iPhone Hacking Raises Security Concerns for all Smartphone Users

Security analysts have long predicted that hackers who routinely pester computer users would eventually target smart phones, whose advanced network connections and operating systems continue to become more computer-like. Indeed, smart-phone virus outbreaks have been reported in Europe and Asia.

This week Independent Security Evaluators (ISE), a U.S. independent testing lab, dramatized the looming danger by piercing the defenses of the much-vaunted iPhone. (ISE is the lab whose help Consumer Reports seeks for our evaluations of security software. See our report on how we test antivirus software and look for our 2007 State of the Net report, which posts to ConsumerReports.org in early August.)

See our complete coverage on:

• Apple's iPhone
• Internet and online security risks

Some telecom experts believed the iPhone was relatively immune from such attacks because of the limited access Apple granted third-party developers to iPhone's operating system (a stripped-down version of the one that runs on Macs), and because iPhone's Safari Web browser lacks the ability to use plug-ins, such as Flash, a primary entry point for Web-borne attacks.

Yet ISE was able to hack into a New York Times reporter's iPhone when it (voluntarily) visited a special Web site they created, which uploaded malicious software and gave the "hackers" unlimited access to files and phone functions. (Note: The embedded link will take you to the New York Times Web site, which may display an online ad before presenting its story on hacking the iPhone.)

Besides downloading contact information and recent text messages, ISE claims it was able to seize control of the phone, and program it to dial any number, send any text message—-even turn the iPhone into a bugging device to eavesdrop on anyone within earshot. More important, while ISE's focus was the iPhone, their main point is cell-phone providers need spruce up their security act. More details of ISE's iPhone effort are available on https://www.exploitingiphone.com/.

ISE has sent its recommendations for security patches to Apple. In the meantime, it offers these tips for iPhone and other smart-phone owners to minimize risk:

• Only visit Web sites you know
• Only use Wi-Fi networks you trust
• Don't open Web links from e-mails

--Mike Gikas

—Paul Eng