Apple says security flaw could allow hackers to beat iPhone encryption

SAN FRANCISCO: A major flaw in Apple Inc software for mobile devices could allow hackers to intercept email and other communications that are meant to be encrypted, the company said on Friday, and experts said Mac computers were even more exposed.

If attackers have access to a mobile user's network, such as by sharing the same unsecured wireless service offered by a restaurant, they could see or alter exchanges between the user and protected sites such as Gmail and Facebook. Governments with access to telecom carrier data could do the same.

"It's as bad as you could imagine, that's all I can say," said Johns Hopkins University cryptography professor Matthew Green.

Apple did not say when or how it learned about the flaw in the way iOS handles sessions in what are known as secure sockets layer or transport layer security, nor did it say whether the flaw was being exploited.

But a statement on its support website was blunt: The software "failed to validate the authenticity of the connection."

Apple released software patches and an update for the current version of iOS for iPhone 4 and later, 5th-generation iPod touches, and iPad 2 and later.

Without the fix, a hacker could impersonate a protected site and sit in the middle as email or financial data goes between the user and the real site, Green said.

After analysing the patch, several security researchers said the same flaw existed in current versions of Mac OSX, running Apple laptop and desktop computers. No patch is available yet for that operating system, though one is expected soon.

Because spies and hackers will also be studying the patch, they could develop programs to take advantage of the flaw within days or even hours.

The issue is a "fundamental bug in Apple's SSL implementation," said Dmitri Alperovich, chief technology officer at security firm CrowdStrike Inc. Adam Langley, a senior engineer at Google, agreed with CrowdStrike that OS X was at risk.

Apple did not reply to requests for comment. The flaw appears to be in the way that well-understood protocols were implemented, an embarrassing lapse for a company of Apple's stature and technical prowess.

The company was recently stung by leaked intelligence documents claiming that authorities had 100 per cent success rate in breaking into iPhones.

Friday's news suggests that enterprising hackers could have had great success as well if they knew of the flaw.

New pictures of purported low-cost iPhone's back shell show a Blue variant

THE NEXT iPHONE?!

Anupam Saxena, July 03, 2013

New higher quality images of the purported back case of the low-cost iPhone have surfaced online, adding a Blue colour shell.

The images that appeared on French website, Nowhereelse.fr reveal back shells that sport a glossy finish and include metal contacts/ attachment points for connecting components. 

It appears that they're final production units as evident from the plastic covering they're wrapped in. However, the images do not reveal any new details and match the ones that surfaced a few days backbarring that they also feature a new Blue shell in addition to the Red, Green and Yellow shells depicted in the previous image.

As apparent, the back shells sports a black Apple logo, a round hole for the camera lens, another one for the flash and a hole for the noise cancellation microphone. As previously noted, the internal panel sports contacts/ attachment points that can connect to components such as the motherboard and Lightning connector port at almost exactly the same points where they're positioned on the iPhone 5. 

Another picture of the rear shell that appeared in April, shared by case manufacturer Tactus, matches these shells in terms of the overall design, including the position of the camera lens, microphone and flash holes, though it was White in colour. The case maker had said that the cheaper iPhone would be available in Black, White, Blue, Red and Yellow colours, citing the 'factory producing this secretive project' as a source. Tactus had informed that the actual phone might be around 9mm thick, 120mm in height and around 62-65mm in width, making it both taller and wider than the iPhone 4 and 4S.

Apple focused Japanese blog Macotakara had also suggested that the new low-cost iPhone will come in multiple colours. It cited two sources that suggested different colours for the purported budget iPhone. While one source mentioned that it would come in Navy, Gold Orange, White, and Grey colours, the second one suggested White, Pink, Green, Blue, and Yellow-Orange  colours. The mockup offered by the site also featured the same design elements and positioning of components, though the colours were a bit different.

KGI Securities analyst Ming-Chi Kuo had also confirmed in one of his research reports a plastic shell for the budget iPhone and had said that Apple was finding it difficult to keep the plastic shell of the low-cost iPhone as thin as it would like.