Featured Research

from universities, journals, and other organizations

Friendly app attacks detect vulnerabilities

Date:
December 4, 2013
Source:
The Agency for Science, Technology and Research (A*STAR)
Summary:
Hacking programs disguised as games are helping Apple to improve the security of devices operating on its iOS platform.

Hacking programs disguised as games are helping Apple to improve the security of devices operating on its iOS platform.

Related Articles


Software companies work hard to protect their customers' personal data from malicious applications, or 'apps', but even the most secure devices can be vulnerable. Skilled and independent computer scientists, such as Jin Han and co-workers at the A*STAR Institute for Infocomm Research and the Singapore Management University, can greatly assist companies by spotting security weaknesses before they are exploited.

Han and co-workers recently published a detailed comparison of the two very different security models used by the big players in mobile software, Apple's iOS platform and Google's Android1. Now, the researchers have developed subtle attack apps that test the secretive model of mobile security used in iOS2.

Apple's preferred security model is 'closed source'. This means that the company does not publish details of how apps are vetted before becoming available in their iTunes Store. Apple also refrains from publishing the internal code that decides whether apps can control phone functions such as contacts, calendars or cameras.

Despite this secrecy, the researchers were able to develop generic attack codes that enabled third-party control of iOS devices. They demonstrated seven different attack apps, disguised as games, that performed malicious actions including cracking the device's PIN, taking photographs and sending text messages without the user's awareness.

"We utilized private function calls to gain privileges that are not intended for third-party developers," explains Han. "Furthermore, we found a way to bypass Apple's vetting process so that our apps, embedded with proof-of-concept attacks, could be published on iTunes."

The attack apps worked on both iOS 5 and 6, although the team was careful to include secret triggers to protect any public users. The researchers have shared all of their findings with Apple and published recommendations on how the company should fix these vulnerabilities.

"Apple responded very quickly after we informed them about our findings, and before the release of the new iOS 7 platform," says Han. He expects that the company adopted countermeasures similar to those described in his team's paper, but cannot confirm this since iOS is closed source.

The ongoing debate over open- versus closed-source development will continue to rage among information technology specialists. Nevertheless, Han notes that their attack-app codes could, with some modifications, probably also bypass the permissions-based security model used in Android. "My personal opinion is that closed-source development is not good for security. A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. I think the same principle applies to operating systems."

The A*STAR-affiliated researchers contributing to this research are from the Institute for Infocomm Research.


Story Source:

The above story is based on materials provided by The Agency for Science, Technology and Research (A*STAR). Note: Materials may be edited for content and length.


Journal Reference:

  1. Jin Han, Su Mon Kywe, Qiang Yan, Feng Bao, Robert Deng, Debin Gao, Yingjiu Li, Jianying Zhou. Launching Generic Attacks on iOS with Approved Third-Party Applications. Applied Cryptography and Network Security Lecture Notes in Computer Science, 2013 DOI: 10.1007/978-3-642-38980-1_17

Cite This Page:

The Agency for Science, Technology and Research (A*STAR). "Friendly app attacks detect vulnerabilities." ScienceDaily. ScienceDaily, 4 December 2013. <www.sciencedaily.com/releases/2013/12/131204090800.htm>.
The Agency for Science, Technology and Research (A*STAR). (2013, December 4). Friendly app attacks detect vulnerabilities. ScienceDaily. Retrieved December 18, 2014 from www.sciencedaily.com/releases/2013/12/131204090800.htm
The Agency for Science, Technology and Research (A*STAR). "Friendly app attacks detect vulnerabilities." ScienceDaily. www.sciencedaily.com/releases/2013/12/131204090800.htm (accessed December 18, 2014).

Share This


More From ScienceDaily



More Computers & Math News

Thursday, December 18, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

How 2014 Shaped The Future Of The Internet

How 2014 Shaped The Future Of The Internet

Newsy (Dec. 18, 2014) It has been a long, busy year for Net Neutrality. The stage is set for an expected landmark FCC decision sometime in 2015. Video provided by Newsy
Powered by NewsLook.com
Jaguar Unveils 360 Virtual Windshield Making Car Pillars Appear Transparent

Jaguar Unveils 360 Virtual Windshield Making Car Pillars Appear Transparent

Buzz60 (Dec. 17, 2014) Jaguar unveils a virtual 360 degree windshield that may be the most futuristic automotive development yet. Jen Markham explains. Video provided by Buzz60
Powered by NewsLook.com
BlackBerry Launches Classic Smartphone

BlackBerry Launches Classic Smartphone

AP (Dec. 17, 2014) BlackBerry is returning to its roots with a new smartphone called the Classic, featuring a traditional keyboard at a time when rival Apple and Android phones - and most smartphone customers - have embraced touch screens. (Dec. 17) Video provided by AP
Powered by NewsLook.com
The Future of Work, Skills & Careers in a Digital World-Dr. Tracy Wilen

The Future of Work, Skills & Careers in a Digital World-Dr. Tracy Wilen

Working Mother (Dec. 16, 2014) 2014 Worklife Congress Video provided by Working Mother
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:

Strange & Offbeat Stories


Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins