Is your iPhone safe from hackers?

Consumer Reports News: February 04, 2010 02:41 PM

An example of a verification screen hackers
might use to gain access to your iPhone.
Source: Cryptopath

Cryptopath, a security Weblog devoted to digital security, claims it's discovered a back door by which hackers can change the settings on your iPhone or iPod Touch. The vulnerability supposedly allows cybercriminals to tinker with the device's Wi-Fi connections, e-mail, and applications; block Internet access entirely; or redirect your Internet searches to any server.

That last hack could enable cyber criminals to obtain passwords to your bank accounts, social security number, and other important private information.

The security vulnerability is actually a window Apple left open to allow IT managers to simultaneously set up multiple iPhones via the Safari Web browser. It's also how some iPhone users override the device's settings to establish their phone as a wireless modem for a laptop. This modem function, also known as tethering, is a common smart-phone capability. But AT&T does not allow iPhone tethering; hence, the workaround by some iPhone owners.

Hackers, the site claims, can use the same entry point to alter the device's proxy settings and root certificates to cause havoc.

The Cryptopath post, "iPhone certificate flaws," is itself a bit cryptic. But here's how the hack seems to work: By creating an official-looking over-the-air (OTA) security update, anonymous hackers gained access when the unsuspecting user tapped the accept button. (shown)

The problem doesn't appear to be widespread, and Cryptopath says the only solution is for Apple to exercise more control over who can tinker with an iPhone's or iPod Touch's settings over the air.

Our advice: Don't accept any OTA updates except those from the App Store or operating-system updates via iTunes on your computer.

—Mike Gikas