A computer experts group including a former NSA employee has warned Apple of a serious security flaw that affects the company’s latest gadget, which could totally compromise the data contained inside the phone.
Independent Security Evaluators, a security research firm from Baltimore founded by Johns Hopkins University professor Avi Rubin (but not associated with the University), includes several Ph.D.s in Computer Science and in Math, as well as Masters degrees in computer science and security informatics. ISE security analysts have backgrounds that include academia, industry, as well as former employees of the National Security Agency.
With such outstanding academic background it’s no wonder that ISE experts have managed to bypass iPhone’s thoroughly tested security modules. They were able to gain control over the Apple iPhone, using a connection to a Wi-Fi network, by luring a user to access a bogus Web page that contained malware.
Charles Miller, the principal security analyst for the firm, admitted though that Apple’s efforts to make the iPhone a secure environment are quite impressive, but "once you did manage to find a hole, you were in complete control."
ISE has warned the Cupertino, CA-based giant of the vulnerability and also proposed a software patch that could prevent further attacks.
Apple found no evidence that the glitch has been exploited by other people than those at ISE and also informed that no similar vulnerabilities have been signaled until now.
Miller is a former National Security Agency employee with a doctorate in computer science. To demonstrate the hack in front of a NY Times reporter he used a fake Web page of his own creation, which, when accessed through the iPhone, infected the gadget with malicious code that later allowed full control over it.
The phone promptly followed instructions to transmit text message files, telephone contacts and e-mail addresses to the attacking computer.