The following content found in the Cisco 2010 Annual Security Report.
Mobile Security – Are You Ready?
The “bears” may be changing their hunting patterns, but cybercriminals are still very much in the research and development phase with their methods of snaring victims using mobile devices. Over the past two years, there have been a number of phishing scams, mostly regional in focus, targeting individuals or select groups—such as customers of local banks or credit unions. And Apple’s products, including iPhones, iPads, and the iTunes media service, have all been recent targets.
As for the Apple iPhone, users of the newly released iOS 4 have benefitted from more than 60 patches designed to fix security vulnerabilities, including an exploit that allowed third-party applications (“apps”) to access information on an iPhone user’s location without permission. However, many users are undermining the security of their smartphones and other devices, including iPads and iTouch devices, by “jailbreaking” them. Discussed in previous Cisco security reports, jailbreaking is a process that allows users to unlock the iOS, thereby removing Apple-imposed limitations on what apps they can download and from where.
In July 2010, the U.S. Library of Congress added jailbreaking to its list of actions that do not violate copyright protections—leaving iPhone users free to unlock their devices and download applications not authorized by Apple. Only a week after the ruling, JailbreakMe 2.0, the one-click, mobile, Safari-based iPhone jailbreak utility, was unveiled. The new tool makes it easier than ever for users to jailbreak their phones; in the past, some advanced technical skill was required. The advent of this tool also revealed a significant security flaw in the iOS 4 (which Apple has since patched) that could leave iPhone users with jailbroken phones more susceptible to hackers who could gain access to root privileges and essentially take control of the devices.
Since the Library of Congress lifted the threat of legal liability from Apple customers looking to unlock their devices, more than a million users have jailbroken their iPhones, according to the Electronic Frontier Foundation, a San Francisco-based privacy rights organization that petitioned the library. And users are finding ample opportunity to download unofficial iPhone apps, including those from a market called Cydia, which provides access to “Installous” from Hackulous, an app that offers free, pirated versions of thousands of apps available through the iTunes store.
Meanwhile, many users are avoiding the hassle of jailbreaking their iPhones and instead are fully embracing the open architecture of the Google Android smartphone operating system. In fact, market share for the Android OS expanded significantly during 2010, and the opensource operating system is proving to be a significant, competitive threat to the Apple iPhone (both operating systems are still trailing Research in Motion’s BlackBerry OS, however, in terms of popularity by numbers).
“Three years ago, there was no Android. Now, there are only a few major handset manufacturers that aren’t developing devices based on Android,” says Cisco threat research manager Scott Olechowski. “The growth of this platform will be exponential. From smartphones and tablet PCs to cars and refrigerators, we will see billions of devices, including a massive number in the enterprise, relying on this platform within the next few years. The relative youth of the Android OS, including its apps and ecosystem, combined with the sheer number of users will make this a very attractive platform for exploitation.”