Featured Research

from universities, journals, and other organizations

Friendly app attacks detect vulnerabilities

Date:
December 4, 2013
Source:
The Agency for Science, Technology and Research (A*STAR)
Summary:
Hacking programs disguised as games are helping Apple to improve the security of devices operating on its iOS platform.

Hacking programs disguised as games are helping Apple to improve the security of devices operating on its iOS platform.

Related Articles


Software companies work hard to protect their customers' personal data from malicious applications, or 'apps', but even the most secure devices can be vulnerable. Skilled and independent computer scientists, such as Jin Han and co-workers at the A*STAR Institute for Infocomm Research and the Singapore Management University, can greatly assist companies by spotting security weaknesses before they are exploited.

Han and co-workers recently published a detailed comparison of the two very different security models used by the big players in mobile software, Apple's iOS platform and Google's Android1. Now, the researchers have developed subtle attack apps that test the secretive model of mobile security used in iOS2.

Apple's preferred security model is 'closed source'. This means that the company does not publish details of how apps are vetted before becoming available in their iTunes Store. Apple also refrains from publishing the internal code that decides whether apps can control phone functions such as contacts, calendars or cameras.

Despite this secrecy, the researchers were able to develop generic attack codes that enabled third-party control of iOS devices. They demonstrated seven different attack apps, disguised as games, that performed malicious actions including cracking the device's PIN, taking photographs and sending text messages without the user's awareness.

"We utilized private function calls to gain privileges that are not intended for third-party developers," explains Han. "Furthermore, we found a way to bypass Apple's vetting process so that our apps, embedded with proof-of-concept attacks, could be published on iTunes."

The attack apps worked on both iOS 5 and 6, although the team was careful to include secret triggers to protect any public users. The researchers have shared all of their findings with Apple and published recommendations on how the company should fix these vulnerabilities.

"Apple responded very quickly after we informed them about our findings, and before the release of the new iOS 7 platform," says Han. He expects that the company adopted countermeasures similar to those described in his team's paper, but cannot confirm this since iOS is closed source.

The ongoing debate over open- versus closed-source development will continue to rage among information technology specialists. Nevertheless, Han notes that their attack-app codes could, with some modifications, probably also bypass the permissions-based security model used in Android. "My personal opinion is that closed-source development is not good for security. A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. I think the same principle applies to operating systems."

The A*STAR-affiliated researchers contributing to this research are from the Institute for Infocomm Research.


Story Source:

The above story is based on materials provided by The Agency for Science, Technology and Research (A*STAR). Note: Materials may be edited for content and length.


Journal Reference:

  1. Jin Han, Su Mon Kywe, Qiang Yan, Feng Bao, Robert Deng, Debin Gao, Yingjiu Li, Jianying Zhou. Launching Generic Attacks on iOS with Approved Third-Party Applications. Applied Cryptography and Network Security Lecture Notes in Computer Science, 2013 DOI: 10.1007/978-3-642-38980-1_17

Cite This Page:

The Agency for Science, Technology and Research (A*STAR). "Friendly app attacks detect vulnerabilities." ScienceDaily. ScienceDaily, 4 December 2013. <www.sciencedaily.com/releases/2013/12/131204090800.htm>.
The Agency for Science, Technology and Research (A*STAR). (2013, December 4). Friendly app attacks detect vulnerabilities. ScienceDaily. Retrieved March 29, 2015 from www.sciencedaily.com/releases/2013/12/131204090800.htm
The Agency for Science, Technology and Research (A*STAR). "Friendly app attacks detect vulnerabilities." ScienceDaily. www.sciencedaily.com/releases/2013/12/131204090800.htm (accessed March 29, 2015).

Share This


More From ScienceDaily



More Computers & Math News

Sunday, March 29, 2015

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Facebook Building Plane-Sized Drones For Global Internet

Facebook Building Plane-Sized Drones For Global Internet

Newsy (Mar. 27, 2015) Facebook on Thursday revealed more details about its Internet-connected drone project. The drone is bigger than a 737, but lighter than a car. Video provided by Newsy
Powered by NewsLook.com
Robot Returns from International Space Station and Sets Two Guinness World Records

Robot Returns from International Space Station and Sets Two Guinness World Records

Reuters - Light News Video Online (Mar. 27, 2015) The companion robot "Kirobo" returns to earth from the International Space Station and sets two Guinness World Records. Sharon Reich reports. Video provided by Reuters
Powered by NewsLook.com
Smart Bracelet Changes Design With the Touch of a Button

Smart Bracelet Changes Design With the Touch of a Button

Reuters - Innovations Video Online (Mar. 27, 2015) Interactive jewellery that allows users to change designs and doesn&apos;t need charging. Sharon Reich reports. Video provided by Reuters
Powered by NewsLook.com
Twitter's Periscope New Rival for Meerkat

Twitter's Periscope New Rival for Meerkat

Reuters - Business Video Online (Mar. 26, 2015) Twitter has unveiled Periscope, its live-streaming app to rival Meerkat and other emerging apps that have captured the attention of the social media industry. Bobbi Rebell reports. Video provided by Reuters
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:

Strange & Offbeat Stories


Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins