Thai service spoke to one patient who had undergone the treatment, who told them: "I wanted to feel more confident in my swimming briefs". The 30-year-old said his first session of several was two months ago, and he had since seen a definite change in the shade. 'What for?' The original Facebook post from the clinic offering the treatment, which uses lasers to break do

Myanmar Villagers Tell of 150 Homes Burned in Deadly Army Air Attacks

Artillery fire and aerial bombardments by Myanmar forces killed three civilians and burned scores of houses in their communities in mid-March amid fighting between Myanmar forces and the rebel Arakan Army in war-ravaged Rakhine state, villagers recounted Monday at a press conference. Villagers from Kyauktaw township in western Myanmar's Rakhine state discuss the government military's attacks on their communities at press conference in Sittwe, March 30, 2020. They made the comments after traveling from in Kyauktaw township to the state capital Sittwe to give testimony on a series of attacks on civilian dwellings amid a government-imposed internet shutdown in nine townships in Rakhine and neighboring Chin state, cutting off vital information about the fighting. They villagers accused the Myanmar Army of conducting an aerial bombing on civilian communities that destroyed about 150 homes and a monastery in Pyaing Taing village, while government soldiers on the g