Home > Ask the Security Experts > Information Security Threats Questions & Answers > Are iPhone security risks different than those of other mobile devices?
Ask The Security Expert: Questions & Answers
EMAIL THIS

Are iPhone security risks different than those of other mobile devices?

Ed Skoudis, past SearchSecurity.com expert EXPERT RESPONSE FROM: Ed Skoudis, past SearchSecurity.com expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 10 July 2007
Now that the iPhone is available, should enterprises be worried about iPhones more than any other mobile devices? I've heard that the devices offer little in terms of security, but are the security risks all that different?


BROWSE BY TAG
Wireless Network Security: Setup and Tools,   Enterprise Network Security,   Handheld and Mobile Device Security Best Practices,   Information Security Threats,   Emerging Information Security Threats,   Information Security Threats,   Expert Archive: Information Security Threats,   Smartphone and PDA Viruses and Threats,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Handheld and Mobile Device Security Best Practices
How to prevent mobile phone spying
Unified communications: Securing a converged infrastructure
RIM patches serious BlackBerry Attachment Service flaws
How secure are iPhone App Store mobile applications?
Is there a spy on my mobile device?
Mobile phones win during Pwn2Own contest
Latest Apple iPhone features prompt security concerns
Apple iPhone app could boost two-factor
What Obama's Blackberry means for mobile device security
SMS mobile worm attacks Symbian smartphones
Handheld and Mobile Device Security Best Practices Research

Emerging Information Security Threats
New attack code targets Microsoft ActiveX zero-day vulnerability
Adobe ColdFusion websites being compromised
Antispyware buying guide for Indian enterprises
ATM malware lets attackers take over machines
FTC shutters rogue ISP for hosting malicious content, botnets
The failing war against cybercriminals
White House cybersecurity czar faces major hurdles
Cybercrime and threat management
The Pipe Dream of No More Free Bugs
Face-off: Who should be in charge of cybersecurity?

Information Security Threats
How to get rid of malware, botnets on a hospital IT network
Should a national cybersecurity strategy include offensive botnets?
How can search results lead to malware?
How to prevent brute force webmail attacks
How to prevent mobile phone spying
What are today's antivirus software trends?
How to detect input validation errors and vulnerabilities
Can secure USB devices prevent man-in-the middle attacks
How to prevent and build protection against online identity theft
Is there a spy on my mobile device?

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
DNS rebinding attack  (SearchSecurity.com)
drive-by pharming  (SearchSecurity.com)
JavaScript hijacking  (SearchSecurity.com)
man in the browser  (SearchSecurity.com)
phlashing  (SearchSecurity.com)
polymorphic malware  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


Your timing is quite amazing. It just so happens that I purchased an iPhone last night and set it up early this morning. It's a dazzling device, but you are right to bring up security concerns. Only a few short weeks after its release, researchers had already discovered vulnerabilities associated with the iPhone's browser and mail client. I agree with you that the security risks of an iPhone are comparable to other wireless devices, but the iPhone does bring some special issues that are a cause for concern:

  1. The iPhone is a product with gobs of new software on it. Surely, bugs will be scrubbed out over time, and many of these bugs will have security implications. Some iPhone supporters might point out that the iPhone is based on Mac OS X, and therefore isn't as worrisome as totally untried software would be. But a lot of the capabilities on the iPhone are being introduced for the first time, and the glue that links all of these applications together -- including the contact list, calendar, email and phone features -- is new. Security vulnerabilities are often found in a product's underpinnings, and if similar weaknesses are found in the iPhone, an attacker may be able to steal contacts or break phone connectivity.
  2. The iPhone is sexy. Researchers are already trying to make a name for themselves by finding flaws in the product and announcing them publicly. Expect to see a lot more of that in the near future, as the security community "breaks in" this newcomer.
  3. The iPhone is feature-rich. This gadget has more applications and functions than most other widespread cell phone technologies. Thus, there is more of a chance for interference with a user's life.
  4. As of this writing, the iPhone doesn't integrate with many enterprise email systems, although Apple has hinted that the incompatibility issues will be addressed very soon. Integration, however, might make users bend over backwards to exfiltrate their own email so that they can read their messages on the new device. The transfer could possibly short-circuit carefully secured enterprise email infrastructures.

Only time will tell, but I wholeheartedly think there will be a good number of iPhone security issues in the next six months or so. It's going to be a heck of a ride. But the product is so nifty that I did sign up for my seat on the roller coaster.

More information:

  • Shellcode has been published for Apple's iPhone. Learn how the device can be used as a pocket-sized attack platform.
  • An expert warns that the Apple iPhone will provoke complex mobile attacks.




  • Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    Targeted Security Channel Tips for Resellers, Integrators and Consultants
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts