Feeds

iPhone Mail bug adds phishing danger

Be careful around the net

High performance access to file storage

Flaws in the Mail and Safari applications bundled with the iPhone leave users of the device at greater risk of phishing attacks.

A URL-spoofing vulnerability means that a dodgy domain pointed to by a specially crafted URL can appear to be that of a trusted brand when viewed through the iPhone's mail or Safari browser applications.

Mail and Safari on version 1.1.4 and 2.0 of the iPhone firmware are affected by this vulnerability. Earlier versions may also be buggy. , Security researcher Aviv Raff, who found the flaw, is withholding technical details pending the release of patches from Apple.

iPhone users are advised to enter the addresses of sites they wish to visit manually instead of clicking on links contained in email. This is good advice generally but all the more important while there is no patch available.

The way the vulnerability affects Mail also leaves iPhone users more likely to receive spam, according to Raff, who reports that the consumer electronics giant has privately acknowledged the Mail vulnerability. Apple is still reportedly investigating the Safari-on-iPhone bug.

Raff is a prominent researcher in the arena of client side vulnerabilities, and has been credited in recent months with discovering or expanding research on flaws in Internet Explorer, Skype and Safari. ®

High performance access to file storage

More from The Register

next story
Broadband Secretary of SHEEP sensationally quits Cabinet
Maria Miller finally resigns over expenses row
Skype pimps pro-level broadcast service
Playing Cat and Mouse with the media
Beat it, freetards! Dyn to shut down no-cost dynamic DNS next month
... but don't worry, charter members, you're still in 'for life'
Like Google, Comcast might roll its own mobile voice network
Says anything's possible if regulators approve merger with Time Warner
EE dismisses DATA-BURNING glitch with Orange Mail app
Bug quietly slurps PAYG credit - yet EE denies it exists
Turnbull leaves Australia's broadband blackspots in the dark
New Statement of Expectations to NBN Co offers get-out clauses for blackspot builds
Facebook claims 100 MEEELLION active users in India
Who needs China when you've got the next billion in your sights?
Facebook splats in-app chat, whacks brats into crack yakety-yak app
Jibber-jabbering addicts turfed out just as Zuck warned
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.