- Related Stories
Apple basks in iPhone buzzJune 25, 2007
ARM says it's ready for the iPhoneJune 22, 2007
Google boss shows off iPhoneJune 21, 2007
The great iPhone hunt of 2007June 12, 2007
Apple opens iPhone to developers--kind ofJune 12, 2007
- Related Blogs
Apple stores hosting 'iPhone World Premiere' Friday night
June 26, 2007
Pricing for iPhone service released
June 26, 2007
(continued from previous page)
I'm sure someone will open the iPhone up shortly after launch and report everything they find inside. Apple has already talked a little about updating the iPhone software or firmware. Everything from activation to updates is to be handled through iTunes, right?
Mehta: The iPhone will likely be connected to a PC quite frequently, and the update mechanism for other Apple devices that are connected to the PC, such as the iPod, is very robust and very user-friendly. If you want to update the program on your iPod, for example, if you connect it to your PC, it's just one click to update the firmware within the iTunes software. Some of that people take for granted in terms of its peers but it's really not that common to have a good update mechanism for a smart phone. And that's one of the biggest problems for a lot of the smart phones out there--there's no easy way to update. And, so, if you ask a lot of people with a smart phones when was the last time they patched their smart phone, most of them would look at you like you're crazy because very few of them have done it.
In many cases there is no over-the-air update mechanism, and also these phones are not connected to the PCs with the specific purpose of its own firmware updates. Some of the firmware updates (for smart phones) require you to back up all of your contacts and data on the device, wipe the entire device, and so on. All of these things contribute to updates for other smart phones being very infrequent.
If Apple makes updating the iPhone as easy as it has made updating some of the other devices (like the iPod), it'll have a leg up on other smart phones in terms of installing patches and keeping it up to date, even if security vulnerabilities are there. I think that's a positive as well. The only other smart phone that has that to any degree is the BlackBerry, platform where updates can push from the enterprise server, and be managed by corporate IT. But outside of that most smart phones are very hard to update, and they require you to manually search for updates on your own and let you install them by yourself.
So the iPhone will be easy to keep patched, but it seems there's another exploitable weakness--the browser. Even if you have a fully patched browser, there are still ways for criminals to hijack the Ajax processes on Web 2.0-enabled sites, for example, and link iPhone users to malicious code. But that's assuming the Apple Safari browser is not itself vulnerable, right?
Mehta: Yes. You're absolutely right. If you look at the history of browser security for the last year or two, it's been absolutely terrible. And that's because browsers are enormous and very complex applications. One of the things we do know about the iPhone is that the Safari browser will definitely be on it. And the only documented way for third parties to develop applications for the device will also be through Safari and through Ajax. So it's very likely that vulnerabilities that are found for Safari for Mac or Safari for Windows will also affect the iPhone.
I think that's just a small piece of the bigger potential security risk being that having an iPhone based on Mac OS X gives attackers the ability to go and analyze any shared application that might be on a Mac, and analyze it on a familiar platform that they understand very well, and then try and extend that knowledge or port it over to the iPhone. We'll likely see that there will be a parallel stream of updates for the Safari browser on both Mac and on the iPhone, and for other applications within OS X that run both on the Mac and on the iPhone. Even though it's a closed platform, it will have a certain degree of transparency because of the shared code base with other platforms.
I would also guess that less sophisticated attackers will likely try and look at the applications on the Mac platform or the Safari browser on Windows and then simply try the exploits that they create against the iPhone and see if they work. We've already seen some public speculation that the Safari vulnerabilities will affect the iPhone prior to its release.
15 commentsJoin the conversation! Add your comment