News

Researcher Fed Up, Reveals iPhone Vulnerabilities

Friday, October 3rd, 2008 at 2:35 PM - by

Back in July, Aviv Raff, told Apple about two iPhone issues that he considered to be vulnerabilities. Updates 2.0.1, 2.0.2. and 2.1 came and went with no fix, so Mr. Raff went public with the details.

All that Apple has said, according to Mr. Raff, a security researcher in Israel is that they're still "working on it."

The first problem is related to the limited real estate on the iPhone screen. For some time now, desktop e-mail programs are designed to display, with a hovering tooltip, the actual URL of a link, no matter what the text says. Apple Mail does that on the Mac.

On the iPhone, there is no hovering tip, and in fact, the iPhone truncates the URL due to limited space. As a result, a longer, malicious URL could look like a legitimate one. The author showed an example of a deceptive link to Facebook.

The second problem is one that has also been fixed in desktop systems, namely the link-back of embedded images. "This one is not just a trivial bug, it's actually a pretty dumb design flaw, which was already fixed by all other mail clients ages ago. Whenever you view an HTML mail message which contains images, a request is made to a remote server in order to get the image. Most of the mail clients today requires you to approve the download of the images. This is done for a good reason," Mr. Raff wrote.

"If the images were downloaded automatically, the spammer who controls the remote server will know that you have read the message, and will mark your mail account as active, in order to send you more spam. This 'feature' is also known as 'Web Bug'.

"The iPhone's Mail application downloads all images automatically, and there is NO WAY to disable this feature!" Mr. Raff noted with dismay.

Mr. Raff suggested that the Mail application on the iPhone not be used until these issues are fixed.

Apple has a history of fixing bugs on their own schedule, not the schedule of researchers who report them. That can lead to some frustration, but in the end, Apple makes the call on which vulnerabilities get the highest priorities. Sometimes, fixing a security flaw disrupts an entire feature set, and reworking the feature, without the flaw, takes time. In any case, knowledge is better than ignorance for users, and, as usual, iPhone users should be Internet savvy and at least as smart as their smartphone.

10 comments from the community.

You can post your own below.

+ show options

Your current settings, click to change: Sort Oldest First, Show Guest Posts, Hide Community Stats

vasic said:

member since 09 Aug 2005 with 278 posts, unranked, send him a message or view his profile

Fri Oct 03, 2008 3:30 pm

These are most ridiculous findings. Both of them are so insignificant that there is no surprise Apple ignored this. The first one relates to phishing, and as we all know, if you click on a link in a message, you have to be cautious where you put your passwords and other data.

As for an embeded image, Mail only loads it on messages that aren't spam. If the message that has an embedded remote image is categorised as spam, the image wont load.

Such sloppy research, I can't believe this guy takes himself so seriously!

Quote this post ↓

A guest said: (hide)

Fri Oct 03, 2008 4:07 pm

vasic wrote:
These are most ridiculous findings. Both of them are so insignificant that there is no surprise Apple ignored this. The first one relates to phishing, and as we all know, if you click on a link in a message, you have to be cautious where you put your passwords and other data.

As for an embeded image, Mail only loads it on messages that aren't spam. If the message that has an embedded remote image is categorised as spam, the image wont load.

Such sloppy research, I can't believe this guy takes himself so seriously!

What!

I have 6 email accounts I read on my iPhone - .me, gmail and 4 POP accounts. Just how does Mail know which is spam? Has Apple solved the spam problem for the world? Of course not. I get spam on my iPhone and in fact on the first day I activated it - without realizing they'd made such a poor design choice I clicked on an email purporting to be from an AIM email address - BIG mistake. Mail loaded the images and guess what - it was spam and now I'm getting bombed by spam purporting to be from AIM accounts.

This is an EXCELLENT article - I'm glad to finally see it getting some press. The other major problem I have with iPhone mail is that I've got 3 choices when I get new mail - read it, delete it, or let the unread count pile up. Reading means taking time to load it and any potential spam images. Delete it means I can't come back later and also that if you've got room left in your "# messages to load quota" it will go back in time if need be to fill that quota. Every other mail client allows one to mark a message as read without having to load it. I use this constantly - for me the unread count means I have mail I'm not aware of. Once I've seen the message I delete those I'm done with and leave the other to come back to later. Between this missing feature and the spam threat I now just use iPhone mail as a place to look every once in a while in case something important has come in. I rarely load emails and just let the unread count pile up.

The fixes are so simple one has to wonder why they haven't taken care of them. I need a better tool than this. Yeah it's pretty sexy but if they don't fix the basics I'm going back to a Blackberry no matter the cost. My increased productivity will more than make up for the expense.

Quote this post ↓

Sir Harry Flashman said:

member since 08 Feb 2007 with 787 posts, unranked, send him a message or view his profile

Fri Oct 03, 2008 4:30 pm

" Just how does Mail know which is spam? "

I see this in the long headers of suspected spam

Spam detection software, running on the system "some.hosting.other.than.guests.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details.

Or I can set my mail server to hold spam. Then I can check it using webmail

Quote this post ↓

A guest said: (hide)

Fri Oct 03, 2008 4:56 pm

Sir Harry Flashman wrote:
" Just how does Mail know which is spam? "

I see this in the long headers of suspected spam

Spam detection software, running on the system "some.hosting.other.than.guests.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details.

Or I can set my mail server to hold spam. Then I can check it using webmail

In headers from what email account - .me? Each mail account uses different scans/checks etc. And how accurate are they? The answer is the only thing they can do 100% correct is make sure there are no attachments containing KNOWN malware. Everything else is a guess. There's no cure for spam yet. It still requires human intervention and Apple has eliminated one of the most powerful options. I NEVER load images on email until after I've loaded it and read it. If I suspect spam I'll look at the raw message for faked URL's etc.

And to your point about reading in webmail - doesn't that greatly diminish the value of the iPhone as a tool. I and many people I work with live in their portable email. If I can't rely on it then why waste my time tinkering around with it? Apple is marketing the iPhone as enterprise ready. Plain and simple it just isn't yet. It can be and I'd like it to be and these fixes are a needed step in the right direction. But as I've written to Apple - I'm disappointed in how poorly iPhone handles the basics and if they don't fix things in a few months I'm going back to the tool that worked - a Blackberry.

Quote this post ↓

Sir Harry Flashman said:

member since 08 Feb 2007 with 787 posts, unranked, send him a message or view his profile

Fri Oct 03, 2008 5:06 pm

"In headers from what email account - .me? Each mail account uses different scans/checks etc. And how accurate are they? ..."

Whatever Aviv (I suspect), you got the attention you want. Have a good weekend.

Quote this post ↓

mike3k said:

member since 31 Dec 2001 with 61 posts, unranked, send him a message or view his profile

Fri Oct 03, 2008 5:18 pm

He's a complete asshole. As long as you follow one rule: DON'T CLICK ON ANY LINK IN EMAIL, you're fairly safe.

Quote this post ↓

ctopher said:

member since 25 Aug 2006 with 134 posts, unranked, send him a message or view his profile

Fri Oct 03, 2008 5:44 pm

I'm sorry but I have to agree with the guest on this one. I don't have an iPhone, but in mail.app in the "viewing" preference I un-check the "Display remote images in HTML messages" for that very reason.

In the AOL mail client it's off by default, same with gmail. I think Outlook is the same. Apple want's people to receive pretty HTML e-mail but you run the risk of the HTML reporting back to a spammer.

If you can't shut this off in the iPhone, I'd say that was a pretty big miss. I'd be frustrated too.

Quote this post ↓

TheSteveW said:

member since 17 Aug 2007 with 2 posts, unranked, send him a message or view his profile

Fri Oct 03, 2008 6:57 pm

I forgot to login earlier - I made the guest posts

I guess there are those that believe Apple can't make a mistake. This is a mistake pure and simple - there's no rational argument against providing the OPTION to turn off images. It reduces spam, messages load faster and bandwidth used for spam is reduced. Is this discussion about what users want or what Apple wants.

I'm strictly a Mac user - have been since personal computers existed. I like most of what Apple does but not this. They need to fix it. And by the way - I USE my email - heavily. Once I recognized this problem years ago and stopped loading images my spam dropped dramtically - that is until I got an iPhone.

"Fairly Safe" - I wonder if Apple will use that in their marketing?

http://en.wikipedia.org/wiki/Web_bug

Quote this post ↓

tthomcarl said:

member since 24 Mar 2006 with 5 posts, unranked, send him a message or view his profile

Sun Oct 05, 2008 8:06 pm

A legend, in his own mind. Just what we need in these trying times, another attention whore. Aviv I suggest you go outside, take off all your clothes, wave your arms in the air and scream like a chicken. It worked for Chicken Little.

Quote this post ↓

A guest said: (hide)

Mon Oct 06, 2008 8:43 am

This is interesting; I have noticed that my spam-count on my desktop has increased in the last few months... Is it a coincidence that that is when I got my beloved iPhone? It is not a big deal for me since I work in IT and I enjoy finding phishing schemes and reporting or hacking them.

Quote this post ↓

Post Your Comments

  Remember Me

Not a member? Register now. You can post comments without logging in, but they'll show up as a "guest" post.


Please enter the word exactly as you see it in the image above. Registered users aren't prompted for this. Having trouble reading the image get a new one.