Update your iThings: Apple splats scary SSL snooping bug in iOS

snoopy · Feb 21, 2014

Update your iThings: Apple splats scary SSL snooping bug in iOS
Encrypted connections vulnerable to tampering, putting millions at risk
By Chris Williams, 21st February 2014

Evaluating the cost of a DDoS attack

Apple has issued updates for its mobile operating system iOS to patch a bug that blew apart the integrity of encrypted connections in the right conditions.

Versions 7.0.6 and 6.1.6, available now for download, fixes a vulnerability that could allow "an attacker with a privileged network position" to "capture or modify data in sessions protected by SSL/TLS," according to the Cupertino corp. This is due to the Secure Transport component of the operating system failing to validate "the authenticity of the connection," suggesting some sort of failure to verify the certificate or identity of whatever system a vulnerable iDevice was connected to.

In short, users should apply the security update as soon as possible to avoid falling foul of a man-in-the-middle attack: we can imagine a malicious router or Wi-Fi access point exploiting this iOS flaw to masquerade as a legit server, and thus intercept and decrypt the contents of a supposedly secure connection.
Click to expand...

More details here: http://www.theregister.co.uk/2014/02/21/apple_patches_ios_ssl_vulnerability/

Log in or Sign up

Update your iThings: Apple splats scary SSL snooping bug in iOS

snoopy Registered Members

Share This Page

Log in or Sign up

Update your iThings: Apple splats scary SSL snooping bug in iOS

snoopy Registered Members

Share This Page

Useful Searches