Categories: MobilitySecurity

Latest Apple iPhone Security Update Falls Short

The anti-phishing feature for the iPhone OS 3.1 isn’t all it’s cracked up to be, according to security researchers.

For whatever reason, some researchers have found, phishing sites blocked by the desktop version of Apple Safari are not consistently blocked by the mobile version. Since Apple released the iPhone OS 3.1 upgrade on 8 Sept, testers have found that the performance of the anti-phishing feature has been spotty.

“The Mac Security Blog has reported seeing inconsistencies among iPhones, with some blocking and others not,” said Michael Sutton, vice president of research at Zscaler. “Based on this information, it would appear that the problems lie with update mechanisms reporting phishing sites to the phone, as opposed to the blocking functionality itself.”

On the Zscaler blog, Sutton cited two phishing sites (click at your own risk) as examples of the situation. One is blocked by Safari for OS X but is still accessible on the iPhone; the other wasn’t being blocked by the mobile edition of Safari at first, but has been blocked since 10 Sept.

Researchers aren’t sure what is causing the inconsistent results. Apple has not responded to inquiries on the matter. But at Mac security vendor Intego, officials said they will continue to investigate the situation.

“We’ve tried isolating locations, iPhone [and] iPod touch models, and whether they are connecting over a cell network or via Wi-Fi, but all we’ve come up with is that sometimes it works and sometimes it doesn’t,” blogged Peter James, spokesperson for Intego. “This is clearly more dangerous than no protection at all, because if users think they are protected, they are less careful about which links they click.”

Despite its inconsistency, Sutton described Apple’s attempt at fighting phishing sites on the iPhone as an important step for mobile device security.

“Mobile browsers have many of the same capabilities as their desktop counterparts,” he said. “Most notably, smartphones now generally have JavaScript engines and as such are vulnerable to many of the same attacks. Despite this fact, security is essentially absent in mobile browsers altogether. Functionality now standard in desktop browsers such as phishing and malicious URL blacklists haven’t been incorporated into mobile devices. While I applaud Apple for taking a first step in this direction, it would appear that they have some wrinkles to iron out.”

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Share
Published by
Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

Craig Wright Sentenced For Contempt Of Court

Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…

3 days ago

El Salvador To Sell Or Discontinue Bitcoin Wallet, After IMF Deal

Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…

3 days ago

UK’s ICO Labels Google ‘Irresponsible’ For Tracking Change

Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…

3 days ago

EU Publishes iOS Interoperability Plans

European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…

4 days ago

Momeni Convicted In Bob Lee Murder

San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…

4 days ago