Featured Research

from universities, journals, and other organizations

Friendly app attacks detect vulnerabilities

Date:
December 4, 2013
Source:
The Agency for Science, Technology and Research (A*STAR)
Summary:
Hacking programs disguised as games are helping Apple to improve the security of devices operating on its iOS platform.

Hacking programs disguised as games are helping Apple to improve the security of devices operating on its iOS platform.

Related Articles


Software companies work hard to protect their customers' personal data from malicious applications, or 'apps', but even the most secure devices can be vulnerable. Skilled and independent computer scientists, such as Jin Han and co-workers at the A*STAR Institute for Infocomm Research and the Singapore Management University, can greatly assist companies by spotting security weaknesses before they are exploited.

Han and co-workers recently published a detailed comparison of the two very different security models used by the big players in mobile software, Apple's iOS platform and Google's Android1. Now, the researchers have developed subtle attack apps that test the secretive model of mobile security used in iOS2.

Apple's preferred security model is 'closed source'. This means that the company does not publish details of how apps are vetted before becoming available in their iTunes Store. Apple also refrains from publishing the internal code that decides whether apps can control phone functions such as contacts, calendars or cameras.

Despite this secrecy, the researchers were able to develop generic attack codes that enabled third-party control of iOS devices. They demonstrated seven different attack apps, disguised as games, that performed malicious actions including cracking the device's PIN, taking photographs and sending text messages without the user's awareness.

"We utilized private function calls to gain privileges that are not intended for third-party developers," explains Han. "Furthermore, we found a way to bypass Apple's vetting process so that our apps, embedded with proof-of-concept attacks, could be published on iTunes."

The attack apps worked on both iOS 5 and 6, although the team was careful to include secret triggers to protect any public users. The researchers have shared all of their findings with Apple and published recommendations on how the company should fix these vulnerabilities.

"Apple responded very quickly after we informed them about our findings, and before the release of the new iOS 7 platform," says Han. He expects that the company adopted countermeasures similar to those described in his team's paper, but cannot confirm this since iOS is closed source.

The ongoing debate over open- versus closed-source development will continue to rage among information technology specialists. Nevertheless, Han notes that their attack-app codes could, with some modifications, probably also bypass the permissions-based security model used in Android. "My personal opinion is that closed-source development is not good for security. A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. I think the same principle applies to operating systems."

The A*STAR-affiliated researchers contributing to this research are from the Institute for Infocomm Research.


Story Source:

The above story is based on materials provided by The Agency for Science, Technology and Research (A*STAR). Note: Materials may be edited for content and length.


Journal Reference:

  1. Jin Han, Su Mon Kywe, Qiang Yan, Feng Bao, Robert Deng, Debin Gao, Yingjiu Li, Jianying Zhou. Launching Generic Attacks on iOS with Approved Third-Party Applications. Applied Cryptography and Network Security Lecture Notes in Computer Science, 2013 DOI: 10.1007/978-3-642-38980-1_17

Cite This Page:

The Agency for Science, Technology and Research (A*STAR). "Friendly app attacks detect vulnerabilities." ScienceDaily. ScienceDaily, 4 December 2013. <www.sciencedaily.com/releases/2013/12/131204090800.htm>.
The Agency for Science, Technology and Research (A*STAR). (2013, December 4). Friendly app attacks detect vulnerabilities. ScienceDaily. Retrieved March 3, 2015 from www.sciencedaily.com/releases/2013/12/131204090800.htm
The Agency for Science, Technology and Research (A*STAR). "Friendly app attacks detect vulnerabilities." ScienceDaily. www.sciencedaily.com/releases/2013/12/131204090800.htm (accessed March 3, 2015).

Share This


More From ScienceDaily



More Computers & Math News

Tuesday, March 3, 2015

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

HP to Buy Aruba Networks in $3B Deal

HP to Buy Aruba Networks in $3B Deal

Reuters - Business Video Online (Mar. 2, 2015) Hewlett-Packard is boosting its mobile computing business... buying California-based Aruba Networks- a wi-fi network gear maker for $24.67 per share. Leah Duncan reports. Video provided by Reuters
Powered by NewsLook.com
Can Curved Screen Give Samsung the Edge?

Can Curved Screen Give Samsung the Edge?

Reuters - Business Video Online (Mar. 2, 2015) South Korea&apos;s Samsung Electronics Co Ltd unveiled its latest Galaxy S smartphones, featuring a slim body made from aircraft-grade metal, in a bid to reclaim the throne of undisputed global smartphone leader from Apple Inc. Hayley Platt reports. Video provided by Reuters
Powered by NewsLook.com
Smartphone Giants Unveil Latest Models at Technology Show

Smartphone Giants Unveil Latest Models at Technology Show

AFP (Mar. 2, 2015) Mobile providers have been unveiling their upcoming models at the Mobile World Congress in Barcelona, showing off the latest in smartphone technology. Duration: 00:57 Video provided by AFP
Powered by NewsLook.com
Mobile World Looks to 5G

Mobile World Looks to 5G

Reuters - Business Video Online (Mar. 2, 2015) The wireless industry&apos;s annual conference gets underway in Barcelona with 85,000 executives taking part and numerous new smartphones and watches being launched. As Ivor Bennett reports from the show the race for 5G is one of the key themes. Video provided by Reuters
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:

Strange & Offbeat Stories


Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins