Enormous Security Flaw In IOS 4.1

This is one for the record books. The password on your iPhone is not nearly as safe as you may like to think it is. A new vulnerability has been found that allows anyone to bypass that lock and get full access to your phone, contacts list, and even photos.

The way it works is like this. Let your phone lock to where you need to put in your passcode to unlock it. Swipe your finger to bring up the passcode screen. Press "Emergency Call." Now type in any numbers, stars or pound signs work too. This is the important part, press the call button and immediately press the sleep button on the top of the phone. You should be taken immediately to the Phone app, where you can access your phone numbers, voicemail, and full contact list. In order to see photos, go to your contact list and press on someone. Now press "Share Contact" followed by "MMS." You will now be taken to a text message screen, where you can press on the little image of a camera and get to the photos on your phone.

Needless to say, this is a HUGE security hole, which can be used to access your personal information. We can only hope that Apple will be coming out with a security update soon to address this issue, considering the amount of internet media attention it has been receiving. The bug find is credited to Salomão Filho, who posted this video of himself giving a step by step tutorial on how to exploit it.

I have personally tested this on several of my friends' iPhone 3GS and iPhone 4 running iOS 4.1, and found that it is just as easy as it looks to break into a phone using this method.

Facebook phishing worm compromises thousands of accounts

A very effective phishing worm has been targeting Facebook users and has been compromising their accounts by luring them with the offer of seeing a video.

The victim would receive a instant message from a contact asking "Is this you?" and supposedly offering a link to the video, but actually providing a link to a malicious Facebook application which loads a phishing page into an iframe:


The Kaspersky researcher that spotted the worm was curious and poked around the server to access some common directories so that he could discover more information about the worm's activity, and he found one containing Apache access logs.

"When analyzing the content of the log file I saw that someone was trying to access a file named acc.txt," says the researcher. "I downloaded acc.txt and saw that the file contained stolen accounts: in the first version of acc.txt which I downloaded I saw that the attacker had collected over 3000 accounts! I downloaded the acc.txt at 5-minute intervals, and within 20 minutes, the number of stolen accounts went from 3000 to over 6000."

He immediately notified Facebook, and the malicious page was taken down. Users who think their account has been compromised are advised to change their passwords and to terminate any active session that might be found in the Account Security section in the Account Settings.

Increase in Halloween malware attacks

There's an increase in the number of Trojans circulating in the pre-Halloween period this year, according to GFI Software. Eight of the top 10 threat detections currently spreading on the internet are Trojans, up from six during October last year.

Furthermore, three of the top 10 threat detections from last year’s Halloween season are still on the list, highlighting the lasting impact of this type of malware long after the holiday is over.

Consumers should be on the lookout for new iterations of the following common types of attack:

• Halloween Tweets, “likes” and posts on various social media sites that can be used to lure users to malicious websites.
• Search engine optimization (SEO) poisoning, in which links to malicious Web sites show up in search engine results for holiday items.
• Halloween-themed attachments posing as invitations, greeting cards or documents. Clicking on these creates a significant risk of downloading rogue security products or other malware.
• “Typo attacks” which take advantage of the increased Holiday traffic to commonly misspelled URLs. Malware writers set up spoofed infected sites and download locations to trap unsuspecting web users who misspell URLs and end up in the wrong place.
• Sites that offer contests attempting to get visitors to subscribe to questionable subscription services that are billed to their cell phone monthly.

New 0-day flaw in Flash Player exploited in the wild?

Bad news just keep piling on Adobe - it looks like there is a new zero-day vulnerability in their Flash Player that is being exploited in the wild.

Its existence is still to be confirmed by Adobe, but security researcher Mila Parkour from the Contagio Malware Dump blog seems to think it may be the real deal. According to her, the vulnerability is exploited via a malicious .pdf document sent as an attachment, and two files are dropped - and executed - on the system: nsunday.exe and nsunday.dll.

They are both components of a variant of Wisp - an information-stealing and downloader Trojan and, according to Softpedia, it is currently detected by 15 of the 42 AV solution used on VirusTotal.

If the flaw and its use in the wild is confirmed, Adobe will have to scramble to put out a patch way ahead of the selected date for the next security update. In the meantime, users could prevent becoming victims by disabling Flash support in Adobe Reader.

UPDATE: Apple has confirmed the existence of the vulnerability and plans to issue a patch for Flash Player around November 9 and patched up versions of Adobe Reader and Acrobat around November 15.

Think your Twitter Direct Message is private? Think again

Twitter has established itself as a means of broadcasting information to wide group of people all at once. But, for those times where you want to talk more intimately, Twitter also has the ability to send a Direct Message (DM) that is private between the two parties. Well, it's supposed to be private, but the reality is perhaps not as secretive as one might expect.

While the DMs are ostensibly private, the reality is that any apps that have been approved to access your Twitter account can also see those "private" messages.

There are only two types of account access authorisations: read-only, or read-and-write. In either case, the fact that the app has been granted permission to access the account at all means that all Twitter messages, including DMs are accessible to the app. In the event of read-and-write approval, the app could also delete your messages, or send messages out on your behalf.

Perhaps you should think twice next time before blindly approving some random app to access your Twitter feed. You can find out which apps have access to your Twitter messages by logging in to your account on the Twitter site. Click on Settings, then Connections. The fine print for each entry displays the type of access authorized (read-only or read-and-write), and a link is provided to "Revoke Access" for any that seem shady or unwarranted.

It may be a tad paranoid to worry about whether the admin of a given app is abusing the privilege you have granted and is sifting through your private DMs. But, just to be safe you should exercise some discretion with the apps you grant that authority to, and remember that your DMs may not be as private as you might think.

MySpace apps send user IDs to advertisers

In the wake of the discovery that some third party Facebook applications transmit users' ID to ad agencies and Internet tracking companies, The Wall Street Journal has revealed that MySpace and some of the game applications on it are doing exactly the same thing.

This is not the first time MySpace has been found "oversharing" - at the time, they said they were working on a method to obfuscate the ID information sent to ad agencies via "HTTP referrers".

An extenuating circumstance is the fact that - unlike Facebook - MySpace doesn't require of or encourage its users to make an account in their real name, so knowing a user ID doesn't immediately mean that usable information can be harvested. On the other hand, many users simply don't think of creating an online persona to protect their privacy.

Three popular MySpace applications - TagMe, GreenSpot and RockYou Pets - have been found transmitting the information, a thing that is against the rules set by the social network.

"It has recently come to our attention that several third-party app developers may have violated these terms and we are taking appropriate action against those developers," a MySpace spokesman said.