Web code locks up iPhones and iPod Touch

A new exploit will either lock up your iPhone or iPod Touch or crash your Safari browser on your PC or Mac OS desktop if you simply visit a maliciously coded Web site. Unlike an earlier exploit that required users to click to become infected, the new code published by iPhoneWorld requires no user interaction.

So far, Apple has had no comment.

The code was first reported in January and exhausts the memory in Safari, which in turn will cause your iPhone or iPod Touch to freeze, or your desktop Safari to crash. "Given the nature of this issue," said the BugTraq newsgroup vulnerability report, "remote code execution may also be possible, but this has not been confirmed."

There is no patch available from Apple. The recommended workaround is to disable Javascript within Safari. To do so:

1. Under Edit, click Preferences.
2. Click the Security icon.
3. Uncheck Enable JavaScript.
4. Close and restart Safari.

[mreiher]

Interesting but....

Since January huh? Must not be too bad... I have yet to have any
trouble with Safari or my iPhone... both are used daily and often.
But then again, I don't visit the kind of sites that might bring on
this sort of attack either. Maybe this report is a little overstated?

[ejevo]

Quite agree

As we all know, all things Apple are impervious to any threats and are implicitly safe. This just needless interrupts us from worshiping all that Steve Jobs bestows upon us. The author should know better.

[Thomas, David]

Exception to that is

When someone hacks a site to place the code on it. Given most
the sites I visit are not prone to those types of attacks, but that
does not prevent a link to site that has been hacked.

Due caution is advised, but not critical. To restart your iPhone,
simply hold down the home button, and the sleep button (at top) at
the same time.

[henebry]

Which version(s) of Safari?

Apple just released version 3.1 of Safari for Macs and PCs. Does the
exploit work with the new release?

Does it work on the older 2.x Safari as well? What about 1.x?

[Thomas, David]

Probably All versions

This affects the Javascript run-time, in the browser. The
javascript code is designed to eat up memory.

[docstens]

versions

The article specifically states that it doesn't work with Safari 3.1.
However, Safari on the iPhone and iPod Touch hasn't been
upgraded as yet.

[gianpo]

3.1 is safe

No the exploit does not work on 3.1

[AppleSuxLeo]

I love it !!!

now that Apple has a product that is a big target , we get to see just how INSECURE OSX really is.
It will be fun seeing how Apple and it`s fanboys try and spin all the attacks that are just starting , and there will be many more to come.

[zealant]

Get a clue

Actually, no, the insecurity of a very watered-down version of OS X says absolutely nothing about OS X itself. Besides, this is a very primitive, low-level attack, so it doesn't say much in the big picture. Javascript is a security risk no matter where you're using it anyway, which is why it's a good idea to disable it except on sites that really need it. Hooray for Firefox's NoScript addon.

[Drpixelphd2]

Yessireebob

Applesuxleo - I can't wait! Let's have a party. I am in Florida.

[McAdams]

Neanderthals Thrive

Your comment disparaging Apple proves that neanderthals are still
wandering the earth. I still wonder why people like yourself look to
the negative side of life, instead of celebrating the good in people
and companies. What a tragedy.

[flyboy15]

LOCK UP STORY

yes i think this is what happend to me yesterday, the iphone started working slowly, when i was checking the stocks, after that it froze when i checked the wheather, and after that none of the buttons would work, so i turned off and turned it back on. the next was that it told me to connect it to itunes. when i did it told me it had a error and i need to take it to apple store....

[whosawhatsit]

FIXED in Safari 3.1

Gotta love Apple for being prompt!

[emoslayer6224]

funny how I'm typing this on an archos 605.

that's why I'm using this. Fame means threats.

[thesplintercell]

Fantastic, but no mention for ipod touch or iphone

?? i think your column is missing something...
mentioned ipod touch and iphone, but your only focus was with the computer-versions of safari...