A few weeks ago I posted on how iPhones and iPads operating systems were vulnerable to attack. Historically Apple provides very little information when it comes to revealing security issues, but company officials did say, "privileged network position could capture or modify data in sessions protected by SSL/TLS." In their effort to address this situation Apple restored the missing validation steps.

The flaw didn't allow attackers to compromise the device  but it made it possible to exploit the device through Man in the Middle attacks. This makes it possible for attackers to spy on user connections when a person connects via untrusted network. Even users on encrypted networks are vulnerable.

Apple users should update their iOS as soon as possible. The new update iOS 7.0.6 is available for iPhones, iPads, and iPods. For older generation devices like the iPhone 3GS and 4th generation iPod udate iOS 6.1.6 is available.

To find out more and to link to some of the updates visit Mike Lennon's blog Apple Fixes Dangerous SSL Authentication Flaw in iOS
  

In keeping with the spirit of the Olympic games I am dedicating this post to the games. The Olympics are supposed to be a time of year when nations put aside their differences and humanity comes together to celebrate what we all have in common. Unfortunately these games have been plagued with news of security vulnerabilities and possible danger to Sochi visitors. These threats aren't limited to physical security either. 

US officials have warned travelers to this years games that they should not expect any level of privacy. Not all of the threats are coming from internet criminals. Other entities that maybe trying to view personal information include state surveillance and hacker attacks. In previous games held in London and Beijing some controls were put in place to help provide at least some level of privacy to internet users during the games. Russia however allows for complete government inspection of any digital communications. In other words Russian officials can legally block or intercept any communications sent over land lines, cell phones, or the internet. All of the information collected is then stored and analyzed as needed. US security analysts have gone as far to say when travelers connect to hotel networks or encrypted private networks they should assume these have been compromised as well, and only transmit data to known trusted sites.

Sochi visitors are encouraged to buy pre-paid cell phones while on vacation and only call the few numbers you need. They should also keep in mind their conversations are being monitored. They won't enjoy the same freedoms we do in the United States so they will need to monitor what they are personally saying to help avoid any possible trouble. If travelers brought their laptops with them it is recommended they turn them off during their stay and get a security professional to check them out once they get home.

It's a sad day when people can't go and support their country's athletes without being victimized in the host country. Even though the danger is there with some careful planning visitors can still show their patriotism and keep their personal data safe at the same time.

GO TEAM USA!!!!

You can read more about this here: http://www.csmonitor.com/World/Security-Watch/2014/0206/The-other-security-concern-at-Sochi-Olympics-cyberthreats

New Malware Could Record What You are Doing on Your IPhone

 

It appears one of the advantages the iPhone has over the Android phone market could be slipping away. Android has been taking a beating for the security risks it has because of the open access policies it has when allowing apps to be used on their phones. Traditionally iPhones have been fairly secure for users but there is a new  “screenlogging” malware that is raising some eyebrows.

Neal Hindocha is planning on demonstrating how this malware puts iPhone users at risk at the RSA Conference in San Francisco. Screenlogging is similar to key logging with the main difference being instead of logging key strokes it logs the swipe of your finger on the screen while taking screen shots at the same time.

Sifting through all of that information would be very labor intrusive on the would be hacker, but the malware can be designed to only work with certain apps. By doing so the information stolen can be targeted to things like banking app credentials or VPN log in credentials to lessen the amount of data that needed to be analyzed.

Hindocha hopes that releasing his research will bring attention to the threat and some solutions can be applied to this risk.  Most Apple users don’t have a lot to fear at the moment though. Apple’s present security holds up against the attacks unless you have been foolish enough to jail break your phone or iPad.

 

If you want to read more on this topic check out this site. New Malware Records Everything You Do on Your iPhone