Security flaw puts iPhone users at risk of phishing attacks

thumb_catfishing_ars-thumb-230x130-11855-f.jpg

When Apple introduced iPhone OS 3.0, it attempted to beef up the security of over-the-air enterprise management of iPhones by adding support for Cisco Systems’ Simple Certificate Enrollment Protocol (SCEP). However, a flaw in the implementation of the standard could allow hackers to offer mobile configuration files that appear to be from a legitimate source, but may otherwise set your iPhone to access malicious servers.

Ars spoke with a mobile security expert who discovered the problem (who asked to remain anonymous because he did not have approval to talk about the issue). He told Ars that the issue is one of trust: “Who would you trust to change your iPhone configuration over the air? Your carrier? Your company? Your IT security admin?” he asked. Apple uses SCEP as a way for the iPhone to check in with a certificate server to verify that a mobileconfig file has been signed by a trusted source, but flaws in the set-up on the iPhone mean that the process doesn’t always work as intended.

Read the rest of this article...

apple?i=0ZL-P8J9s7E:Jw_1-6G3fTE:V_sGLiPBpWU apple?i=0ZL-P8J9s7E:Jw_1-6G3fTE:F7zBnMyn0Lo apple?d=qj6IDK7rITs apple?d=yIl2AUoC8zA
0ZL-P8J9s7E

http://feeds.arstechnica.com/~r/arstechnica/apple/~3/0ZL-P8J9s7E/security-flaw-puts-iphone-users-at-risk-of-phishing-attacks.ars

Potentially Nasty New iPhone Security Flaw Discovered

Screen-shot-2010-02-03-at-February-3-2.51.45-PM1.png

Wuh-oh! Considering its popularity and the number of handsets floating around out there compared to the number of security exploits discovered thus far, I’d say Apple has done a pretty good job of keeping things locked down.

As this just-discovered flaw proves, however, nobody’s perfect.

Read the rest of this post at MobileCrunch >>

Techcrunch?d=2mJPEYqXBVI Techcrunch?d=dnMXMwOfBR0 Techcrunch?i=_IAtLsPjXmo:E9dH4sqD6GE:D7DqB2pKExk Techcrunch?d=7Q72WNTAKBA Techcrunch?d=yIl2AUoC8zA
_IAtLsPjXmo

http://feedproxy.google.com/~r/Techcrunch/~3/_IAtLsPjXmo/

Today’s threat: Computer network terrorism

“Carry out all my demands or the entire country’s electricity will be cut off.” Is this another line from a suspense film, or is it a palpable threat made possible with a computer keyboard? “Today, there is a growing trend amongst hackers around the world to threaten national infrastructures for ransom,” says an expert in information war.493p4f_xvic

http://feeds.sciencedaily.com/~r/sciencedaily/~3/493p4f_xvic/100119092836.htm

Apple’s Secret Cloud Strategy And Why Lala Is Critical

michael-1.jpgThis is a guest post from Michael Robertson, a 12-year veteran of the digital music business. He is the founder and former CEO of digital music pioneer MP3.com. He is currently the CEO of music locker company MP3tunes. Robertson is also an adviser to Google Voice.

For years there’s been speculation that Apple would supplement their $1/song (now $1.29) iTunes business with a monthly subscription service, but their upcoming plans are quite different and once again are positioning them to lead the digital music industry into a new era. Leveraging their ubiquitous iTunes software Apple plans to upgrade their users almost over night to a cloud music service in an ambitious move to beat Amazon and others to a cloud music service. Record labels are wary to give Apple even greater dominance which is why Apple’s new strategy is designed to sidestep new licenses from the major labels.

Apple’s recent acquisition of digital music startup Lala rekindled speculation of an iTunes subscription service. There’s no shortage of subscription offerings (Napster, Rhapsody, Spotify, Pandora, etc), but none have attracted the millions of subscribers necessary to make the high royalty structures work. Experts have pondered that Apple’s design expertise and hardware integration could make subscription work. And leveraging Lala’s digital library, licenses from the major labels, and a management team who cycled through several business models including the ten cent web song rental could make it a reality. It’s a logical assumption, but after talking to a wide variety of insider sources it’s clear there is no upcoming Apple subscription service and Apple has far different plans.

lala.jpgLala will play a critical role in Apple’s music future, but not for the reasons cited above. Lala’s licenses with major labels are non-transferable, so they’re not usable for any new iTunes service. The 10 cent song rental model never gained traction and does not cover mobile devices thus is of little value to Apple. What is of value is the personal music storage service which was an often overlooked component of Lala’s business. As Apple did with the original iPods, Lala realized that any music solution must include music already possessed by the user. The Lala setup process provides software to store a personal music library online and then play it from any web browser alongside web songs they vend. This technology plus the engineering and management team is the true value of Lala to Apple.

An upcoming major revision of iTunes will copy each user’s catalog to the net making it available from any browser or net connected ipod/touch/tablet. The Lala upload technology will be bundled into a future iTunes upgrade which will automatically be installed for the 100+ million itunes users with a simple “An upgrade is available…” notification dialog box. After installation iTunes will push in the background their entire media library to their personal mobile iTunes area. Once loaded, users will be able to navigate and play their music, videos and playlists from their personal URL using a browser based iTunes experience.

Apple will link the tens of millions of previously sold iPods, Touches, AppleTV and iTablets to mobile iTunes giving users seamless playback of their media from a wide range of Apple branded devices. Since media will be supplied from the user’s personal collection, Apple is freed from the hassles of device and region limitations. iTunes shoppers will be able to continue to buy music and movies as they can now with purchases still being downloaded, but once downloaded they will be automatically loaded to their mobile iTunes area for anywhere access. Again because users are in possession of the materials no new licenses are required from the record labels or publishers.

Some are curious why Apple with thousands of engineers would need Lala talent and technology. For sure Apple could copy Lala technology, but time is of the essence and Lala lets Apple move faster in transitioning from their PC software business to a cloud service. They get a knowledgeable digital music engineering team, plus a code base to build upon which already does uploading and web playback. There’s precedence for this strategy. The iTunes software did not originate within in Apple but came via an acquisition. Finally, Apple gets the quick witted, brilliant, but occasionally loony Lala CEO Bill Nguyen who will play a future role in Apple. (Although one wonders how Jobs and lime light relishing Nguyen can co-exist.)

It’s critically important that technology companies build and maintain a core strength. This cornerstone allows them to command a significant portion of the profit stream and is a beachhead to launch other initiatives. Think Amazon/e-commerce, Microsoft/OS, Google/search, Apple/media. Jobs is keenly aware of the digital transition from PC to cloud centric programs and services. It’s imperative Apple lead in this transition or risk ceding leadership in media to others such as Amazon, Real, Microsoft, Yahoo, etc. Lala will help Apple protect their media franchise from encroachment by accelerating their cloud efforts. iTunes users can expect mobile iTunes in 2010.

Techcrunch?d=2mJPEYqXBVI Techcrunch?d=dnMXMwOfBR0 Techcrunch?i=UJnNessdYxs:sXknZkdz6WI:D7DqB2pKExk Techcrunch?d=7Q72WNTAKBA Techcrunch?d=yIl2AUoC8zA
UJnNessdYxs

http://feedproxy.google.com/~r/Techcrunch/~3/UJnNessdYxs/